Page 142 of the DSE Cybersecurity knowledge center, with source-backed guidance and practical next steps.
Source-backed guidance for identity, vulnerability reduction, ransomware readiness, detection, response, and recovery.
A standalone sensor needs port mirroring or a network TAP to see domain-controller network traffic. Microsoft directs organizations using port mirroring to configure each monitored domain controller as a traffic source and coordinate with networking or virtualization teams.
Read the playbook
Windows event forwarding can enhance standalone-sensor detections with events that are unavailable from domain-controller network traffic. Standalone sensors still do not collect ETW entries used by multiple detections, and Microsoft recommends the standard sensor for full coverage.
Read the briefing
The document defines required message syntax for a standalone sensor to listen for supported SIEM event types. Its RSA Security Analytics example uses a Windows event 4776 message and treats the standard RFC 3164 syslog header prefix as optional.
Read the checklist
Defender for Identity sensors parse specific Windows event logs from domain controllers, AD FS, AD CS, and Microsoft Entra Connect servers, which must have the correct advanced audit policy settings.
Read the explainer
Portal-based migration from sensor v2.x to v3.x automatically completes switchover while retaining server configuration and monitoring without downtime or duplicate data.
Read the guide
A first sensor activation can take up to an hour to show as Running, while subsequent activations can appear within five minutes. Microsoft directs administrators to confirm Defender for Identity events on the device timeline and user data for the newly onboarded domain.
Read the playbook
After connection, CyberArk identity data is added to the identity inventory and correlated with on-premises Active Directory and Microsoft Entra identities.
Read the briefing
The connection uses connector APIs to provide Defender for Identity visibility into and control over CyberArk identities. Microsoft requires the documented CyberArk role plus Microsoft Entra or Defender role-based access permissions before connection.
Read the checklist
Defender for Identity ingests Okta user and activity data and correlates it with identity data from Active Directory and Microsoft Entra ID. The integration provides a centralized view of user activity, posture risks, and suspicious behavior and supports remediation actions.
Read the explainer
The connector collects Okta system logs once and shares them with supported Microsoft security products to reduce API use and duplicate collection.
Read the guide