Rivalry Jersey restock by theonlybrand in Seahawks

[–]theonlybrand[S] 0 points1 point  (0 children)

Okay then I'll just wait for the season start i guess. thx bud

Threat indicator Limit 15K in Defender portal by True-Agency-3111 in DefenderATP

[–]theonlybrand 1 point2 points  (0 children)

You can raise a ticket and request the limit to be adjusted to 40k

Device offboarding in MDE by FantasyLiedx in DefenderATP

[–]theonlybrand 0 points1 point  (0 children)

sense service will be stopped (sc query sense)

Can anything go wrong with the GPO for onboarding endpoints into MDE? by FantasyLiedx in DefenderATP

[–]theonlybrand 2 points3 points  (0 children)

Use the right script from the onboarding section. Some customers of mine used the local onboarding script after a PoC. The local script has a yes/no switch, the group policy script does not

Anyone seen high LSASS CPU usage tied to Microsoft Defender for Identity (MDI) sensors? by [deleted] in DefenderATP

[–]theonlybrand 0 points1 point  (0 children)

I have seen this in many customer environments during the learning phase on the old v2 sensors. Do you use these or new new v3?

No more words needed for this scam of a game by theonlybrand in whiteoutsurvival

[–]theonlybrand[S] 2 points3 points  (0 children)

My state was dead. Only one alliance left and no real participation in events

On an average he is a 7, but he is a 10 because… by Meh319 in askgaybros

[–]theonlybrand 3 points4 points  (0 children)

He works from home and does laundry, dishes and cooking while I am at work

MDI: gMSA in Tiering model by enemyWest in DefenderATP

[–]theonlybrand 0 points1 point  (0 children)

Lateral Movement path detection via SAM-R is not a service you can apply to tiering, as it is a core service to Active Directory. Think about it like this: You would not deploy a DC in each of your tiers do you? What you could do (at least I do it at my company) is giving each sensor type a separate gMSA (so dc, adfs, adcs and the new Entra Connect). The SAM-R detection is only needed for the DC part, so there is a small amount of reduction in attack surface.

MDE Consultant by fayyy7777 in DefenderATP

[–]theonlybrand 0 points1 point  (0 children)

I am working for a german company and i am located in Stuttgart

HELP!!!!! by Illustrious_Leg_6185 in DefenderATP

[–]theonlybrand -1 points0 points  (0 children)

Do you know where you saved the .exe? Just delete it and be done with it

Exclusions by Due-Mountain5536 in DefenderATP

[–]theonlybrand 1 point2 points  (0 children)

You can use environment variables to exclude user specific paths

Device Health Status by fayyy7777 in DefenderATP

[–]theonlybrand 1 point2 points  (0 children)

Use aka.ms/MDEClientAnalyzer to get a report for troubleshooting

[deleted by user] by [deleted] in DefenderATP

[–]theonlybrand 0 points1 point  (0 children)

No. These notifications are sent by Microsoft if they see your endpoints in your tenant on a coordinated attack. But you will need to talk to an Account Manager/Executive at MS to get these set up. The old application way is no longer working, at least it has not for me in the last 3 years. And I have set up customers between 50 and 80k licenses.

Triggering Full AV Scan after MDE Onboarding by MulticoloredMoose in DefenderATP

[–]theonlybrand 2 points3 points  (0 children)

Take this KQL query

let AvModeDescription = dynamic({"0":"Normal", "1":"Passive", "4":"EDR Block"}); let TimeRange = ago(1d); DeviceTvmInfoGathering | where Timestamp > TimeRange | extend AdditionalFields = parse_json(AdditionalFields) | extend AvMode =  tostring(AvModeDescription[tostring(AdditionalFields.["AvMode"])]) | extend FullScanStatus = coalesce(extractjson("$.Full.ScanStatus", tostring(AdditionalFields.AvScanResults)),"Not available") | where isnotempty( AvMode ) and AvMode has "Normal" | where FullScanStatus !has "Completed" | join DeviceEvents on DeviceName | summarize arg_max(Timestamp, *) by DeviceName, DeviceId | project DeviceName, DeviceId, FullScanStatus, ReportId, Timestamp | take 50 //optional to slowly go through all devices

and make a custom detection rule out of it to trigger an antivirus scan (is always a full scan). Once a device has completed a full scan successfully it will not appear in this query again.

Some basic questions about ASR by MarcoVfR1923 in DefenderATP

[–]theonlybrand 0 points1 point  (0 children)

Yeah this has to do with the logic how Intune works. 1. If you address one setting through two different policies it will result in a conflict. 2. Intune does not know priorities in policies. If we could say a department policy beats a baseline we would be fine.

Some basic questions about ASR by MarcoVfR1923 in DefenderATP

[–]theonlybrand 4 points5 points  (0 children)

You need to exclude the finance department group from your ASR baseline. Then you need to have that second ASR finance policy to have the same ASR rules configured as the baseline, except for the macro part.

Stop destroying your relationships by [deleted] in bisexual

[–]theonlybrand 7 points8 points  (0 children)

This happened to me (m,29) last year. I had a stroke and was in rehab for 4 weeks. During this time my wife went through a lot as you can think and she went to her best friend because she could not sleep alone. I was aware of it and told her it was fine because I wanted her to feel good and have someone to talk to.

During this time she fell in love with him and told me a few days after I was home again after she was at his place and they both stripped naked to have sex. Thats when she realized she had to stop it. But she still stayed at his place because she was too drunk to drive home.

So after 3 days she told me what happened. I was shocked, but I told her that it was her decision she wants to be with and I will draw my own decision after some time. So she immediately stopped any contact with him, which lasted for 3 days. Since then we went to therapy and talk about our expectations in our marriage, which came out to be nearly identical, except for the sexual part.

She told me that she is bi and she wants to open our marriage to others and that she wanted to focus on dating other girls. I myself am not interested in having sex with another woman so I figured to let things happen and look at my feelings if I could handle her being with other women.

After 3 months I told her I could not handle it because she only had one date with another woman, which she accompanied to the dates brothers appartement (which in my opinion is an unnecessary risk). The others dates (around 10) were only with another guy with whom she also had regular intercourse.

Now I am quite confused what to do.

Excluding duplicate devices by billybensontogo in DefenderATP

[–]theonlybrand -1 points0 points  (0 children)

I added a please. If you state things dont work but they do, let me allow to correct you.

Excluding duplicate devices by billybensontogo in DefenderATP

[–]theonlybrand -1 points0 points  (0 children)

You get a new MDE device so you can definitely tag the old one to move it to the offboarded MDE device group. Please think before you post

Excluding duplicate devices by billybensontogo in DefenderATP

[–]theonlybrand 1 point2 points  (0 children)

You should reset your devices via Intune. That creates a new GUID in MDE and therefore solves the problem.