1
00:00:00,000 --> 00:00:02,960
What exactly can strangers see when they look at your company online?

2
00:00:02,960 --> 00:00:07,360
You might think of your company website, maybe your public LinkedIn page and your email address,

3
00:00:07,360 --> 00:00:09,240
but the public view is much bigger than that.

4
00:00:09,240 --> 00:00:13,640
There could be an old test website still online, a forgotten subdomain from a past project,

5
00:00:13,640 --> 00:00:19,240
a cloud service created by a team that has since moved on, or a public server, nobody has written down anywhere.

6
00:00:19,240 --> 00:00:20,720
These are digital doors and windows.

7
00:00:20,720 --> 00:00:24,920
They already face the internet, which means anyone can see them, not just your IT team.

8
00:00:24,920 --> 00:00:30,560
Most security tools start from inside your company and protect known devices, known users, and known files.

9
00:00:30,560 --> 00:00:34,320
An attacker starts outside, they don't need your company map or a login.

10
00:00:34,320 --> 00:00:36,040
They only need to look for what is visible.

11
00:00:36,040 --> 00:00:40,920
I'm Mirko Peters from M365FM, and in this knowledge nugget, we're going to look at Microsoft Defender,

12
00:00:40,920 --> 00:00:44,360
external attack service management, or EASM in plain English.

13
00:00:44,360 --> 00:00:48,200
You'll see how it finds public facing assets, why that list changes over time,

14
00:00:48,200 --> 00:00:53,000
and how a small clue you already know about can lead to something your team never knew existed.

15
00:00:53,000 --> 00:00:55,480
The problem, you can't lock what you can't see.

16
00:00:55,480 --> 00:00:57,600
Imagine your company as an office building.

17
00:00:57,600 --> 00:01:01,240
Inside you may have security at the front desk, staff use badges.

18
00:01:01,240 --> 00:01:02,840
Important rooms have locks.

19
00:01:02,840 --> 00:01:05,040
Cameras watch the main hallway, that's a good start.

20
00:01:05,040 --> 00:01:09,000
But someone walking around outside might find a side entrance that nobody checks anymore,

21
00:01:09,000 --> 00:01:12,160
maybe it belonged to an old team or contractor used it years ago.

22
00:01:12,160 --> 00:01:14,400
The sign has faded, but the door still opens.

23
00:01:14,400 --> 00:01:16,160
Online security has the same problem.

24
00:01:16,160 --> 00:01:21,680
Your IT team may keep a list of laptops, user accounts, approved applications, and company servers.

25
00:01:21,680 --> 00:01:26,720
The marketing team keeps a separate list of websites, a cloud team tracks its own services.

26
00:01:26,720 --> 00:01:30,680
A supplier runs another public site for a campaign, each list can be correct on its own.

27
00:01:30,680 --> 00:01:33,360
The trouble starts in the spaces between those lists.

28
00:01:33,360 --> 00:01:35,840
A project ends, but its test site stays online.

29
00:01:35,840 --> 00:01:39,680
Someone creates a subdomain for a short term event and forgets to remove it.

30
00:01:39,680 --> 00:01:44,200
A public IP address moves from one service to another, while the old records never change.

31
00:01:44,200 --> 00:01:48,880
A certificate reaches its expiry date and suddenly a website fails when customers try to use it.

32
00:01:48,880 --> 00:01:53,560
The internet doesn't care whether the service belongs to marketing, IT, a developer, or an outside supplier.

33
00:01:53,560 --> 00:01:57,280
If it responds to a request from the public internet, it can attract attention.

34
00:01:57,280 --> 00:02:00,120
An attacker's don't need to break into your office first to find it.

35
00:02:00,120 --> 00:02:04,840
They can search public records, look at domain names and website details, and inspect certificates,

36
00:02:04,840 --> 00:02:07,760
public IP addresses, and services that answer on the internet.

37
00:02:07,760 --> 00:02:10,400
They build a picture from clues that were already visible.

38
00:02:10,400 --> 00:02:12,840
You've probably seen a small version of this yourself.

39
00:02:12,840 --> 00:02:16,720
You search for your company name and find an old page still appearing in the results.

40
00:02:16,720 --> 00:02:21,400
Maybe it lists a phone number nobody uses anymore, or it refers to a product that no longer exists.

41
00:02:21,400 --> 00:02:24,880
For a security team, the same thing can happen with far more technical items.

42
00:02:24,880 --> 00:02:29,760
A domain can lead to a subdomain which can point to a host, which can reveal a public service.

43
00:02:29,760 --> 00:02:31,840
None of this means there is automatically a problem.

44
00:02:31,840 --> 00:02:36,440
Public websites need to be public, email systems need to accept messages, and remote access.

45
00:02:36,440 --> 00:02:37,920
Maybe there for a good reason.

46
00:02:37,920 --> 00:02:39,480
The issue is ownership and awareness.

47
00:02:39,480 --> 00:02:41,560
Can someone tell you who owns that asset?

48
00:02:41,560 --> 00:02:43,000
Do they know why it is public?

49
00:02:43,000 --> 00:02:44,000
Is it still needed?

50
00:02:44,000 --> 00:02:47,480
And if a weakness appears, does the right person know they need to fix it?

51
00:02:47,480 --> 00:02:50,840
This gets harder because a company's public footprint never stays still.

52
00:02:50,840 --> 00:02:54,680
People launch new websites, teams try cloud services, companies by other companies,

53
00:02:54,680 --> 00:02:57,640
vendors create portals, and developers build test systems.

54
00:02:57,640 --> 00:03:02,400
Then people change jobs, projects close, and the original reason for an asset disappears.

55
00:03:02,400 --> 00:03:04,320
That is often called shadow IT.

56
00:03:04,320 --> 00:03:09,680
Shadow IT means a tool, service, or system that operates outside the normal company list.

57
00:03:09,680 --> 00:03:11,280
It doesn't always come from bad choices.

58
00:03:11,280 --> 00:03:13,680
Often someone simply needed to get work done quickly.

59
00:03:13,680 --> 00:03:16,720
But if nobody knows it exists, nobody checks whether it is safe.

60
00:03:16,720 --> 00:03:20,360
So a yearly spreadsheet of public assets can become outdated very quickly.

61
00:03:20,360 --> 00:03:24,000
The old way it depends on asking every team, collecting their answers, and hoping nothing

62
00:03:24,000 --> 00:03:25,000
was missed.

63
00:03:25,000 --> 00:03:28,000
That gives you an inside view, but it doesn't prove what the internet can actually see.

64
00:03:28,000 --> 00:03:30,840
Microsoft Defender ESM starts from the other direction.

65
00:03:30,840 --> 00:03:34,880
It begins with a small clue about your company, then follows the public trail outward.

66
00:03:34,880 --> 00:03:37,560
What Microsoft Defender ESM actually is?

67
00:03:37,560 --> 00:03:41,320
Microsoft Defender external attack service management is Microsoft service for finding,

68
00:03:41,320 --> 00:03:44,800
slapping, and monitoring the parts of your company that face the public internet.

69
00:03:44,800 --> 00:03:47,680
That's a mouthful, so let's break it down in plain English.

70
00:03:47,680 --> 00:03:50,040
External means outside your company network.

71
00:03:50,040 --> 00:03:52,560
On the public internet where anyone can see.

72
00:03:52,560 --> 00:03:57,120
A attack service refers to every public spot that someone or something could reach, inspect,

73
00:03:57,120 --> 00:04:01,160
or try to misuse, and management means keeping that picture up to date so your team can review

74
00:04:01,160 --> 00:04:03,520
it and take action when something needs attention.

75
00:04:03,520 --> 00:04:07,400
Put those three words together, and ESM gives you an outside view of your company's

76
00:04:07,400 --> 00:04:08,400
public footprint.

77
00:04:08,400 --> 00:04:11,280
Think of a property inspector walking along a row of business units.

78
00:04:11,280 --> 00:04:14,040
They don't enter every room or read every file inside.

79
00:04:14,040 --> 00:04:18,840
Instead, they check only the parts visible from the street, which entrances exist, which

80
00:04:18,840 --> 00:04:23,280
signs point to the business, which windows are broken, and which old storage door still

81
00:04:23,280 --> 00:04:26,360
has a lock, but no one seems responsible for it.

82
00:04:26,360 --> 00:04:27,960
Defender ESM works the same way online.

83
00:04:27,960 --> 00:04:33,280
It can find domains and subdomains like Contoso, Com and Events, dot Contoso.com, identify

84
00:04:33,280 --> 00:04:37,680
hosts that are named systems connected to those addresses, and map public IP addresses,

85
00:04:37,680 --> 00:04:41,240
web pages, certificates, and internet services linked to your company.

86
00:04:41,240 --> 00:04:43,000
Make certificates as an example.

87
00:04:43,000 --> 00:04:47,080
When you visit a secure website, your browser checks a digital certificate to prove which

88
00:04:47,080 --> 00:04:49,360
site you reached and protect the connection.

89
00:04:49,360 --> 00:04:54,120
But certificates also leave public clues about names connected to a company, and ESM uses

90
00:04:54,120 --> 00:04:55,800
those clues as part of its view.

91
00:04:55,800 --> 00:04:57,680
It can also show connections that matter.

92
00:04:57,680 --> 00:05:02,040
A company domain may point to a website, which connects to a host, which uses a public IP

93
00:05:02,040 --> 00:05:04,320
address where a service might be answering.

94
00:05:04,320 --> 00:05:09,120
Looking at each item alone gives you a list, but seeing how they connect gives you context.

95
00:05:09,120 --> 00:05:14,480
Many people hear the word Defender, and assume ESM protects every device or blocks every attack,

96
00:05:14,480 --> 00:05:15,880
but it doesn't work that way.

97
00:05:15,880 --> 00:05:20,760
ESM doesn't replace a firewall, patch old software, or take the place of antivirus on laptops,

98
00:05:20,760 --> 00:05:23,480
email protection, or cloud security settings.

99
00:05:23,480 --> 00:05:28,760
Those tools handle different jobs, a firewall controls traffic, patching fixes software problems,

100
00:05:28,760 --> 00:05:31,600
and Microsoft Defender for Endpoint Protects devices.

101
00:05:31,600 --> 00:05:35,920
ESM helps you see what the public internet can find before you decide what needs fixing,

102
00:05:35,920 --> 00:05:36,920
removing or watching.

103
00:05:36,920 --> 00:05:37,960
You need both views.

104
00:05:37,960 --> 00:05:41,640
The tools inside your company can tell you about devices and services you already manage,

105
00:05:41,640 --> 00:05:45,080
but ESM starts from the outside and asks a different question.

106
00:05:45,080 --> 00:05:49,440
If someone knew nothing about your company except its public name, what could they discover?

107
00:05:49,440 --> 00:05:53,400
That outside view can uncover a service your internal inventory missed, and it can also

108
00:05:53,400 --> 00:05:57,320
confirm that an internet-facing application you already know about still looks the way

109
00:05:57,320 --> 00:05:59,280
you expect from the public side.

110
00:05:59,280 --> 00:06:00,440
And that difference matters.

111
00:06:00,440 --> 00:06:04,320
A long-asset list by itself can feel like more work, not more security.

112
00:06:04,320 --> 00:06:08,400
A useful part comes from how Defender ESM turns public clues into a connected picture that

113
00:06:08,400 --> 00:06:12,040
helps you separate the assets that belong to you from the ones that don't.

114
00:06:12,040 --> 00:06:13,520
How Discovery works?

115
00:06:13,520 --> 00:06:15,360
From one known clue to a map.

116
00:06:15,360 --> 00:06:19,000
So how does Defender ESM find things your company never put on a list?

117
00:06:19,000 --> 00:06:20,000
It starts with a seed.

118
00:06:20,000 --> 00:06:24,160
A seed is a known piece of public information that points ESM toward your company.

119
00:06:24,160 --> 00:06:25,800
It could be a domain like Contoso.

120
00:06:25,800 --> 00:06:31,480
Com, a public IP address, or range, a host name, an email contact, an autonomous system

121
00:06:31,480 --> 00:06:36,720
number, ASN for short, or a company name found in public domain registration details, an

122
00:06:36,720 --> 00:06:39,480
ASN sounds technical, but the idea is simple.

123
00:06:39,480 --> 00:06:43,640
Internet providers and large organizations use ASNs to identify the networks they run.

124
00:06:43,640 --> 00:06:47,280
So if your company owns part of a public network, that number can help point Discovery

125
00:06:47,280 --> 00:06:48,440
toward the right place.

126
00:06:48,440 --> 00:06:50,560
You don't need every seed before you begin.

127
00:06:50,560 --> 00:06:52,160
In fact, that would miss the point.

128
00:06:52,160 --> 00:06:56,240
You give Defender ESM the clues you already trust, and it uses public connections around

129
00:06:56,240 --> 00:06:58,320
those clues to build a wider picture.

130
00:06:58,320 --> 00:07:00,440
Imagine you know one public website address.

131
00:07:00,440 --> 00:07:05,200
Internet address might reveal a subdomain like portal, Contoso.com, and a public certificate

132
00:07:05,200 --> 00:07:08,400
connected to that subdomain may contain other names.

133
00:07:08,400 --> 00:07:12,200
One of those names can point to a host, which may connect to a public IP address where

134
00:07:12,200 --> 00:07:15,320
a web service or another internet facing service responds.

135
00:07:15,320 --> 00:07:17,040
Each clue leads to another clue.

136
00:07:17,040 --> 00:07:19,040
Microsoft calls this recursive discovery.

137
00:07:19,040 --> 00:07:23,400
In plain English, ESM finds a public relationship, checks where it leads, then keeps following

138
00:07:23,400 --> 00:07:27,080
connected information to figure out what likely belongs to your company.

139
00:07:27,080 --> 00:07:30,480
It doesn't need a company user account. It uses information that already appears on the

140
00:07:30,480 --> 00:07:36,800
public internet like domain records, certificates, host names, web content, and the public behavior

141
00:07:36,800 --> 00:07:38,200
of services.

142
00:07:38,200 --> 00:07:41,880
These are the same kinds of clues and outside researcher or an attacker can use to build

143
00:07:41,880 --> 00:07:42,880
a map.

144
00:07:42,880 --> 00:07:47,240
But finding a connection doesn't automatically prove ownership, and that part matters a lot.

145
00:07:47,240 --> 00:07:51,120
A public IP address might belong to a shared cloud provider, a certificate could include

146
00:07:51,120 --> 00:07:56,360
names for several customers, and a website may use a service run by a supplier.

147
00:07:56,360 --> 00:08:01,760
And a ESM helps you investigate those relationships, but your team still needs to decide what actually

148
00:08:01,760 --> 00:08:03,320
belongs to your company.

149
00:08:03,320 --> 00:08:06,800
Think about a business that uses a web agency for a short campaign.

150
00:08:06,800 --> 00:08:10,760
The campaign domain might point to systems owned by the agency, so some parts are yours,

151
00:08:10,760 --> 00:08:14,880
some belong to the agency, and some are shared services used by many customers.

152
00:08:14,880 --> 00:08:19,360
Treating every related item as your asset would create noise and confusion, so ESM gives

153
00:08:19,360 --> 00:08:21,560
you a starting point for that ownership conversation.

154
00:08:21,560 --> 00:08:24,280
You can create discovery groups to keep the search focused.

155
00:08:24,280 --> 00:08:28,160
A discovery group might cover your main company name, another could focus on a new brand

156
00:08:28,160 --> 00:08:33,040
or business unit, and you can also build a group around known domains and public IP ranges.

157
00:08:33,040 --> 00:08:37,040
That approach helps when a large company has separate teams and separate public services.

158
00:08:37,040 --> 00:08:41,320
Instead of one huge pile of results, you can ask more focused questions.

159
00:08:41,320 --> 00:08:43,760
What does the public internet show for this brand?

160
00:08:43,760 --> 00:08:45,600
What changed around this business unit?

161
00:08:45,600 --> 00:08:49,200
And which assets connect to the domains used by this product team?

162
00:08:49,200 --> 00:08:52,920
You can also exclude items that you already know don't belong in the inventory that doesn't

163
00:08:52,920 --> 00:08:54,320
erase the public record.

164
00:08:54,320 --> 00:08:57,960
It simply keeps your working view cleaner so your team can spend time on the assets they

165
00:08:57,960 --> 00:08:59,560
can actually manage.

166
00:08:59,560 --> 00:09:00,960
Discovery also isn't a one-time job.

167
00:09:00,960 --> 00:09:04,840
A company can launch a new public service on Monday, change a cloud setting on Wednesday,

168
00:09:04,840 --> 00:09:08,000
and retire a site on Friday without removing every public reference.

169
00:09:08,000 --> 00:09:12,040
The public footprint changes because the business changes, so a weekly recurring discovery

170
00:09:12,040 --> 00:09:15,160
schedule is a sensible starting point for many organizations.

171
00:09:15,160 --> 00:09:19,240
You can also run discovery once for a snapshot, but regular discovery keeps the inventory

172
00:09:19,240 --> 00:09:20,240
connected to real life.

173
00:09:20,240 --> 00:09:24,760
A new seed can lead to a new branch of public information, and boom, that's often where

174
00:09:24,760 --> 00:09:26,800
teams find something they didn't expect.

175
00:09:26,800 --> 00:09:30,320
Not because Defender EASM creates the asset, but because it connects clues that existed

176
00:09:30,320 --> 00:09:32,600
separately until someone looked at them together.

177
00:09:32,600 --> 00:09:34,880
Still, discovery only gives you the map.

178
00:09:34,880 --> 00:09:39,240
A map can show hundreds of domains, IP addresses, certificates, and services.

179
00:09:39,240 --> 00:09:41,000
The next question is harder.

180
00:09:41,000 --> 00:09:42,920
Which of those findings need attention first?

181
00:09:42,920 --> 00:09:45,360
What should your team actually do about them?

182
00:09:45,360 --> 00:09:46,680
From inventory to action?

183
00:09:46,680 --> 00:09:48,360
What EASM helps you spot?

184
00:09:48,360 --> 00:09:52,480
So once Defender EASM builds an inventory, you need to treat it as a living record, is

185
00:09:52,480 --> 00:09:53,880
not the final answer.

186
00:09:53,880 --> 00:09:58,600
Some items are recent, showing what EASM has seen as part of your current public footprint.

187
00:09:58,600 --> 00:09:59,960
Others are historic.

188
00:09:59,960 --> 00:10:03,760
They were visible at some point, but may no longer respond or connect the same way, even

189
00:10:03,760 --> 00:10:06,080
so that older records still has a purpose.

190
00:10:06,080 --> 00:10:10,960
Imagine an incident starts with a suspicious domain name or an IP address found in a log.

191
00:10:10,960 --> 00:10:15,520
A historic record can tell you that this address once connected to an old business service,

192
00:10:15,520 --> 00:10:19,920
even if that service disappeared months ago, that helps your team figure out who used it,

193
00:10:19,920 --> 00:10:23,000
what it did, and whether a related system might still exist.

194
00:10:23,000 --> 00:10:25,760
The inventory also keeps the links between items visible.

195
00:10:25,760 --> 00:10:27,880
A domain name may connect to a certificate.

196
00:10:27,880 --> 00:10:30,480
That certificate may connect to several host names.

197
00:10:30,480 --> 00:10:33,280
Those hosts can lead to public IP addresses and services.

198
00:10:33,280 --> 00:10:36,920
When you see that chain, you stop treating each result as a random technical detail.

199
00:10:36,920 --> 00:10:38,480
You can ask better questions.

200
00:10:38,480 --> 00:10:41,720
Does this public login page belong to the same team as the main website?

201
00:10:41,720 --> 00:10:44,320
Does this certificate point to an old product name?

202
00:10:44,320 --> 00:10:48,320
Is this exposed service part of an approved cloud setup or did someone leave it behind

203
00:10:48,320 --> 00:10:49,320
after a test?

204
00:10:49,320 --> 00:10:50,480
That's where observations come in.

205
00:10:50,480 --> 00:10:53,880
An observation is something defender EASM has noticed that may need review.

206
00:10:53,880 --> 00:10:57,760
It could be a forgotten subdomain in old web page still appearing online, a remote access

207
00:10:57,760 --> 00:11:01,560
service exposed to the public internet, or a setup choice that doesn't match your company

208
00:11:01,560 --> 00:11:02,560
rules.

209
00:11:02,560 --> 00:11:04,040
Certificates also need attention.

210
00:11:04,040 --> 00:11:07,560
An expired certificate can stop a website from loading properly and create warnings for

211
00:11:07,560 --> 00:11:08,560
users.

212
00:11:08,560 --> 00:11:12,040
A certificate that will expire soon gives the owner time to renew it before customers or

213
00:11:12,040 --> 00:11:14,160
staff run into a broken service.

214
00:11:14,160 --> 00:11:17,400
But EASM doesn't only collect technical names and dates.

215
00:11:17,400 --> 00:11:21,440
Microsoft uses virtual user technology to revisit public web content and check how a page

216
00:11:21,440 --> 00:11:22,920
behaves from the outside.

217
00:11:22,920 --> 00:11:27,200
Think of it as a fresh visitor arriving at the site, rather than relying only on an old record

218
00:11:27,200 --> 00:11:28,400
from months ago.

219
00:11:28,400 --> 00:11:32,240
That can show whether a page changed, whether it still loads and what public content or behavior

220
00:11:32,240 --> 00:11:33,400
it exposes.

221
00:11:33,400 --> 00:11:37,240
This gives security teams current evidence when they investigate a web facing asset.

222
00:11:37,240 --> 00:11:38,240
But here's the thing.

223
00:11:38,240 --> 00:11:39,760
Most people mess up at this point.

224
00:11:39,760 --> 00:11:43,120
This year long list of findings and treat every item as equally urgent.

225
00:11:43,120 --> 00:11:45,720
That creates a queue nobody can realistically work through.

226
00:11:45,720 --> 00:11:48,640
A public asset needs context before it becomes a priority.

227
00:11:48,640 --> 00:11:50,520
First, ask how exposed it is.

228
00:11:50,520 --> 00:11:54,680
A public administration page needs more care than a simple information page.

229
00:11:54,680 --> 00:11:57,520
Then ask whether there is a known weakness or unsafe setup.

230
00:11:57,520 --> 00:11:59,280
After that, look at business importance.

231
00:11:59,280 --> 00:12:02,840
A public customer portal and a forgotten event page don't carry the same risk even if

232
00:12:02,840 --> 00:12:04,560
both sit on the internet.

233
00:12:04,560 --> 00:12:05,960
Finally, find an owner.

234
00:12:05,960 --> 00:12:10,520
Without a named owner, a finding often moves from one team to another until nobody fixes it.

235
00:12:10,520 --> 00:12:14,320
Ownership turns a technical observation into a piece of work that someone can accept,

236
00:12:14,320 --> 00:12:15,920
change, remove or explain.

237
00:12:15,920 --> 00:12:16,920
Take a common example.

238
00:12:16,920 --> 00:12:19,440
The marketing team launches a campaign site for a new product.

239
00:12:19,440 --> 00:12:21,280
The campaign ends six months later.

240
00:12:21,280 --> 00:12:22,800
But the site remains online.

241
00:12:22,800 --> 00:12:24,640
The agency that built it has moved on.

242
00:12:24,640 --> 00:12:26,400
The internal project lead changed roles.

243
00:12:26,400 --> 00:12:31,080
The site runs an older version of its web software and it still shows a public login page.

244
00:12:31,080 --> 00:12:32,240
Nothing may have gone wrong yet.

245
00:12:32,240 --> 00:12:34,680
Still, this is the kind of asset that deserves a decision.

246
00:12:34,680 --> 00:12:35,800
Is it still needed?

247
00:12:35,800 --> 00:12:36,800
Who owns it?

248
00:12:36,800 --> 00:12:37,800
Can the software be updated?

249
00:12:37,800 --> 00:12:39,200
Should the login page stay public?

250
00:12:39,200 --> 00:12:40,800
Or should the site come down entirely?

251
00:12:40,800 --> 00:12:42,760
The action path can stay simple.

252
00:12:42,760 --> 00:12:44,280
Confirm who owns the asset.

253
00:12:44,280 --> 00:12:48,040
Decide whether it belongs to your company and whether it still has a business purpose.

254
00:12:48,040 --> 00:12:52,480
Then fix the problem, remove the asset, or keep watching it if it must stay public.

255
00:12:52,480 --> 00:12:56,160
Record that decision so the next person doesn't need to start the same investigation again.

256
00:12:56,160 --> 00:12:58,320
Not every discovery is an emergency.

257
00:12:58,320 --> 00:13:00,680
And not every public service should disappear.

258
00:13:00,680 --> 00:13:04,480
Your website, customer portal and public email service exist because people need to

259
00:13:04,480 --> 00:13:05,320
reach them.

260
00:13:05,320 --> 00:13:06,520
The goal is control.

261
00:13:06,520 --> 00:13:10,760
You want every visible asset to have a reason for being there, a person or team responsible

262
00:13:10,760 --> 00:13:13,120
for it and the right level of protection.

263
00:13:13,120 --> 00:13:17,160
Once that outside record exists, it can do more than support one security review.

264
00:13:17,160 --> 00:13:21,120
It can feed the teams already responding to alerts and managing risk across Microsoft security

265
00:13:21,120 --> 00:13:22,120
tools.

266
00:13:22,120 --> 00:13:24,760
How EASM fits into Microsoft security.

267
00:13:24,760 --> 00:13:28,120
Defender EASM becomes more useful when it connects with the security work your teams

268
00:13:28,120 --> 00:13:29,120
already do.

269
00:13:29,120 --> 00:13:31,360
Think of it as the outside patrol around your company.

270
00:13:31,360 --> 00:13:36,280
It watches what the public internet can reach while other Microsoft security tools help protect

271
00:13:36,280 --> 00:13:41,440
the people, devices, email and cloud services behind those public facing services.

272
00:13:41,440 --> 00:13:45,320
Microsoft Defender for endpoint focuses on devices such as laptops and servers.

273
00:13:45,320 --> 00:13:49,440
Microsoft Defender for Office 365 helps protect email and collaboration.

274
00:13:49,440 --> 00:13:54,720
Microsoft Defender for Cloud helps teams find and manage security issues in cloud workloads.

275
00:13:54,720 --> 00:13:56,360
Defender EASM adds a different view.

276
00:13:56,360 --> 00:14:00,400
It asks what is visible before an attacker reaches any of those systems.

277
00:14:00,400 --> 00:14:02,000
Security also belongs in this picture.

278
00:14:02,000 --> 00:14:05,040
Entra ID is the reception desk for your digital identity.

279
00:14:05,040 --> 00:14:09,680
It manages who signs in what they can access and how their account proves who they are.

280
00:14:09,680 --> 00:14:14,600
If an exposed application uses company sign-in, security teams may need to understand both sides.

281
00:14:14,600 --> 00:14:18,680
The public application that someone can reach and the identity controls protecting access

282
00:14:18,680 --> 00:14:19,960
after they arrive.

283
00:14:19,960 --> 00:14:21,720
These tools don't compete with each other.

284
00:14:21,720 --> 00:14:24,400
They cover different parts of the same company.

285
00:14:24,400 --> 00:14:27,800
Microsoft Security Exposure Management brings these views closer together.

286
00:14:27,800 --> 00:14:32,320
It gives security teams a broader picture of exposure across Microsoft security products

287
00:14:32,320 --> 00:14:36,320
so they can look beyond one alert or one device and see where risks connect.

288
00:14:36,320 --> 00:14:41,160
For example, a public facing server might appear in Defender EASM while cloud security data

289
00:14:41,160 --> 00:14:42,640
shows how that server is set up.

290
00:14:42,640 --> 00:14:46,920
A security team can use both pieces of information when deciding what to fix first.

291
00:14:46,920 --> 00:14:52,080
EASM can also send its findings to places where teams search and investigate security data.

292
00:14:52,080 --> 00:14:57,080
Through data connections, you can export asset data, attack surface insights, or both.

293
00:14:57,080 --> 00:15:02,880
Acid data means the discovered items such as domains, hosts, IP addresses and services.

294
00:15:02,880 --> 00:15:06,520
Attack surface insights mean the observations and risks connected to those items.

295
00:15:06,520 --> 00:15:08,200
One destination is log analytics.

296
00:15:08,200 --> 00:15:12,640
Log analytics is a place where you store and search data from Microsoft services.

297
00:15:12,640 --> 00:15:17,000
Security teams can use it to ask questions across many sources rather than opening a separate

298
00:15:17,000 --> 00:15:18,600
tool for every answer.

299
00:15:18,600 --> 00:15:20,720
Another destination is Azure Data Explorer.

300
00:15:20,720 --> 00:15:24,360
That is built for teams that need to store and query large amounts of data quickly,

301
00:15:24,360 --> 00:15:28,520
especially when they want to build their own reports or combine EASM data with other records.

302
00:15:28,520 --> 00:15:30,640
Microsoft Sentinel can use that exported data too.

303
00:15:30,640 --> 00:15:33,480
Sentinel is Microsoft's Security Operations Platform.

304
00:15:33,480 --> 00:15:39,480
It collects security signals, helps analysts investigate incidents, and can trigger follow-up actions through playbooks.

305
00:15:39,480 --> 00:15:45,640
When EASM findings appear alongside alerts and logs, an analyst can quickly check whether an incident involves a public facing asset,

306
00:15:45,640 --> 00:15:49,880
what else connects to it, and whether the asset already carried a known concern.

307
00:15:49,880 --> 00:15:52,280
That can reduce guesswork during an investigation.

308
00:15:52,280 --> 00:15:55,200
Security co-pilot adds another way to work with the data.

309
00:15:55,200 --> 00:15:59,040
Instead of searching through lists manually, you can ask questions in plain English.

310
00:15:59,040 --> 00:16:02,680
You might ask which internet facing assets connect to a certain domain,

311
00:16:02,680 --> 00:16:09,040
what observations exist for a public service, or where a newly found host fits in the company's public footprint.

312
00:16:09,040 --> 00:16:11,600
Co-pilot doesn't replace the need for human review.

313
00:16:11,600 --> 00:16:19,040
It helps teams get to the right questions faster, while the people responsible for security still decide what the findings mean and what action makes sense.

314
00:16:19,040 --> 00:16:23,920
You don't need every connection on day one. Start by making the outside view part of your regular security routine.

315
00:16:23,920 --> 00:16:28,880
Then let the process become more useful as your inventory, ownership records, and incident workflows improve.

316
00:16:28,880 --> 00:16:30,320
A simple starting plan.

317
00:16:30,320 --> 00:16:31,960
Start with what you already know.

318
00:16:31,960 --> 00:16:34,800
Your main company domains and approved public IP ranges.

319
00:16:34,800 --> 00:16:39,160
If you know the public names used by a brand, product, or business unit, add those two.

320
00:16:39,160 --> 00:16:42,480
Create a discovery group and let the inventory build over time.

321
00:16:42,480 --> 00:16:46,080
The first results will include items your team recognizes right away.

322
00:16:46,080 --> 00:16:47,920
Plus some assets that need a closer look.

323
00:16:47,920 --> 00:16:49,800
Now bring the right people into that review.

324
00:16:49,800 --> 00:16:51,640
Your website team knows the public pages.

325
00:16:51,640 --> 00:16:53,360
Your cloud team recognizes the hosts.

326
00:16:53,360 --> 00:16:55,760
Network staff can identify IP addresses.

327
00:16:55,760 --> 00:16:57,760
Security helps judge the exposure.

328
00:16:57,760 --> 00:17:00,720
A supplier may need to confirm if they run part of the service.

329
00:17:00,720 --> 00:17:02,080
Label the result clearly.

330
00:17:02,080 --> 00:17:06,120
Market as owned, shared, no longer needed, or outside company control.

331
00:17:06,120 --> 00:17:10,840
That simple decision stops the same unknown asset from coming back as a mystery every few months.

332
00:17:10,840 --> 00:17:14,040
Set a regular discovery schedule and a regular review meeting.

333
00:17:14,040 --> 00:17:16,000
Then turn findings into small actions.

334
00:17:16,000 --> 00:17:20,160
Close and expose service that shouldn't be public, renew a certificate before it expires,

335
00:17:20,160 --> 00:17:22,840
or remove a site that no longer needs to be online.

336
00:17:22,840 --> 00:17:28,200
Over time, your team gets fewer surprises when a new public service appears or an incident begins.

337
00:17:28,200 --> 00:17:33,000
Microsoft Defender ESM helps you see the public facing parts of your company before an attacker

338
00:17:33,000 --> 00:17:35,120
turns an overlooked asset into a target.

339
00:17:35,120 --> 00:17:37,280
Think of it as watching the outside of your building.

340
00:17:37,280 --> 00:17:39,640
You want to know what's exposed before someone else does.

341
00:17:39,640 --> 00:17:40,880
Here's a simple challenge.

342
00:17:40,880 --> 00:17:43,560
Write down three public domains your company uses.

343
00:17:43,560 --> 00:17:48,040
For each one, ask who owns it, why it needs to stay online, and who would fix it if something

344
00:17:48,040 --> 00:17:49,120
changed tomorrow.

345
00:17:49,120 --> 00:17:51,160
That exercise reveals where the gaps are.

346
00:17:51,160 --> 00:17:55,040
For the next knowledge nugget, keep building the full Microsoft Security picture with Defender

347
00:17:55,040 --> 00:17:57,440
and Microsoft Security Exposure Management.

348
00:17:57,440 --> 00:18:00,200
The public view tells you what strangers can find.

349
00:18:00,200 --> 00:18:03,120
The inside tools help you understand what those public services can reach.