Orange County NC Website
Browse       Search
Statement of Work <br />Orange County NC <br />v20221005 March 8, 2023 p. 8 of 26 <br />• Facilitating the migration from Advanced Threat Analytics (ATA) to Defender for <br />Identity. <br /> <br />The following is out of scope: <br />• Project management of the customer's remediation activities. <br />• Ongoing management, threat response, and remediation. <br />• Deploying Defender for Identity as a proof of concept. <br />• Supporting GCC-High or GCC-DoD (Office 365 US Government). <br />• Deploying or performing the following Defender for Identity sensor activities: <br />o Manual capacity planning. <br />o Running the Auditing tool. <br />o Deploying the standalone sensor. <br />o Deploying to Active Directory Federation Services (AD FS) servers. <br />o Deploying the sensor using a Network Interface Card (NIC) Teaming adaptor. <br />o Deploying the sensor through a third-party tool. <br />o Connecting to the Defender for Identity cloud service through a web proxy <br />connection. <br />• Configuring the Microsoft account (MSA) in Active Directory. <br />• Creation and management of honeytokens. <br />• Enabling Network Name Resolution (NNR). <br />• Configuration of Deleted Objects container. <br />• Deployment guidance or education on: <br />o Remediating or interpreting various alert types and monitored activities. <br />o Investigating a user, computer, lateral movement path, or entity. <br />o Threat or advanced hunting. <br />o Incident response. <br />• Providing a security alert lab tutorial for Defender for Identity. <br />• Providing notification when Defender for Identity detects suspicious activities by sending <br />security alerts to your syslog server through a nominated sensor. <br />• Configuring Defender for Identity to perform queries using security account manager <br />remote (SAMR) protocol to identify local admins on specific machines. <br />• Configuring VPN solutions to add information from the VPN connection to a user’s profile <br />page. <br />• Security information and event management (SIEM) or API integration (including Azure <br />Sentinel). <br /> <br />Microsoft Defender for Cloud Apps <br />Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that provides rich <br />visibility, control over data travel, and sophisticated analytics to identify and combat cyber threats <br />across all your Microsoft and third-party cloud services. We provide remote guidance for: <br />• Configuring the portal, including: <br />o Importing user groups. <br />o Managing admin access and settings. <br />o Scoping your deployment to select certain user groups to monitor or exclude from <br />monitoring. <br />o How to set up IP ranges and tags. <br />o Personalizing the end-user experience with your logo and custom messaging. <br />• Integrating first-party services including: <br />o Microsoft Defender for Endpoint. <br />DocuSign Envelope ID: 4F8CE7A2-004B-4516-AE7C-0C68141E2FF6