Microsoft Defender for Endpoint

Coordinate Threat Response Through Email and Endpoint Intelligence

Connect Mimecast email security intelligence with Microsoft Defender endpoint protection to coordinate automated threat response across your entire security infrastructure. Transform email-borne threats into preventative endpoint actions. Deploy coordinated response capabilities that accelerate threat containment while ensuring consistent policy enforcement throughout complex multi-vector attack scenarios and investigation processes.

Solution overview

1. Mimecast periodically obtains endpoint protection alerts and incidents from Defender.
2. Each malware based event is associated with a user and updates the individual risk score.
3. Users with high-risk scores can be sent behavioral nudges or additional training.

Use Cases

• Uncover your greatest sources of human risk

  Surface your organization's riskiest employees through phishing simulation performance data. Correlate Microsoft Attack Simulation phishing simulation results with email security events providing actual attack patterns rather than theoretical vulnerabilities.

• Focus intervention on the employees that need it most

  Analyze patterns of missed phishing simulation across your organization to identify departments or roles with elevated risk exposure for targeted security training and behavioral interventions.

• Adaptive Policies

  Identify users with recurring failed phishing simulation events to automatically adjust email security and Incydr policies, enable stricter scanning, require access justification, or remove corporate resource access.

Key benefits

1. Enhanced Risk Visibility by incorporating endpoint protection telemetry into the Human Risk Management Platform, providing a more comprehensive view of user-related security events and enabling more accurate risk assessment calculations.
2. Multi-Factor Risk Assessment providing a multi-dimensional approach to risk evaluation and enabling more precise behavioral response targeting.