Endpoint Security Engineering

Lab Pack - the configurations and the data to work them against

Separate from the toolkit, deliberately. The toolkit is read-only code you take to a real estate. This is material to learn against.

Configurations: An attack surface reduction deployment with a per-rule position for the audit-then-promote sequence, and a Sysmon baseline tuned to complement the endpoint sensor rather than duplicate it.

Data: An audit event set, so the promotion decision in ES4.3 can be worked without a live tenant. Reading evidence whose answer you can check is the point.

KQL: What a rule would have blocked by application and population, the four device health cells as counts rather than a percentage, and running mode with signature age across the estate.

Templates: The architecture document the capstone produces, section by section against the modules.

Test before using in your environment. These configurations are tuned for the course environment. Deploy every one in audit mode first, measure what it would have blocked against your own estate, and validate under your own change process before enforcing anything.

Toolkit - the readbacks, to take with you

Separate from the lab pack, deliberately. The lab pack is evidence and configuration to learn against. This is code you take to a real estate, and the two carry different risk.

ESIR, a PowerShell module. Eight functions, one per verification question the course asks: whether the antivirus engine is acting rather than merely enabled, which of the four links behind the cloud protection switch are set, what is excluded and whether the automatic layer was switched off, which attack surface rules are configured against which are acting, the effective application control mode per collection, what the device control default enforcement permits, the exploit mitigations in force, and all of it as one row per machine for a fleet sweep.

Three shell scripts for the platforms that are not PowerShell. The Linux reader takes the supplementary events subsystem first, because that is the field distinguishing a host collecting everything from one on the netlink fallback collecting process events alone. The macOS reader takes full disk access by command, because a permission granted through a management profile is not displayed in the operating system's own privacy pane and checking there returns a false negative on a working Mac. The third reads whether the mandatory integrity layer four of your macOS controls rest on still holds.

Read-only, by design. There is no Set- verb anywhere in it and no script writes, installs or remediates. A readback that can also change a setting is a readback nobody will let you run on a production server. Each function also reports what it could not establish alongside what it could: it will tell you the engine is passive and refuse to call that unprotected, because only the first of those is a reading.

Test before using in your environment. These are written against the command lines this course teaches and are built for the lab: run them first against a machine whose answer you already know, satisfy yourself they report what you expect, and validate them under your own change process before they go anywhere near live work.

Course Resources - what comes with the modules

Every course carries a resources phase built for that course and no other. It is the part subscribers keep going back to long after they have read the modules once.

Study Guide - Endpoint Security Engineering

The course as a book. Ten chapters following the modules, every section of the course inside them, and under each one what it teaches, the settings and commands that do the work and the figures that show it. 195 pages.

It is generated from the published course rather than written alongside it, so it cannot drift from what you are being taught. Yours to print, annotate and keep, including after a subscription lapses.

Things you need to know

What are the prerequisites for this course?

There are no prerequisites. The course teaches endpoint security from first principles. Familiarity with the Microsoft 365 admin center and Intune will help you move faster through the early modules, but neither is required. Every concept is explained at first use.

What are the device requirements?

A device with at least 8 GB of RAM. Access to a Microsoft 365 E5 tenant (a developer subscription if you qualify for one, otherwise a 30-day E5 trial) with Defender for Endpoint and Intune for hands-on configuration. The lab pack provides synthetic data if you cannot use a live environment.

How will the course benefit your career?

Endpoints remain the most common initial access vector in breaches. Organizations need engineers who can tune Defender for Endpoint beyond defaults, promote ASR rules to block mode with confidence, and defend every exception the estate carries. This course gives you those skills.

The demand for endpoint security engineers continues to grow as organizations move from basic MDE onboarding to fully tuned, multi-platform endpoint security programs.