2.3.1. Advanced Features, Rules Settings, and Custom Data Collection
💡 First Principle: MDE ships with a baseline, and the tenant-wide settings pages decide which optional capabilities are switched on, which organization-specific rules shape detection and blocking, and whether extra telemetry beyond the default is collected. Each is a deliberate trade between capability, noise, and cost.
Advanced features (Settings > Endpoints > Advanced features) are tenant-wide toggles. The ones that recur in scenarios:
- Live response, Live response for servers, and Live response unsigned script execution gate remote shell access to devices (3.4.2).
- Allow or block file enables blocking a file hash across the organization (requires Microsoft Defender Antivirus active with cloud-based protection).
- Custom network indicators enables allow and block indicators for IPs, domains, and URLs.
- Tamper protection prevents attackers or local admins from turning off Defender Antivirus and related settings.
- EDR in block mode lets MDE block malicious artifacts even when Defender Antivirus runs in passive mode behind a third-party antivirus.
- Automatically resolve alerts resolves alerts when automated investigation finds no threat or has remediated it.
- Restrict correlation to within scoped device groups keeps alerts from different device groups from merging into one incident, useful for separate regional SOCs.
- Automatic attack disruption, Device discovery, Web content filtering, Microsoft Intune connection (device risk for Conditional Access), Defender for Cloud Apps integration, and Share endpoint alerts with Microsoft Purview connect MDE to the wider platform.
Rules settings (Settings > Endpoints > Rules) hold the organization's ordinances:
| Rule type | What it does |
|---|---|
| Alert suppression rules | Suppress specific recurring benign alerts (now managed as Defender XDR alert tuning, 2.4.1) |
| Indicators | Allow, audit, warn, or block files (hashes), certificates, IPs, URLs, and domains; "block and remediate" for files |
| Process memory indicators | Indicators for in-memory content |
| Web content filtering | Policies that block website categories |
| Automation uploads | Whether automated investigation can upload files for deep analysis |
| Automation folder exclusions | Folders automated investigation should skip |
| Asset rule management | Rules that apply dynamic tags to devices, used for targeting |
Custom data collection extends MDE telemetry beyond the default. MDE deliberately doesn't record every event (that would be too noisy and costly), but some investigations need more, such as every DLL load from a specific folder or every network connection from a specific process. You create custom data collection rules in the Defender portal that specify an event category, filters on event properties (folder paths, process names, network attributes), and a device scope defined by dynamic tags from asset rule management (manual tags aren't supported). Matching events are sent to a connected Sentinel workspace in dedicated tables: DeviceCustomProcessEvents, DeviceCustomFileEvents, DeviceCustomNetworkEvents, DeviceCustomImageLoadEvents, and DeviceCustomScriptEvents. Each rule is capped at 75,000 events per device in a rolling 24-hour window, after which that rule pauses on that device until the window resets. Narrow filters and tight device scoping are how you control cost.
⚠️ Exam Trap: Custom data collection requires a connected Sentinel workspace and targets devices by dynamic tags. "Collect additional process events from finance servers by adding a manual tag" fails; the devices need a dynamic tag from an asset rule. And the data lands in DeviceCustom* tables in Sentinel, not in the standard DeviceProcessEvents table.
Reflection Question: Why does MDE filter some endpoint events out by default, and what does custom data collection let you trade to get them back?
