5 ms·

the details here are insanely thin on the how. is this rolled out to every windows 10/11 os in the next security kb? is this a windows feature that can be enabl

the details here are insanely thin on the how. is this rolled out to every windows 10/11 os in the next security kb? is this a windows feature that can be enabled by enterprise editing only? do I need defender atp license for it? can I fw the data to my detection engine at my enterprise like normal or does this go to a cloud console in azure somewhere first? is this designed to be available to enterprises, or data to improve Microsoft's defender product? if ms is getting this data, how the hell can they afford the disk space?! my bro implementation was 250GB/h of disk space for 20k endpoints. I can only fathom what all windows agents would generate. soo many questions around this still

encryptluks2 4y ago
What I gather and maybe I'm wrong, but it sounds like this is a third party component and not something that is shipped with Windows by default. The post was full of so much BS I had to click off it quickly
worewood 4y ago
That one is easy, having worked with space-constrained data collection myself (not personal data, it's sensor data so no ethical concerns). You do a "pre-summarization" of the data on the client side, and just send a report to the mothership. Consequence of this is that it will result in using CPU resources of the client - and that explains why the telemetry service eats so much of it on Windows.
Godel_unicode 4y ago
It’s being rolled out as a capability in MDE: https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-for-endpoint-announcements-at-microsoft/ba-p/3646025 https://techcommunity.microsoft.com/t5/microsoft-defender-fo...
nixgeek 4y ago
There’s some information here on how Defender approaches this (processing data, nothing specific to Zeek) and which talks about the scale — many petabytes of data and trillions of datapoints. https://customers.microsoft.com/en-us/story/1540745195786192446-microsoft-other-unsegmented-azure-en-united-states https://customers.microsoft.com/en-us/story/1540745195786192...
jpalomaki 4y ago
These are paid products/services. Interestingly you can get access also as small business. Just purchase the Microsoft 365 E5 license. Price is something like 50-70€/month, 12M subscription. This can be convenient, if you have requirements to use this kind of tools from your customers. And they actually log a lot of stuff. When enabled you can see (on cloud) pretty detailed information on what has happened to workstation.

encryptluks2 4y ago

What I gather and maybe I'm wrong, but it sounds like this is a third party component and not something that is shipped with Windows by default. The post was full of so much BS I had to click off it quickly

worewood 4y ago

That one is easy, having worked with space-constrained data collection myself (not personal data, it's sensor data so no ethical concerns). You do a "pre-summarization" of the data on the client side, and just send a report to the mothership. Consequence of this is that it will result in using CPU resources of the client - and that explains why the telemetry service eats so much of it on Windows.

Godel_unicode 4y ago

It’s being rolled out as a capability in MDE: https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-for-endpoint-announcements-at-microsoft/ba-p/3646025 https://techcommunity.microsoft.com/t5/microsoft-defender-fo...

nixgeek 4y ago

There’s some information here on how Defender approaches this (processing data, nothing specific to Zeek) and which talks about the scale — many petabytes of data and trillions of datapoints. https://customers.microsoft.com/en-us/story/1540745195786192446-microsoft-other-unsegmented-azure-en-united-states https://customers.microsoft.com/en-us/story/1540745195786192...

jpalomaki 4y ago

These are paid products/services. Interestingly you can get access also as small business. Just purchase the Microsoft 365 E5 license. Price is something like 50-70€/month, 12M subscription. This can be convenient, if you have requirements to use this kind of tools from your customers. And they actually log a lot of stuff. When enabled you can see (on cloud) pretty detailed information on what has happened to workstation.