Defender Toolkit — oeltayeb.com
===============================

Onboarding, antivirus policy, attack surface reduction, tamper protection and sensor-health checklists for Microsoft Defender for Endpoint on Windows and macOS, including the Sense event IDs you need when onboarding goes wrong.

Every file in this folder is a self-contained HTML page: open it in any browser and use Print / save as PDF.
Each resource was derived from an article on https://www.oeltayeb.com and links back to it — read the article when you need
the reasoning behind a step.

Contents
--------
- mde-onboarding-checklist.html — Checklist: MDE onboarding checklist
    source: https://www.oeltayeb.com/articles/onboard-defender-for-endpoint-with-intune.html
- defender-antivirus-troubleshooting-checklist.html — Checklist: Defender Antivirus troubleshooting checklist
    source: https://www.oeltayeb.com/articles/defender-antivirus-policy-not-applying.html
- asr-rules-rollout-troubleshooting-guide.html — Checklist: ASR rules rollout & troubleshooting guide
    source: https://www.oeltayeb.com/articles/attack-surface-reduction-rules-audit-mode.html
- defender-device-inactive-no-sensor-data-checklist.html — Checklist: Device shows "Inactive" or "No sensor data" in Microsoft Defender: how to troubleshoot
    source: https://www.oeltayeb.com/articles/defender-device-inactive-no-sensor-data.html
- mde-onboarding-validation-sense-event-ids.html — Checklist: MDE onboarding validation: Sense event IDs
    source: https://www.oeltayeb.com/articles/defender-for-endpoint-onboarding-errors-sense-event-ids.html
- defender-tamper-protection-troubleshooting-intune-checklist.html — Checklist: Tamper protection and Intune: why a Defender setting won't change, and how to fix it
    source: https://www.oeltayeb.com/articles/defender-tamper-protection-troubleshooting-intune.html
- defender-for-endpoint-macos-onboarding-intune-checklist.html — Checklist: Onboarding macOS to Defender for Endpoint with Intune: profiles, app and onboarding package
    source: https://www.oeltayeb.com/articles/defender-for-endpoint-macos-onboarding-intune.html

Related PowerShell scripts (read-only by default, MIT licence)
--------------------------------------------------------------
- Get-DefenderAlertsReport.ps1: Reports alerts from Microsoft Defender XDR (unified alerts API) for the last N days.
- Get-DefenderIncidentsReport.ps1: Reports Microsoft Defender XDR incidents for triage, including how long each one has been open.
- Get-DefenderSecureScore.ps1: Shows the current Microsoft Secure Score and the improvement actions with the largest remaining point gap.
  https://github.com/omer-eltayeb/M365-Intune-Admin-Scripts

Licence
-------
Free to use and share within your organisation; please link to www.oeltayeb.com when you redistribute.

© Omer Eltayeb · https://www.oeltayeb.com · Shared free for the Microsoft community. Verify settings in a test tenant first.
