EDR / Product research notes

Microsoft Defender for Endpoint

Microsoft publishes an endpoint security capability matrix showing that available functions vary by platform and plan.

UNASSESSED · DOCUMENTATION ONLY

Scope before scoring

Plan 2 candidate; device/server entitlements and platform feature differences require confirmation.

Questions for your evaluation

  1. Record the device mix and applicable license for every platform.
  2. Test the required investigation and response actions per operating system.
  3. Measure agent health and the process for restoring a contained endpoint.

The evidence that would change that

Freeze the edition and requirements, run representative scenarios, record results with dates, verify critical requirements, and have a second reviewer reproduce the calculations. Unknown criteria remain unknown.

See the research plan ↗

Find your next idea.

Tip: press / to open search. Escape closes this window.