{"id":70,"title":"Microsoft 365 Defender'daki Live Response \u00f6zelli\u011fi","content":"Microsoft 365 Defender'daki\u00a0<strong>Canl\u0131 Yan\u0131t (Live Response)<\/strong> \u00f6zelli\u011fi, U\u00e7 Nokta i\u00e7in Microsoft Defender (MDE) ve Microsoft U\u00e7 Nokta Veri Kayb\u0131 \u00d6nleme (MEIDP) taraf\u0131ndan i\u015flenen ve izlenen olaylar\u0131 belirlemede kullan\u0131\u015fl\u0131 bir ara\u00e7t\u0131r. \u0130\u015fte bu olaylar\u0131 tespit etmek i\u00e7in <strong>Live Response <\/strong>kullan\u0131m\u0131; <h3><strong>Canl\u0131 Yan\u0131t ile \u0130\u015flenen Olaylar\u0131 Belirleme Y\u00f6ntemleri<\/strong><\/h3> <h4><strong>a) \u0130\u015flem Merkezi (Action Center) \u0130ncelemesi<\/strong><\/h4> <ul> <li> <p ><strong>M365 Defender Portal<\/strong>\u00a0&gt;\u00a0<strong>\u0130\u015flem Merkezi<\/strong>\u2019nde denetlenmi\u015f Canl\u0131 Yan\u0131t komutlar\u0131n\u0131 ve y\u00fcr\u00fct\u00fclen i\u015flemleri g\u00f6r\u00fcnt\u00fcleyebilirsiniz.<\/p> <\/li> <li> <p >Burada, MDE ve MEIDP'nin hangi olaylar\u0131 i\u015fledi\u011fine dair ge\u00e7mi\u015f komut g\u00fcnl\u00fckleri ve eylemler listelenir.<\/p> <\/li> <\/ul> <h4><strong>b) MDE API Kullan\u0131m\u0131<\/strong><\/h4> <p ><strong>MDE API<\/strong>\u00a0ile makine eylemlerini ve Canl\u0131 Yan\u0131t isteklerini sorgulayarak i\u015flenen olaylar\u0131n kapsaml\u0131 bir listesini alabilirsiniz.<\/p> \u00d6rne\u011fin: <pre  data-enlighter-language=\"generic\">GET https:\/\/api.securitycenter.microsoft.com\/api\/machineactions<\/pre> <p >API yan\u0131tlar\u0131, hangi olaylar\u0131n i\u015flendi\u011fine dair detaylar i\u00e7erir (\u00f6rne\u011fin, vir\u00fcsten koruma taramalar\u0131, DLP ihlalleri).<\/p> <h4><strong>Canl\u0131 Yan\u0131t Komut Dosyalar\u0131 ile Log Toplama<\/strong><\/h4> <ul> <li> <p >Canl\u0131 Yan\u0131t oturumunda a\u015fa\u011f\u0131daki komutlarla belirli olay g\u00fcnl\u00fcklerini toplayabilirsiniz:<\/p> <ul> <li> <p ><strong><code>Get-MpThreatDetection<\/code><\/strong>: Defender Vir\u00fcsten Koruma tehdit kay\u0131tlar\u0131n\u0131 listeler.<\/p> <\/li> <li> <p ><strong><code>Get-WinEvent -LogName \"Microsoft-Windows-Windows Defender\/Operational\"<\/code><\/strong>: Defender g\u00fcnl\u00fcklerini \u00e7eker.<\/p> <\/li> <li> <p ><strong><code>Get-WinEvent -LogName \"Microsoft-Windows-DLP\/Operational\"<\/code><\/strong>: MEIDP olaylar\u0131n\u0131 kontrol eder.<\/p> <\/li> <li> <p ><strong><code>Get-NetEventPacketCapture<\/code><\/strong>: A\u011f izleme verilerini g\u00f6r\u00fcnt\u00fcler.<\/p> <\/li> <\/ul> <\/li> <\/ul> <h3><strong>MDE ve MEIDP Taraf\u0131ndan \u0130\u015flenen Olay T\u00fcrleri<\/strong><\/h3> <p >A\u015fa\u011f\u0131daki olaylar genellikle MDE ve MEIDP taraf\u0131ndan otomatik olarak i\u015flenir ve Canl\u0131 Yan\u0131t ile sorgulanabilir:<\/p> <h4><strong>\u00a0Sens\u00f6r &amp; Cihaz Sa\u011fl\u0131\u011f\u0131 Kay\u0131tlar\u0131<\/strong><\/h4> <ul> <li> <p >Cihaz\u0131n MDE'ye ba\u011flant\u0131 durumu, sinyal kay\u0131plar\u0131, sens\u00f6r hatalar\u0131.<\/p> <\/li> <\/ul> <h4><strong>\u00a0Microsoft Defender Vir\u00fcsten Koruma G\u00fcnl\u00fckleri<\/strong><\/h4> <ul> <li> <p >K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m tespitleri, engellenen tehditler, tarama sonu\u00e7lar\u0131.<\/p> <\/li> <\/ul> <h4><strong>\u00a0Veri Kayb\u0131 \u00d6nleme (DLP) Olaylar\u0131<\/strong><\/h4> <ul> <li> <p >Hassas veri s\u0131z\u0131nt\u0131lar\u0131, politik ihlaller, \u015fifrelenmemi\u015f veri transferleri.<\/p> <\/li> <\/ul> <h4><strong>\u00a0A\u011f ve Windows Filtre Platformu (WFP) Kay\u0131tlar\u0131<\/strong><\/h4> <ul> <li> <p >\u015e\u00fcpheli a\u011f ba\u011flant\u0131lar\u0131, engellenen trafik, g\u00fcvenlik duvar\u0131 kurallar\u0131 ihlalleri.<\/p> <\/li> <\/ul> <h4><strong>\u00a0Di\u011fer Windows Olaylar\u0131<\/strong><\/h4> <ul> <li> <p ><strong>Process Creation (4688)<\/strong>: \u015e\u00fcpheli i\u015flem ba\u015flatmalar\u0131.<\/p> <\/li> <li> <p ><strong>PowerShell Script Block Logging (4104)<\/strong>: K\u00f6t\u00fc ama\u00e7l\u0131 komut dosyas\u0131 \u00e7al\u0131\u015ft\u0131rma giri\u015fimleri.<\/p> <\/li> <li> <p ><strong>Registry Modifications<\/strong>: Kritik kay\u0131t defteri de\u011fi\u015fiklikleri.<\/p> <\/li> <\/ul> <h3><strong>Microsoft Sentinel Entegrasyonu<\/strong><\/h3> <ul> <li> <p ><strong>Sentinel'de MDE ve MEIDP olaylar\u0131n\u0131<\/strong>\u00a0<code>SecurityAlert<\/code>\u00a0veya\u00a0<code>DeviceEvents<\/code>\u00a0tablolar\u0131ndan sorgulayarak merkezi izleme yapabilirsiniz.<\/p> <\/li> <\/ul> <pre  data-enlighter-language=\"generic\">SecurityAlert | where ProviderName contains \"Microsoft Defender\" | summarize count() by AlertName<\/pre> <p ><strong>Not: G\u00fcnl\u00fck Saklama S\u00fcreleri<\/strong>: Canl\u0131 Yan\u0131t ile toplanan verilerin saklama s\u00fcresi, Microsoft 365 lisans\u0131n\u0131za g\u00f6re de\u011fi\u015fir (\u00f6rne\u011fin, E5'te 30 g\u00fcn).Canl\u0131 Yan\u0131t, MDE ve MEIDP'nin i\u015fledi\u011fi olaylar\u0131\u00a0<strong>ger\u00e7ek zamanl\u0131<\/strong>\u00a0olarak incelemek i\u00e7in g\u00fc\u00e7l\u00fc bir ara\u00e7t\u0131r. \u0130\u015flem Merkezi, API sorgular\u0131 ve \u00f6zel komut dosyalar\u0131 ile kapsaml\u0131 bir izleme sa\u011flayabilirsiniz. Kurulumunuza \u00f6zg\u00fc detaylar i\u00e7in\u00a0<a href=\"https:\/\/docs.microsoft.com\/en-us\/microsoft-365\/security\/\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Docs<\/a>\u2019u kontrol etmeniz \u00f6nerilir.<\/p>","excerpt":"Microsoft 365 Defender'daki\u00a0Canl\u0131 Yan\u0131t (Live Response) \u00f6zelli\u011fi, U\u00e7 Nokta i\u00e7in Microsoft Defender (MDE) ve Microsoft U\u00e7 Nokta Veri Kayb\u0131...","created_at":"2025-05-03 10:30:40","updated_at":"2026-09-07 09:02:50","category_id":7,"view_count":822,"reading_time":3,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-05-03 10:30:40","featured_image":"resimyok.jpg","slug":"microsoft-365-defenderdaki-live-response-ozelligi","category_name":"Cyber Security","category_slug":"cyber-security"}