DE · EN

Call us

build 6ddc7a35 | content blog-content@417154f · 338 posts | profiles 32 · corpus 315 | ● 0 skipped | built 2026-10-21 12:35 UTC format run

$ soultec get solution/endpoint-security/microsoft-defender-atp -o yaml$ soultec get solution/endpoint-security/microsoft-defender-atp -o json$ soultec get solution/endpoint-security/microsoft-defender-atp -o toml$ soultec get solution/endpoint-security/microsoft-defender-atp -o xml$ python3 endpoint-security/microsoft-defender-atp.pyPS> ./endpoint-security/microsoft-defender-atp.ps1$ go run endpoint-security/microsoft-defender-atp.go$ node endpoint-security/microsoft-defender-atp.js

apiVersion: soultec.ch/v1kind: Solutionmetadata: name: endpoint-security/microsoft-defender-atp locale: en labels: vendor: Microsoft Defender for Endpoint capability/endpoint-security: 2.73 capability/security: 1.91 vendor/microsoft: 2.61 annotations: source: src/content/solutions/en/endpoint-security/microsoft-defender-atp.md route: /en/solutions/endpoint-security/microsoft-defender-atp/ schema: /nerd/schema/solutions.json markdown: /en/solutions/endpoint-security/microsoft-defender-atp.mdspec: title: Microsoft Defender tags: [endpoint-security, security] vendors: [microsoft] summary: >- Endpoint detection and response from the Microsoft stack. If you already have M365 E5, you have usually already licensed it. photoNeed: A security console on screen with real alerts in it, being triaged stub: false draft: false kind: product addon: false vendorName: Microsoft Defender for Endpoint status: current sections: - heading:

What it is

body: | Defender for Endpoint reads what actually happens on a device and reports sequences that do not fit. The analysis runs in Microsoft's cloud, and the signals come from the operating system itself rather than from an agent bolted on afterwards. - heading:

What it is for

body: | Estates that are on Microsoft anyway. The biggest practical advantage is that identity, device management and endpoint security use the same groups and the same console. - heading:

What to watch

body: | Two things. Licensing first: the full feature set depends on the plan. Then the first few weeks: backup agents, monitoring and home-grown scripts all look like attackers to an EDR. Those exceptions should be documented.status: corpus: 315 services: - {ref: services/modern-workplace, score: 0.81} - {ref: services/security, score: 0.75} - {ref: services/managed-security, score: 0.48} - {ref: services/cloud, score: 0.41} experts: - {ref: experts/oliver-erismann, score: 0.43} - {ref: experts/matthias-frech, score: 0.36} - {ref: experts/steven-rodenburg, score: 0.36} neighbours: - {ref: solutions/endpoint-security, relation: parent} - {ref: solutions/igel/addon/90meter, score: 0.70} - {ref: solutions/endpoint-security/crowdstrike-falcon, score: 0.70} search: /en/search.json

{ "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": { "name": "endpoint-security/microsoft-defender-atp", "locale": "en", "labels": { "vendor": "Microsoft Defender for Endpoint", "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/microsoft": 2.61 }, "annotations": { "source": "src/content/solutions/en/endpoint-security/microsoft-defender-atp.md", "route": "/en/solutions/endpoint-security/microsoft-defender-atp/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security/microsoft-defender-atp.md" } }, "spec": { "title": "Microsoft Defender", "tags": [ "endpoint-security", "security" ], "vendors": [ "microsoft" ], "summary": "Endpoint detection and response from the Microsoft stack. If you already have M365 E5, you have usually already licensed it.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": false, "draft": false, "kind": "product", "addon": false, "vendorName": "Microsoft Defender for Endpoint", "status": "current", "sections": [ { "heading": "

What it is

", "body": "Defender for Endpoint reads what actually happens on a device and reports sequences that do\nnot fit. The analysis runs in Microsoft's cloud, and the signals come from the operating\nsystem itself rather than from an agent bolted on afterwards." }, { "heading": "

What it is for

", "body": "Estates that are on Microsoft anyway. The biggest practical advantage is that identity,\ndevice management and endpoint security use the same groups and the same console." }, { "heading": "

What to watch

", "body": "Two things. Licensing first: the full feature set depends on the plan. Then the first few\nweeks: backup agents, monitoring and home-grown scripts all look like attackers to an EDR.\nThose exceptions should be documented." } ] }, "status": { "corpus": 315, "services": [ { "ref": "services/modern-workplace", "score": "0.81" }, { "ref": "services/security", "score": "0.75" }, { "ref": "services/managed-security", "score": "0.48" }, { "ref": "services/cloud", "score": "0.41" } ], "experts": [ { "ref": "experts/oliver-erismann", "score": "0.43" }, { "ref": "experts/matthias-frech", "score": "0.36" }, { "ref": "experts/steven-rodenburg", "score": "0.36" } ], "neighbours": [ { "ref": "solutions/endpoint-security", "relation": "parent" }, { "ref": "solutions/igel/addon/90meter", "score": "0.70" }, { "ref": "solutions/endpoint-security/crowdstrike-falcon", "score": "0.70" } ], "search": "/en/search.json" }}

apiVersion = "soultec.ch/v1"kind = "Solution"[metadata]name = "endpoint-security/microsoft-defender-atp"locale = "en"[metadata.labels]vendor = "Microsoft Defender for Endpoint""capability/endpoint-security" = 2.73"capability/security" = 1.91"vendor/microsoft" = 2.61[metadata.annotations]source = "src/content/solutions/en/endpoint-security/microsoft-defender-atp.md"route = "/en/solutions/endpoint-security/microsoft-defender-atp/"schema = "/nerd/schema/solutions.json"markdown = "/en/solutions/endpoint-security/microsoft-defender-atp.md"[spec]title = "Microsoft Defender"tags = ["endpoint-security", "security"]vendors = ["microsoft"]summary = "Endpoint detection and response from the Microsoft stack. If you already have M365 E5, you have usually already licensed it."photoNeed = "A security console on screen with real alerts in it, being triaged"stub = falsedraft = falsekind = "product"addon = falsevendorName = "Microsoft Defender for Endpoint"status = "current"[[spec.sections]]heading = "

What it is

"body = '''Defender for Endpoint reads what actually happens on a device and reports sequences that donot fit. The analysis runs in Microsoft's cloud, and the signals come from the operatingsystem itself rather than from an agent bolted on afterwards.'''[[spec.sections]]heading = "

What it is for

"body = '''Estates that are on Microsoft anyway. The biggest practical advantage is that identity,device management and endpoint security use the same groups and the same console.'''[[spec.sections]]heading = "

What to watch

"body = '''Two things. Licensing first: the full feature set depends on the plan. Then the first fewweeks: backup agents, monitoring and home-grown scripts all look like attackers to an EDR.Those exceptions should be documented.'''[status]corpus = 315search = "/en/search.json"[[status.services]]ref = "services/modern-workplace"score = "0.81"[[status.services]]ref = "services/security"score = "0.75"[[status.services]]ref = "services/managed-security"score = "0.48"[[status.services]]ref = "services/cloud"score = "0.41"[[status.experts]]ref = "experts/oliver-erismann"score = "0.43"[[status.experts]]ref = "experts/matthias-frech"score = "0.36"[[status.experts]]ref = "experts/steven-rodenburg"score = "0.36"[[status.neighbours]]ref = "solutions/endpoint-security"relation = "parent"[[status.neighbours]]ref = "solutions/igel/addon/90meter"score = "0.70"[[status.neighbours]]ref = "solutions/endpoint-security/crowdstrike-falcon"score = "0.70"

<?xml version="1.0" encoding="UTF-8"?><manifest kind="Solution"> <apiVersion>soultec.ch/v1</apiVersion> <metadata> <name>endpoint-security/microsoft-defender-atp</name> <locale>en</locale> <labels> <vendor>Microsoft Defender for Endpoint</vendor> <entry key="capability/endpoint-security">2.73</entry> <entry key="capability/security">1.91</entry> <entry key="vendor/microsoft">2.61</entry> </labels> <annotations> <source>src/content/solutions/en/endpoint-security/microsoft-defender-atp.md</source> <route>/en/solutions/endpoint-security/microsoft-defender-atp/</route> <schema>/nerd/schema/solutions.json</schema> <markdown>/en/solutions/endpoint-security/microsoft-defender-atp.md</markdown> </annotations> </metadata> <spec> <title>Microsoft Defender</title> <tags> <item>endpoint-security</item> <item>security</item> </tags> <vendors> <item>microsoft</item> </vendors> <summary>Endpoint detection and response from the Microsoft stack. If you already have M365 E5, you have usually already licensed it.</summary> <photoNeed>A security console on screen with real alerts in it, being triaged</photoNeed> <stub>false</stub> <draft>false</draft> <kind>product</kind> <addon>false</addon> <vendorName>Microsoft Defender for Endpoint</vendorName> <status>current</status> <sections> <section> <heading>

What it is

</heading> <body>Defender for Endpoint reads what actually happens on a device and reports sequences that donot fit. The analysis runs in Microsoft's cloud, and the signals come from the operatingsystem itself rather than from an agent bolted on afterwards. </body> </section> <section> <heading>

What it is for

</heading> <body>Estates that are on Microsoft anyway. The biggest practical advantage is that identity,device management and endpoint security use the same groups and the same console. </body> </section> <section> <heading>

What to watch

</heading> <body>Two things. Licensing first: the full feature set depends on the plan. Then the first fewweeks: backup agents, monitoring and home-grown scripts all look like attackers to an EDR.Those exceptions should be documented. </body> </section> </sections> </spec> <status> <corpus>315</corpus> <services> <item> <ref>services/modern-workplace</ref> <score>0.81</score> </item> <item> <ref>services/security</ref> <score>0.75</score> </item> <item> <ref>services/managed-security</ref> <score>0.48</score> </item> <item> <ref>services/cloud</ref> <score>0.41</score> </item> </services> <experts> <item> <ref>experts/oliver-erismann</ref> <score>0.43</score> </item> <item> <ref>experts/matthias-frech</ref> <score>0.36</score> </item> <item> <ref>experts/steven-rodenburg</ref> <score>0.36</score> </item> </experts> <neighbours> <item> <ref>solutions/endpoint-security</ref> <relation>parent</relation> </item> <item> <ref>solutions/igel/addon/90meter</ref> <score>0.70</score> </item> <item> <ref>solutions/endpoint-security/crowdstrike-falcon</ref> <score>0.70</score> </item> </neighbours> <search>/en/search.json</search> </status></manifest>

# Code generated by the soultec.ch build. DO NOT EDIT.import jsonPAGE = { "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": { "name": "endpoint-security/microsoft-defender-atp", "locale": "en", "labels": { "vendor": "Microsoft Defender for Endpoint", "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/microsoft": 2.61, }, "annotations": { "source": "src/content/solutions/en/endpoint-security/microsoft-defender-atp.md", "route": "/en/solutions/endpoint-security/microsoft-defender-atp/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security/microsoft-defender-atp.md", }, }, "spec": { "title": "Microsoft Defender", "tags": ["endpoint-security", "security"], "vendors": ["microsoft"], "summary": "Endpoint detection and response from the Microsoft stack. If you already have M365 E5, you have usually already licensed it.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": False, "draft": False, "kind": "product", "addon": False, "vendorName": "Microsoft Defender for Endpoint", "status": "current", "sections": [ { "heading": "

What it is

", "body": ( "Defender for Endpoint reads what actually happens on a device and reports sequences that do\n" "not fit. The analysis runs in Microsoft's cloud, and the signals come from the operating\n" "system itself rather than from an agent bolted on afterwards." ), }, { "heading": "

What it is for

", "body": ( "Estates that are on Microsoft anyway. The biggest practical advantage is that identity,\n" "device management and endpoint security use the same groups and the same console." ), }, { "heading": "

What to watch

", "body": ( "Two things. Licensing first: the full feature set depends on the plan. Then the first few\n" "weeks: backup agents, monitoring and home-grown scripts all look like attackers to an EDR.\n" "Those exceptions should be documented." ), }, ], }, "status": { "corpus": 315, "services": [ { "ref": "services/modern-workplace", "score": "0.81", }, { "ref": "services/security", "score": "0.75", }, { "ref": "services/managed-security", "score": "0.48", }, { "ref": "services/cloud", "score": "0.41", }, ], "experts": [ { "ref": "experts/oliver-erismann", "score": "0.43", }, { "ref": "experts/matthias-frech", "score": "0.36", }, { "ref": "experts/steven-rodenburg", "score": "0.36", }, ], "neighbours": [ { "ref": "solutions/endpoint-security", "relation": "parent", }, { "ref": "solutions/igel/addon/90meter", "score": "0.70", }, { "ref": "solutions/endpoint-security/crowdstrike-falcon", "score": "0.70", }, ], "search": "/en/search.json", },}if __name__ == "__main__": print(json.dumps(PAGE, indent=2, ensure_ascii=False))

# Code generated by the soultec.ch build. DO NOT EDIT.$Page = [ordered]@{ apiVersion = 'soultec.ch/v1' kind = 'Solution' metadata = [ordered]@{ name = 'endpoint-security/microsoft-defender-atp' locale = 'en' labels = [ordered]@{ vendor = 'Microsoft Defender for Endpoint' 'capability/endpoint-security' = 2.73 'capability/security' = 1.91 'vendor/microsoft' = 2.61 } annotations = [ordered]@{ source = 'src/content/solutions/en/endpoint-security/microsoft-defender-atp.md' route = '/en/solutions/endpoint-security/microsoft-defender-atp/' schema = '/nerd/schema/solutions.json' markdown = '/en/solutions/endpoint-security/microsoft-defender-atp.md' } } spec = [ordered]@{ title = 'Microsoft Defender' tags = @('endpoint-security', 'security') vendors = @('microsoft') summary = 'Endpoint detection and response from the Microsoft stack. If you already have M365 E5, you have usually already licensed it.' photoNeed = 'A security console on screen with real alerts in it, being triaged' stub = $false draft = $false kind = 'product' addon = $false vendorName = 'Microsoft Defender for Endpoint' status = 'current' sections = @( [ordered]@{ heading = '

What it is

' body = @'Defender for Endpoint reads what actually happens on a device and reports sequences that donot fit. The analysis runs in Microsoft's cloud, and the signals come from the operatingsystem itself rather than from an agent bolted on afterwards.'@ } [ordered]@{ heading = '

What it is for

' body = @'Estates that are on Microsoft anyway. The biggest practical advantage is that identity,device management and endpoint security use the same groups and the same console.'@ } [ordered]@{ heading = '

What to watch

' body = @'Two things. Licensing first: the full feature set depends on the plan. Then the first fewweeks: backup agents, monitoring and home-grown scripts all look like attackers to an EDR.Those exceptions should be documented.'@ } ) } status = [ordered]@{ corpus = 315 services = @( [ordered]@{ ref = 'services/modern-workplace' score = '0.81' } [ordered]@{ ref = 'services/security' score = '0.75' } [ordered]@{ ref = 'services/managed-security' score = '0.48' } [ordered]@{ ref = 'services/cloud' score = '0.41' } ) experts = @( [ordered]@{ ref = 'experts/oliver-erismann' score = '0.43' } [ordered]@{ ref = 'experts/matthias-frech' score = '0.36' } [ordered]@{ ref = 'experts/steven-rodenburg' score = '0.36' } ) neighbours = @( [ordered]@{ ref = 'solutions/endpoint-security' relation = 'parent' } [ordered]@{ ref = 'solutions/igel/addon/90meter' score = '0.70' } [ordered]@{ ref = 'solutions/endpoint-security/crowdstrike-falcon' score = '0.70' } ) search = '/en/search.json' }}$Page | ConvertTo-Json -Depth 32

// Code generated by the soultec.ch build. DO NOT EDIT.package mainimport ( "encoding/json" "os")var page = map[string]any{ "apiVersion": "soultec.ch/v1", "kind": "Solution", "metadata": map[string]any{ "name": "endpoint-security/microsoft-defender-atp", "locale": "en", "labels": map[string]any{ "vendor": "Microsoft Defender for Endpoint", "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/microsoft": 2.61, }, "annotations": map[string]any{ "source": "src/content/solutions/en/endpoint-security/microsoft-defender-atp.md", "route": "/en/solutions/endpoint-security/microsoft-defender-atp/", "schema": "/nerd/schema/solutions.json", "markdown": "/en/solutions/endpoint-security/microsoft-defender-atp.md", }, }, "spec": map[string]any{ "title": "Microsoft Defender", "tags": []any{"endpoint-security", "security"}, "vendors": []any{"microsoft"}, "summary": "Endpoint detection and response from the Microsoft stack. If you already have M365 E5, you have usually already licensed it.", "photoNeed": "A security console on screen with real alerts in it, being triaged", "stub": false, "draft": false, "kind": "product", "addon": false, "vendorName": "Microsoft Defender for Endpoint", "status": "current", "sections": []any{ map[string]any{ "heading": "

What it is

", "body": "Defender for Endpoint reads what actually happens on a device and reports sequences that do\n" + "not fit. The analysis runs in Microsoft's cloud, and the signals come from the operating\n" + "system itself rather than from an agent bolted on afterwards.", }, map[string]any{ "heading": "

What it is for

", "body": "Estates that are on Microsoft anyway. The biggest practical advantage is that identity,\n" + "device management and endpoint security use the same groups and the same console.", }, map[string]any{ "heading": "

What to watch

", "body": "Two things. Licensing first: the full feature set depends on the plan. Then the first few\n" + "weeks: backup agents, monitoring and home-grown scripts all look like attackers to an EDR.\n" + "Those exceptions should be documented.", }, }, }, "status": map[string]any{ "corpus": 315, "services": []any{ map[string]any{ "ref": "services/modern-workplace", "score": "0.81", }, map[string]any{ "ref": "services/security", "score": "0.75", }, map[string]any{ "ref": "services/managed-security", "score": "0.48", }, map[string]any{ "ref": "services/cloud", "score": "0.41", }, }, "experts": []any{ map[string]any{ "ref": "experts/oliver-erismann", "score": "0.43", }, map[string]any{ "ref": "experts/matthias-frech", "score": "0.36", }, map[string]any{ "ref": "experts/steven-rodenburg", "score": "0.36", }, }, "neighbours": []any{ map[string]any{ "ref": "solutions/endpoint-security", "relation": "parent", }, map[string]any{ "ref": "solutions/igel/addon/90meter", "score": "0.70", }, map[string]any{ "ref": "solutions/endpoint-security/crowdstrike-falcon", "score": "0.70", }, }, "search": "/en/search.json", },}func main() { enc := json.NewEncoder(os.Stdout) enc.SetEscapeHTML(false) enc.SetIndent("", " ") if err := enc.Encode(page); err != nil { os.Exit(1) }}

// Code generated by the soultec.ch build. DO NOT EDIT.const page = { apiVersion: "soultec.ch/v1", kind: "Solution", metadata: { name: "endpoint-security/microsoft-defender-atp", locale: "en", labels: { vendor: "Microsoft Defender for Endpoint", "capability/endpoint-security": 2.73, "capability/security": 1.91, "vendor/microsoft": 2.61, }, annotations: { source: "src/content/solutions/en/endpoint-security/microsoft-defender-atp.md", route: "/en/solutions/endpoint-security/microsoft-defender-atp/", schema: "/nerd/schema/solutions.json", markdown: "/en/solutions/endpoint-security/microsoft-defender-atp.md", }, }, spec: { title: "Microsoft Defender", tags: ["endpoint-security", "security"], vendors: ["microsoft"], summary: "Endpoint detection and response from the Microsoft stack. If you already have M365 E5, you have usually already licensed it.", photoNeed: "A security console on screen with real alerts in it, being triaged", stub: false, draft: false, kind: "product", addon: false, vendorName: "Microsoft Defender for Endpoint", status: "current", sections: [ { heading: "

What it is

", body: "Defender for Endpoint reads what actually happens on a device and reports sequences that do\n" + "not fit. The analysis runs in Microsoft's cloud, and the signals come from the operating\n" + "system itself rather than from an agent bolted on afterwards.", }, { heading: "

What it is for

", body: "Estates that are on Microsoft anyway. The biggest practical advantage is that identity,\n" + "device management and endpoint security use the same groups and the same console.", }, { heading: "

What to watch

", body: "Two things. Licensing first: the full feature set depends on the plan. Then the first few\n" + "weeks: backup agents, monitoring and home-grown scripts all look like attackers to an EDR.\n" + "Those exceptions should be documented.", }, ], }, status: { corpus: 315, services: [ { ref: "services/modern-workplace", score: "0.81", }, { ref: "services/security", score: "0.75", }, { ref: "services/managed-security", score: "0.48", }, { ref: "services/cloud", score: "0.41", }, ], experts: [ { ref: "experts/oliver-erismann", score: "0.43", }, { ref: "experts/matthias-frech", score: "0.36", }, { ref: "experts/steven-rodenburg", score: "0.36", }, ], neighbours: [ { ref: "solutions/endpoint-security", relation: "parent", }, { ref: "solutions/igel/addon/90meter", score: "0.70", }, { ref: "solutions/endpoint-security/crowdstrike-falcon", score: "0.70", }, ], search: "/en/search.json", },};console.log(JSON.stringify(page, null, 2));

# 60 lines · YAML · validated at build# 102 lines · JSON · validated at build# 98 lines · TOML · validated at build# 113 lines · XML · validated at build# 114 lines · Python · read back at build, equals the JSON record# 111 lines · PowerShell · read back at build, equals the JSON record# 120 lines · Go · read back at build, equals the JSON record# 105 lines · JavaScript · read back at build, equals the JSON record · served at /en/solutions/endpoint-security/microsoft-defender-atp.md

Solution · Microsoft

Microsoft Defender

The vendor calls it: Microsoft Defender for Endpoint

Endpoint detection and response from the Microsoft stack. If you already have M365 E5, you have usually already licensed it.

Topics Endpoint Security 2.73 Security 1.91

Vendors Microsoft 2.61

04Services

02Capabilities

315Corpus

photograph wantedA security console on screen with real alerts in it, being triaged

What it is

Defender for Endpoint reads what actually happens on a device and reports sequences that do not fit. The analysis runs in Microsoft’s cloud, and the signals come from the operating system itself rather than from an agent bolted on afterwards.

What it is for

Estates that are on Microsoft anyway. The biggest practical advantage is that identity, device management and endpoint security use the same groups and the same console.

What to watch

Two things. Licensing first: the full feature set depends on the plan. Then the first few weeks: backup agents, monitoring and home-grown scripts all look like attackers to an EDR. Those exceptions should be documented.