Microsoft Defender for Endpoint Explained: Onboarding, Advanced Hunting in KQL, Isolation and Live Response

Microsoft Defender for Endpoint (MDE) is the EDR many organisations already own through Microsoft 365 E5 licensing, which makes it one of the most common EDR tools security analysts actually use. In interviews, the questions are usually practical: how you would onboard devices, hunt with KQL and respond to an alert.

What it is

Defender for Endpoint is the endpoint part of Microsoft Defender XDR, managed in the Microsoft Defender portal. It covers Windows, macOS, Linux, Android and iOS. It comes as Plan 1, Plan 2 and Defender for Business; Microsoft 365 E5 includes Plan 2, which has EDR, advanced hunting and automated response. Endpoint alerts are correlated with identity, email and cloud app alerts into incidents in the same portal.

How it works

The sensor, built into recent Windows versions and installed as an agent elsewhere, records process, file, network, registry and logon events and sends them to the service. Advanced hunting exposes them as tables such as DeviceProcessEvents, DeviceNetworkEvents and DeviceFileEvents, queried in KQL. Microsoft's table reference notes that SHA256 is usually not populated in DeviceProcessEvents, so hunt on SHA1 there.

How to use it

Day one: onboard in rings

In the Defender portal, open the endpoint onboarding settings, choose the operating system, connectivity type and deployment method (Intune, Configuration Manager, Group Policy or a script), and roll out in rings: an evaluation group of about 50 devices, then a pilot, then everyone. Microsoft's exit criteria for each ring include running a detection test to prove alerts actually arrive.

Week one: learn to hunt

A first useful query finds encoded PowerShell, a common sign of hands-on-keyboard activity:

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("-enc", "-EncodedCommand")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine,
          InitiatingProcessFileName
| order by Timestamp desc

Queries return at most 100,000 rows and stop after 10 minutes, and advanced hunting keeps 30 days of data; longer retention needs Microsoft Sentinel. A query that proves useful can be saved as a custom detection rule.

Every day: respond proportionately

• Collect an investigation package before changing a device, so you keep the evidence.
• Live response opens an audited remote shell. It must be enabled in advanced features (separately for servers). Basic commands such as processes, connections and getfile are for investigation; advanced commands such as run and putfile need extra permission. Limits include one session per device and 50 per tenant.
• Isolate a compromised device (fully, or selectively if a full isolation would cut off proxies you need for recovery). Contain unmanaged devices so onboarded machines refuse to talk to them.
• Automated investigation: from 1 September 2026, Microsoft no longer runs automated investigation and response as a separate experience that can be triggered manually; its capabilities run in the default antivirus stack. Update runbooks that relied on the old flow.

Where it stops

• Licensing decides features. Plan 1 lacks EDR and advanced hunting.
• Thirty days of hunting data. Older investigations need data exported to a SIEM.
• Coverage is per onboarded device. Unmanaged devices can be contained but not investigated.
• Live response is powerful. Unsigned script execution is optional and risky; keep it off unless you need it, and restrict who can run advanced commands.

How it comes up in interviews

• "Write a KQL query to find X." Know the main tables and operators (where, project, summarize, join).
• "An alert shows credential dumping on a server. Walk me through your response." Scope with hunting, collect a package, isolate, reset credentials, then look for lateral movement.
• "How would you roll out an EDR to 20,000 devices without breaking anything?" Rings, detection tests, exclusions reviewed, and a rollback plan.

Sources

Checked on 13 November 2026: Microsoft Learn pages for Microsoft Defender for Endpoint overview, onboarding, automation levels in automated investigation and remediation, respond to device alerts, live response, advanced hunting overview, and the DeviceProcessEvents table reference.