Threat and Vulnerability Management, or TVM,
provides actionable information that
can help mitigate threats and vulnerabilities
in your environment quickly, reducing your overall exposure.
This video demonstrates some of the key insights and actions
available in TVM.
TVM is a component of Microsoft Defender Advanced Threat
Protection that correlates near real-time Endpoint Detection
and Response insights with vulnerability and threat
information.
The result?
You can take quick action to remediate vulnerabilities
in your environment, long before they’re exploited
by adversaries.
Getting started with TVM is easy.
Once you have your machines onboarded to Microsoft Defender
ATP, you quickly start getting insights.
The TVM dashboard is in the Microsoft Defender Security
Center, under Threat & Vulnerability Management.
There’s a lot of functionality and insight in TVM,
but for now I’ll focus on what is available in the dashboard.
First, you’ll notice an Exposure Score.
This is an overall score of how vulnerable your assets are
to cyber threats.
The lower the number, the less exposed you are to threats.
This number is calculated by using a complex set of criteria
including machine weaknesses, likelihood of machines
to be breached, their values, and relevant alerts tied
to machines.
You can also see how your score has improved or declined
over the past 30 days.
To improve this score, you can follow some of the Top security
recommendations.
By default, you’re shown the top recommendations,
based on their highest exposure impact,
but you can always select show more to see them all.
There are many different security recommendations here,
and TVM sorts all of them by impact.
Select one for more details, like the vulnerabilities which
are addressed by following this recommendation
and the impacted machines.
Our other TVM videos provide more detail.
But for now, I just want to show you
how to quickly assess your exposure score
and how to improve it.
Back in the TVM dashboard, let’s take a look at the secure
score.
This is an overview of your security posture,
based on security best practices—grouped by category.
The higher the score, the more your machines
are protected against cyber threats.
Pretty simple, right?
I’ll select the category “Security controls” to see how
I can improve our posture.
Like we saw earlier, TVM sorts these by the most impact,
so it’s simple to pick the most helpful options.
After selecting a recommendation,
I have a few options.
First, I can select Open software page to review more
details about the application itself, where it’s installed,
and any other related security recommendations.
Select Remediation options to see exactly how
to remediate this weakness, and to request a remediation
for this recommendation.
Last, if I want to create an exception for this remediation,
because I need additional time, select Exception options.
TVM prompts for a justification, context information,
and how much time I need for this exception.
Exposure distribution provides a quick view
of the machines that are exposed in your environment, grouped
by risk.
To see the details about which machines are in a category,
select a piece of the pie chart to go to the machine list,
which shows machines at risk.
The last thing I want to show you is Top vulnerable software.
We all know that common applications sometimes
have vulnerabilities.
However, keeping up with all of them, and remediating them,
can be a frustrating.
TVM lists the top 3 software vulnerabilities
in your environment, ordered by the number of machines
with the software.
To see the full software list, select
Show more to open your software inventory.
There’s information about the software,
how many weaknesses there are, active threats,
and how many exposed machines exists per software.
TVM recommends actionable security improvements
that help to improve security posture, and reduce risk.
For more information about TVM, see the documentation
on Microsoft Docs.