Hands-on playbook · 55 min
Microsoft Defender for Endpoint Playbook: KQL Hunting, Custom Detections and Live Response
A hands-on Defender for Endpoint deep dive: verify onboarding, hunt with KQL, turn a hunt into a custom detection that meets every requirement, choose near-real-time or scheduled runs, attach response actions safely, run live response from a controlled script library, and check Linux sensors.
- Verify onboarding with Microsoft's detection test and the Linux mdatp health checks
- Hunt with KQL across process, network and logon tables
- Turn a hunt into a custom detection that returns the columns the rule engine needs
- Make a detection eligible for near-real-time runs, and know when it cannot be
- Attach isolation and other response actions without isolating half the fleet
- Run live response from a reviewed script library with the right limits in mind
- Adjust runbooks for the September 2026 change to automated investigation
- 01Under the hood
- 02Hands-on lab
- 03Which table answers which question
- 04Recipes
- 05Rollout runbook
- 06Troubleshooting
- 07Interview drill
- 08Sources
Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, hands-on tool playbooks, the complete practice-test bank, and the downloadable security field guides.
6 months · One payment · No auto-renewal
An independent playbook for interview preparation and learning. AISecurityInterviews is not affiliated with or endorsed by Microsoft, and product names are trademarks of their owners. Use these procedures only on systems you own or are authorised to test, and check the vendor's documentation before changing production.