u/DaithiG

Hi,

We have one subscription that has our Azure Arc enabled machines with the Defender for Cloud P2 applied.

Sentinel is deployed in another subscription. Defender isn't enabled for the log workspace.

My understanding is that if we use the Windows Security Events via AMA to collect events from the Arc Machines, the 500mb benefit won't apply?

I have to enable Data Collection on the Sentinel Workspace in Defender for Cloud, but the sentinel workspace doesn't have those servers reporting to them?

Does that make sense? This is very confusing for me but maybe I'm over complicating it

Hi all,

We're looking at FortiSASE to possibly replace Cato SASE (a different debate).

What mechanisms does FortSASE have to ensure only corporate devices connect? Does it support Entra Conditional Access Policies and Compliance checks?

Can we use our machine certificate and authenticate based on that?

Hi all

We're using Sophos Intercept XDR for a while but have E5 licences. We're also moving to Sentinel for our SIEM.

While I wouldn't move just because of Sentinel, I'm not sure it makes sense to keep using Sophos either.

Sophos does have better application and device control but we could look at different tools for that (we also have AdminByRequest and don't allow admin rights).

Would love if anyone went through similar and/or could just share thoughts.

Hi,

I'm a bit lost here. We have a domain controller VM in Azure. I've enabled Defender for Cloud P2 at the subscription layer. I can see the MDE agent is enabled in extenstions.

When I check the Defender XDR Portal, it tells me the DC isn't enrolled to MDE security settings. This is after a few days too.

We have two on prem DCs that are showing ok but they have the "on prem" Defender licence, not Defender for Cloud.

Also, do we have to configure the actual defender settings via a GPO? The server setup seems very convoluted versus onboarding to Intune.

Hi all,

I see we can create certs using Intune Cloud PKI now with our E5 licences. I created a Root cert in Intune and then went to create the Issue Certificate Authority but it never finds the Root Cert I created?

I pick the Root CA Source as Intune but the Root CA remains blank when I search.

Is it a matter of time? It's over four hours now.

Are Microsoft still limiting when Data Lakes can be created? It seems incredible that this very useful service can only be setup depending on Microsoft.

Hi,

If we apply Bios updates that update the TPM, it will cause the user's PIN to fail on reboot and we need to reset it. At least on our Dell laptops.

Has anyone come across this problem and has any workaround other than providing the user a password again and resetting the PIN?

Hi all,

I've setup an on prem Linux server, with rsyslog, that will just be used to forward syslog events from our firewall. I have it onboarded to Azure Arc and have Sentinel can receive the logs.

I'm just not clear on disk space usage. The events will be sent to Sentinel, but I'm not clear if I still have to manage the on prem disk space using something like log rotate.

Though I am looking at something like Cribl after we do our network refresh

Hi,

Occasionally we have issues with laptops and it requires the motherboard to be replaced.

This causes the device to lose enrollment and various other issues like user sign in. Sometimes dsregcmd options such as leave and join will work. Sometimes it will require a reset of the device.

Is there anything we can do to ease this issue or are those the best options?

Hi all,

We potenially will have a full Forti stack, firewalls, switches, and APs. We're looking at managed support, mainly for critical security issues and firmware updates.

We are looking locally but I noticed that Fortinet have their own managed service - Managed FortiGate Service. This might be ideal for us.

However it's not quite clear if they will implement mitigations or firmware updates, it might need  FortiGuard SOCaaS.

Has anyone used this service here and have any comments. We'll probably go with a local vendor in any case, but just curious about this service.