Windows Defender module allows you to configure Windows Defender settings.

This module is a collection of functions designed to help you configure and validate your environment for working with Microsoft Defender for Identity.

The Secure Cloud Business Applications (SCuBA) Gear module automates conformance testing about CISA M365 Secure Configuration Baselines.

This module provides the ability to validate the MAPS connection for Microsoft Windows Defender

PowerShell module providing CmdLet for getting human readable information about attack surface reduction rules configured on a Windows Defender client

PowerShell module for Microsoft Defender for Endpoint (MDE).

Various functions related to Microsoft Defender services (APIs). Some of them are explained at https://doitpshway.com. Some of the interesting functions: - Get-M365DefenderMachine - get specific/all machine(s) - Get-M365DefenderMachineUser - get machine owner - Get-M365DefenderMachineVulnerability - get vulnerabilities detecte... More info

This modules was created to help manually configure the local ASR settings of a machine in a small scale scenario where doesn't make sence to use System Center Configuration Manager, Microsoft Intune or Group Policies to deploy the settings.

Client for the Microsoft Defender for Cloud Apps API

Implements the defender API

This module evaluates Microsoft Defender for Endpoint configurations against best practices and exports the results to a CSV file.

The DFIR-O365RC module will extract logs from the unified audit log (using Exchange Online and Purview), Entra ID Sign In logs, Entra ID Audit Logs, Azure Monitor and Azure DevOps activity logs