cuong do

Posted on Oct 14 Originally published at gitlab.com

Defender for Endpoint Day 3: device timeline, inventory and vulnerability management

#azure #cybersecurity #microsoft #security

My own Day 3 study notes on Defender for Endpoint, rewritten as a hands-on guide and checked against Microsoft Learn (October 2026).

Day 2 onboarded devices and decided who can see them (MDE Day 2: onboarding and access). Day 3 is about using that data.

In my lab, the Weaknesses page showed a critical CVE (CVSS 9.8) in Microsoft Edge on a server with no alerts and no incidents. It only showed up because I went looking. And once you fix something like that, the score can stay red until the next day. So this post is also about what is slow by design and what is actually broken.

All screenshots come from my own lab tenant. Device names, IPs and URLs are blacked out or cropped.

TL;DR

Device inventory is where you find a device. The timeline tells you what happened on it. Vulnerability management tells you what could happen next.
Defender for Endpoint Plan 2 already includes core vulnerability management. Security baselines, browser extensions and certificate checks need the add-on (or Defender for Servers Plan 2 for servers).
Most "I fixed it but it's still red" moments are just timing: the exposure score recalculates daily, and excluding a device takes up to 10 hours.

1. Find the device in the inventory
2. Read the device page and know your response actions
3. Investigate with the device timeline
4. Which vulnerability management do you actually have?
5. Weaknesses, recommendations and software inventory
6. Exceptions and security baselines
7. Exclude a device (it is not an exception)
8. Scores and reports
Gotchas
Day 3 checklist
Sources

1. Find the device in the inventory

Go to Assets > Devices in the Defender portal. It opens on All devices, with tabs for Computers & mobile, Network devices, IoT/OT and Uncategorized.

The tiles at the top (High risk, High exposure, Not onboarded...) work as quick filters.
Search works on device name, IP address and MAC address.
The inventory holds both onboarded devices and devices found by device discovery. Discovered devices are not onboarded, so don't expect a timeline or response actions on them until you onboard them.

In the Filter pane I mostly use Managed by and Exclusion state:

Internet-facing devices

Windows devices get an internet facing tag when an external scan reaches them or they receive incoming internet connections. Hover over the tag for the reason. After 48 hours with no new events the tag disappears, which may just mean the device went quiet, not that you fixed anything.

Sources: Device inventory · Identify internet-facing devices

2. Read the device page and know your response actions

The device page has tabs for Timeline, Security recommendations, Inventories, Discovered vulnerabilities, Missing KBs and Security baselines. My lab server showed Exposure level: Medium and "No active alerts or incidents" at the same time. That's why Day 3 exists.

The ... menu holds the response actions:

Action	What to remember
Run antivirus scan	Quick or full. Works even when Defender Antivirus is in passive mode
Isolate device	Cuts the network but keeps the Defender connection. Needs the Active remediation actions permission. Undo with Release from isolation
Contain device	Tells other onboarded devices to block it. Microsoft suggests no more than 100 at a time
Restrict app execution	Only Microsoft-signed files can run. Reversible
Collect investigation package	A forensics zip (autoruns, processes, connections, event logs)
Exclude	Hides the device from vulnerability management. See section 7

Two traps: Plan 1 only gets a few of these (antivirus scan, isolate, stop and quarantine a file, indicators), and every action is tracked in the Action center and on the timeline, so check there whether it actually worked.

Source: Take response actions on a device

3. Investigate with the device timeline

Device page > Timeline. It's the device's diary, minus the feelings.

Default view is the last 30 days. The calendar picker switches to a day, a week, 30 days or a custom range. Data is kept for 90 days.
Events tagged with a MITRE ATT&CK technique (like T1059.001 in my screenshot) show up in bold with a blue icon. Click one for the tactic, the description and a link to MITRE.
Hunt for related events opens an advanced hunting query (without the technique row itself).
Flags: flag the events that matter, then Filters > Flagged events. That's your attack story without scrolling through 4,000 PowerShell lines.
Export covers up to seven days. Need more? Export in chunks or use advanced hunting.

Source: Device timeline

4. Which vulnerability management do you actually have?

My notes said "TVM". The product is now Microsoft Defender Vulnerability Management. On endpoints:

Capability	MDE Plan 2	+ Add-on	Standalone
Device discovery and inventory	✅	✅	✅
Vulnerability and configuration assessment	✅	✅	✅
Risk-based prioritization, remediation tracking	✅	✅	✅
Software inventory and usage insights	✅	✅	✅
Security baselines assessment		✅	✅
Block vulnerable applications		✅	✅
Browser extensions, digital certificates		✅	✅
Network share analysis, hardware and firmware		✅	✅

For servers, Defender for Servers Plan 1 gets the core set and Plan 2 adds the premium features.

Also changed since my notes: Windows authenticated scan is no longer supported, it's not available for Defender for Business, and some tenants now find it under Exposure management > Vulnerability management instead of Endpoints > Vulnerability management.

Sources: Compare Defender Vulnerability Management offerings

5. Weaknesses, recommendations and software inventory

Weaknesses lists every CVE your devices are exposed to. Mine showed 56 vulnerabilities, 4 exploitable and 1 critical. Filtering on Severity: Critical left the Edge CVE from the intro.

The red bug icon means a public exploit exists. The target icon means a related alert is active. Sort by those first.
CSV export is capped at 6,000 records. Filter before you export.

Recommendations turn CVEs into work items like "update Edge". The Impact column shows the expected drop in exposure score and rise in Secure Score for Devices. Remediation options sends the request to Intune for the IT team.

Inventories > Software shows only software with an official CPE (a standard product ID) by default. Software without one says Not available for weaknesses, which means "not supported", not "safe". Data refreshes every three to four hours, with no button to force it.

Sources: Vulnerabilities in my organization · Security recommendations · Software inventory

6. Exceptions and security baselines

When a recommendation doesn't fit (a third-party tool covers it, or the fix is planned), use Exception options on it. You need the exception handling permission. My notes said global exceptions need Global Administrator; Microsoft now says Security Administrator or a custom role with exception handling is enough. Here it is in the role wizard:

Scope: per device group, or global.
Justification matters: Microsoft names Third party control and Alternate mitigation as the ones that reduce the score impact. "Risk accepted" hides the noise but doesn't make you look safer. Fair enough.
Exceptions can't be extended, take up to an hour to reach the score, and live on Remediation > Exceptions.

Security baselines (add-on)

Baselines check devices against CIS or STIG benchmarks. A profile picks software, benchmark, configurations and device groups:

Baselines have their own exceptions:

Limits: only Group Policy settings are assessed, no non-English system locales, and PowerShell Constrained Language Mode must be off.

Sources: Exceptions overview · Create and view exceptions · Security baselines assessment

7. Exclude a device (it is not an exception)

An exception says "this recommendation doesn't apply here". An exclusion says "stop showing me this device in vulnerability management at all". It's in the device page ... menu as Exclude.

Pick a justification (inactive, duplicate, out of scope...) and write a note.
Bulk exclusion takes up to 10 hours. Stopping an exclusion takes up to 8 hours.
The device stays in the inventory with Exclusion state: Excluded, so the filter from section 1 finds it.
It protects nothing. The device keeps its risk, it just stops counting.

Exclude only dead, duplicate or truly out-of-scope devices. Excluding a live server to turn the dashboard green is taping over the check-engine light.

Source: Exclude devices

8. Scores and reports

Exposure score (vulnerability management dashboard): 0–29 low, 30–69 medium, 70–100 high. Lower is better. It recalculates daily, so allow up to 24 hours after a fix.

Microsoft Secure Score: higher is better, covers identities, apps and devices. It's calculated separately from the exposure score, so one can move without the other.

Reports > Endpoints > Monthly Security Summary covers the last 30 or 90 days: secure score, onboarded devices, threat protection and web filtering. Generate PDF report gives you the last 30 days, ready for the manager who "just wants one slide".

Device health, antivirus, firewall, ASR rules and device control reports sit on the same Reports page.

Sources: Exposure score · Microsoft Secure Score · Defender for Endpoint reports

Gotchas

Before deciding "the portal is broken", check how long things are supposed to take:

You did this	It shows up after
Updated software on a device	About 2 hours, sometimes longer
Changed a configuration	4 to 24 hours
Fixed a CVE	Usually 24–48 hours on the Weaknesses page
Exposure score after any fix	Up to 24 hours (daily recalculation)
Created an exception	Up to 1 hour
Excluded devices	Up to 10 hours (8 to undo)
Device went quiet	Internet-facing tag removed after 48 hours

And a few more:

Inventory export ignores your filters. It exports every device in the tenant. Filter the CSV afterwards.
Timeline export stops at 7 days. Plan for it before an incident review.
The exposure score can go up after you patch. New CVEs land in the same daily calculation. Annoying, but normal.

Day 3 checklist

[ ] Inventory filters known: Managed by, Exclusion state, internet facing
[ ] Response actions checked against my plan (Plan 1 vs Plan 2)
[ ] Practiced the timeline: flag events, filter flagged, export a range
[ ] Know whether I have core, add-on or standalone vulnerability management
[ ] Critical and exploitable CVEs reviewed on Weaknesses
[ ] Exception handling given only to the people who need it
[ ] Exclusions used only for dead, duplicate or out-of-scope devices
[ ] Monthly Security Summary PDF sent to whoever asks for "one slide"

Day 4 is next: advanced hunting and troubleshooting the portal and vulnerability data.

DEV Community