diff --git a/docs/Microsoft-Insights/Usage-Guide.md b/docs/Microsoft-Insights/Usage-Guide.md index 55cf369..f8cd2b7 100644 --- a/docs/Microsoft-Insights/Usage-Guide.md +++ b/docs/Microsoft-Insights/Usage-Guide.md @@ -1,6 +1,7 @@ # Microsoft Insights Usage Guide !!! note + This article has recently been published and is subject to change. ## Overview @@ -15,6 +16,7 @@ The integration between SHI One and Microsoft gives you incredible visibility in - **What do I do with this information?** !!! info + The data found in this report is populated from SHIELD. Data will not be available unless you have deployed SHIELD into your environment. For instructions on how to install SHIELD, see [Overview and Installation Requirements](/SHIELD/Prerequisites/Installation). For more information about SHIELD, see [SHI Environment Lockdown and Defense (SHIELD)](https://www.shi.com/it-lifecycle-services/software-lifecycle-management/shield){:target="_blank"}. --- @@ -87,14 +89,13 @@ Next to each feature you will see summary of the feature in your environment. Th - **MAU (Monthly Active Users)** - Users who actively use the service within the monthly period. - **In Scope** - Users who have the service plan enabled in their license profile. - **Purchased** - The number of licenses that have been purchased by your organization. + To understand this information, consider the following two examples: **Example 1: Endpoint Detection & Response Feature Usage** -- Endpoint Detection & Response - - MAU: **134** - - IN SCOPE: **152** - - PURCHASED: **210** +![Example 1 - Endpoint detection & response - 134/152/210 - Light](../assets/Images/Screenshots/example-1-endpoint-detection-and-response-light.png#only-light){ loading=lazy } +![Example 1 - Endpoint detection & response - 134/152/210 - Dark](../assets/Images/Screenshots/example-1-endpoint-detection-and-response-dark.png#only-dark){ loading=lazy } - **Purchased Licenses**: The organization owns **210** licenses for the **Endpoint Detection & Response** feature. - **Endpoints Enabled**: This feature has been enabled on **152** devices or endpoints. @@ -104,10 +105,8 @@ In this example, the organization is not overconsuming the **Endpoint Detection **Example 2: Identity Theft Protection Feature Usage** -- Identity Theft Protection - - MAU: **220** - - IN SCOPE: **275** - - PURCHASED: **210** +![Example 2 - Identity Theft Protection - 220/275/210 - Light](../assets/Images/Screenshots/example-2-identity-theft-protection-light.png#only-light){ loading=lazy } +![Example 2 - Identity Theft Protection - 220/275/210 - Dark](../assets/Images/Screenshots/example-2-identity-theft-protection-dark.png#only-dark){ loading=lazy } - **Purchased Licenses**: The organization owns **210** licenses for the **Identity Theft Protection** feature. - **Endpoints Enabled**: The feature has been enabled on **275** devices or endpoints. @@ -123,6 +122,7 @@ A warning appears when you have more users using a feature than the number of li ![Microsoft Insights Overview - Dark](../assets/Images/Screenshots/MI-warning-dark.png#only-dark){ loading=lazy } !!! info + Sometimes, you might notice that the number of monthly active users is higher than the number of users "in scope." This is not an error; it's simply a result of how Microsoft calculates and reports these metrics. ### License Types @@ -159,6 +159,7 @@ In total, the feature is being used on **1,180** devices, but the organization h 2. **Reduce the number of devices** using the feature to match the number of licenses owned !!! note + Not every feature displays the associated license type. However, you will still be able to see monthly active users (**MAU**), the number of endpoints with the feature enabled (**In scope**), the number of licenses owned (**Purchased**). ### Activity diff --git a/docs/SHIELD/Prerequisites/Application-Permissions.md b/docs/SHIELD/Prerequisites/Application-Permissions.md index 693eb88..a78055c 100644 --- a/docs/SHIELD/Prerequisites/Application-Permissions.md +++ b/docs/SHIELD/Prerequisites/Application-Permissions.md @@ -109,7 +109,7 @@ Coming Soon! Coming Soon! -## `Grant-MIGraphPermission` Usage +## Grant-MIGraphPermission Usage The Grant MI Graph Permission PowerShell script is an easy way to bulk apply permissions to managed identities using either the command line or a graphical picker. You can find the script here at the [PowerShell gallery](https://www.powershellgallery.com/packages/Grant-MIGraphPermission). diff --git a/docs/SHIELD/Prerequisites/Installation.md b/docs/SHIELD/Prerequisites/Installation.md index e11119e..4b58e78 100644 --- a/docs/SHIELD/Prerequisites/Installation.md +++ b/docs/SHIELD/Prerequisites/Installation.md @@ -5,6 +5,7 @@ SHIELD is a self-hosted application deployed in a customer’s Azure App Service tenant. SHIELD collects and processes all necessary data exclusively within the customer’s environment, then returns only abstracted and fully anonymized results back to SHI for reporting. All requirements can be set up by the delivery team or customer prior to engagement. This guide explains how to install the SHIELD - Desktop application and run your first scan. For more information about requirements, pricing, and more, see [Prerequisites](/SHIELD/Prerequisites). !!! info "Security Considerations" + While this application requires sensitive permissions to conduct the automated scan, by self-hosting the application, SHI does not represent a supply chain risk or path to compromise a customer environment via the SHIELD platform, as there is no control maintained beyond the initial point of installation. All code being run to conduct the automated discovery is available for code and security reviews prior to engagement upon request. Permissions exist for both the user initiating the report and the application itself. Code review is available upon request. --- @@ -19,11 +20,11 @@ Every organization uses different equipment and processes, so the steps to disab **How to Proceed**: -- If you’re not sure how to disable network traffic inspection, please contact your networking team, security team, or the person in charge of information technology at your organization. -- You can also share the following network endpoints with your networking team to have the addresses excluded from inspection: +- If you are not sure how to disable network traffic inspection, please contact your networking team, security team, or the person in charge of information technology at your organization. +- You can also share the following network endpoints with your networking team to have the addresses excluded from inspection: - `https://api.shilab.com` - `https://url.shilab.com` - - `https://*.azurewebsites.net` - *Your specific deployment URL (generated after deployment)* + - `https://*.azurewebsites.net` - _Your specific deployment URL (generated after deployment)_ **Common Network Traffic Inspection Technologies** @@ -40,34 +41,37 @@ For more information about traffic inspection, see [Network Traffic Inspection]( ### Create a Dedicated Azure Subscription -1. Sign in to your Azure portal. +1. Sign in to your Azure portal. - **Enterprise**: [https://portal.azure.com/](https://portal.azure.com/){:target="_blank"} - **Government**: [https://portal.azure.us/](https://portal.azure.us/){:target="_blank"} -2. Navigate to **Subscriptions** and click **+ Add**. -3. If applicable, choose an offer type from the options provided. **Enterprise Agreement (EA) customers** typically do not have to select an offer type. -4. Enter a name for the subscription (e.g., "SHIELD – Production") or similar. -5. **Enterprise Agreement (EA) customers**: Assign a billing account and confirm creation. +2. Navigate to **Subscriptions** and click **+ Add**. +3. If applicable, choose an offer type from the options provided. **Enterprise Agreement (EA) customers** typically do not have to select an offer type. +4. Enter a name for the subscription (e.g., "SHIELD – Production") or similar. +5. **Enterprise Agreement (EA) customers**: Assign a billing account and confirm creation. --- -### Global Administrator +### Permissions + +!!! note -The user installing SHIELD must be a **Global Administrator** in order to grant Microsoft Graph application permissions via admin consent. For more information about permissions, see [Application Permissions](./Application-Permissions). + - **Installing User**: The user installing SHIELD must be a `Global Administrator` in order to grant Microsoft Graph application permissions via admin consent. + - **Application**: SHIELD Desktop must be granted `Application.ReadWrite.All` and `AppRoleAssignment.ReadWrite.All` permissions by the user installing SHIELD or another admin. For more information about permissions, see [Application Permissions](./Application-Permissions). -1. Sign in to your Entra ID admin center. +1. Sign in to your Entra ID admin center. - **Enterprise**: [https://entra.microsoft.com/](https://entra.microsoft.com/){:target="_blank"} - **Government**: [https://entra.microsoft.us/](https://entra.microsoft.us/){:target="_blank"} -2. Navigate to **Roles & admins**. -3. Search for and click on the **Global Administrator** role. -4. If the user deploying SHIELD is already assigned the **Global Administrator** role, no additional action is required. If a user needs to be assigned the **Global Administrator** role, follow the steps below: - 1. At the top, click **+ Add Assignments**. - 2. Click the link under **Select member(s)**. - 3. Check the box next to the desired user and click **Select**. You can also use the search bar if needed. - 4. Select your desired settings. We recommend the following: +2. Navigate to **Roles & admins**. +3. Search for and click on the **Global Administrator** role. +4. If the user deploying SHIELD is already assigned the **Global Administrator** role, no additional action is required. If a user needs to be assigned the **Global Administrator** role, follow the steps below: + 1. At the top, click **+ Add Assignments**. + 2. Click the link under **Select member(s)**. + 3. Check the box next to the desired user and click **Select**. You can also use the search bar if needed. + 4. Select your desired settings. We recommend the following: - Assignment type: **Active** - Permanently eligible: Uncheck - Assignment duration: 24-48 hours - 5. Click **Assign**. + 5. Click **Assign**. --- @@ -75,24 +79,24 @@ The user installing SHIELD must be a **Global Administrator** in order to grant Make sure the user installing SHIELD is the **Owner** on the Azure subscription in order to deploy resources. -1. Sign in to your Azure portal. +1. Sign in to your Azure portal. - **Enterprise**: [https://portal.azure.com/](https://portal.azure.com/){:target="_blank"} - **Government**: [https://portal.azure.us/](https://portal.azure.us/){:target="_blank"} -2. Navigate to **Subscriptions** and select the subscription to be used with SHIELD. -3. Click **Access control (IAM)** in the left navigation bar. -4. Click on the **Role assignments** tab. -5. If the user deploying SHIELD is already assigned the **Owner** role of the subscription, no additional action is required. If a user needs to be assigned the **Owner** role, follow the steps below: - 1. At the top, click **+ Add** and click **Add role assignment** in the drop-down menu. - 2. Click on the **Privileged administrator** roles tab. - 3. Click on the **Owner** role so it is highlighted and click **Next**. - 4. Click **+ Select members**, click on the desired user account, and click **Select**. - 5. Click **Next**. - 6. Select **Allow user to assign all roles (highly privileged)**. - 7. Click **Next**. - 8. If applicable, select your desired Assignment type settings. We recommend the following: +2. Navigate to **Subscriptions** and select the subscription to be used with SHIELD. +3. Click **Access control (IAM)** in the left navigation bar. +4. Click on the **Role assignments** tab. +5. If the user deploying SHIELD is already assigned the **Owner** role of the subscription, no additional action is required. If a user needs to be assigned the **Owner** role, follow the steps below: + 1. At the top, click **+ Add** and click **Add role assignment** in the drop-down menu. + 2. Click on the **Privileged administrator** roles tab. + 3. Click on the **Owner** role so it is highlighted and click **Next**. + 4. Click **+ Select members**, click on the desired user account, and click **Select**. + 5. Click **Next**. + 6. Select **Allow user to assign all roles (highly privileged)**. + 7. Click **Next**. + 8. If applicable, select your desired Assignment type settings. We recommend the following: - Assignment type: **Active** - Assignment duration: **Permanent** - 9. Once finalized, click **Review + assign**. + 9. Once finalized, click **Review + assign**. 10. (Optional) Confirm the role appears in the **Role assignments** tab. --- @@ -100,54 +104,64 @@ Make sure the user installing SHIELD is the **Owner** on the Azure subscription ## Install and Deploy SHIELD Discover !!! info "SHIELD Installation Has Changed" + The **SHIELD - Desktop** application is now the preferred method, for faster and easier installation.

**Why?** The desktop application automates most steps, making setup much simpler.

**Manual Installation**: If you prefer the manual method, please reach out to an SHI employee for guidance and support. -0. Run the installer to set up SHIELD automatically using the following link: [https://url.shilab.com/shield-install](https://url.shilab.com/shield-install) +1. Run the installer to set up SHIELD automatically using the following link: [https://url.shilab.com/shield-install](https://url.shilab.com/shield-install) - **Note**: The download will not work if network traffic inspection is enabled, especially in Microsoft/Azure environments. -1. After installation, launch the SHIELD - Desktop application. -2. Log in using the account manager in the top right corner. Be sure to log in with the account that has the necessary **Owner** and **Global Administrator** permissions in Azure. These are required to grant the necessary permissions for deployment. -3. After you are successfully logged in, click on the **Installer** module. +2. After installation, launch the SHIELD - Desktop application. +3. Log in using the account manager in the top right corner. Be sure to log in with the account that has the necessary **Owner** and **Global Administrator** permissions in Azure. These are required to grant the necessary permissions for deployment. +4. After you are successfully logged in, click on the **Installer** module. - **Note**: An additional tab may open, and another log in may be required. -4. Select the **Azure Subscription** that is dedicated for SHIELD. -5. Select your desired **Azure Region** from the drop-down menu. **West US 3** is recommended, but other regions can be selected depending on company policy. -6. Click on the toggle switch to display **Advanced Options**. -7. For **Operation Mode**, select **Discover** from the drop-down menu. -8. Click on the **Deploy** button for the SHIELD installer to begin the installation process. +5. Select the **Azure Subscription** that is dedicated for SHIELD. +6. Select your desired **Azure Region** from the drop-down menu. **West US 3** is recommended, but other regions can be selected depending on company policy. +7. Click on the toggle switch to display **Advanced Options**. +8. For **Operation Mode**, select **Discover** from the drop-down menu. +9. Click on the **Deploy** button for the SHIELD installer to begin the installation process. - **Note**: An additional tab may open, and another log in may be required. -9. The installer will do the following: +10. The installer will do the following: - Download the SHIELD Deploy ZIP file - Create a SHIELD App Service and managed identity in Azure - Upload and configure the SHIELD application, including permissions and security settings such as disabling basic auth, enabling encryption, and setting quantum-resistant cryptography. -10. After deployment, verify the following required permissions are granted to the SHIELD managed identity in Azure: +11. After deployment, grant the following required permissions to the SHIELD managed identity in Azure: - `Application.ReadWrite.All` - `AppRoleAssignment.ReadWrite.All` -11. Lastly, assign the Read and Write Everything role to the user who will run SHIELD scans via the "SHIELD End User Login" enterprise app in Entra. - 1. Sign in to your Entra ID admin center. +12. Lastly, assign the Read and Write Everything role to the user who will run SHIELD scans via the "SHIELD End User Login" enterprise app in Entra. + 1. Sign in to your Entra ID admin center. - **Enterprise**: [https://entra.microsoft.com/](https://entra.microsoft.com/){:target="_blank"} - **Government**: [https://entra.microsoft.us/](https://entra.microsoft.us/){:target="_blank"} - 2. Navigate to **Enterprise apps** in the navigation bar. - 3. Clear out the **Enterprise Applications** filter. - 4. Search for 'SHIELD End User Login' and click on the name of the application. - 5. Click **Users and groups** in the left navigation bar. - 6. Click **+ Add user/group**. - 7. Click the link under **Users and groups**. - 8. Check the box next to the desired user and click **Select**. You can also use the search bar if needed. - 9. Click on the link under **Select a role**. + 2. Navigate to **Enterprise apps** in the navigation bar. + 3. Clear out the **Enterprise Applications** filter. + 4. Search for 'SHIELD End User Login' and click on the name of the application. + 5. Click **Users and groups** in the left navigation bar. + 6. Click **+ Add user/group**. + 7. Click the link under **Users and groups**. + 8. Check the box next to the desired user and click **Select**. You can also use the search bar if needed. + 9. Click on the link under **Select a role**. 10. Search for 'Read and Write Everything', click on the name of the role, and click **Select**. 11. Click **Assign**. ## Running the SHIELD Web Instance -1. Navigate to your SHIELD web instance in your browser: [https://portal.azure.com/](https://portal.azure.com/){:target="_blank"} -2. Click **Resource groups**. -3. Click **SHIELD**. -4. Click on the App Service that starts with "shield-xxxxxxxxx" (the x's are a random set of lower-case letters and numbers). -5. In the top right corner, click on the **Default domain** link. **Example**: shield-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxx.eastus-01.azurewebsites.net -6. Log in to the SHIELD web instance with the account that has the necessary Azure permissions. -7. Click on **Discover Module**. -8. Click **Start Authentication Sync**. Then click **Start Report Collection** to start scanning the tenant environment. -9. During the first scan, SHIELD - Desktop will open and request account credentials multiple times. Log in each time as required. You will also need to accept each set of permissions. -10. Once the scan is complete, reports are available on the SHIELD web instance. - 1. Click **Discover** in the left navigation pane and click **Overview**. +1. Sign in to your Azure portal. + - **Enterprise**: [https://portal.azure.com/](https://portal.azure.com/){:target="_blank"} + - **Government**: [https://portal.azure.us/](https://portal.azure.us/){:target="_blank"} +2. Navigate to **Subscriptions** and select the subscription dedicated to SHIELD. +3. Click **Resource groups**. +4. Click **SHIELD**. +5. Click on the App Service that starts with "shield-xxxxxxxxx" (the x's are a random set of lower-case letters and numbers). + - **Deactivate Health Check (One time only)** + 1. Click on the link next **Health Check**. + 2. Uncheck the box next to **Health check** and click **Apply**. + 3. Click **Save**. +6. Click **Overview** in the left navigation bar. +7. In the top right corner, click on the **Default domain** link. + - **Example**: shield-xxxxxx-xxxxxxxx.eastus-01.azurewebsites.net +8. Log in to the SHIELD web instance with the account that has the necessary Azure permissions. +9. Click on **Discover Module**. +10. Click **Start Authentication Sync**. Then click **Start Report Collection** to start scanning the tenant environment. +11. During the first scan, SHIELD - Desktop will open and request account credentials multiple times. Log in each time as required. You will also need to accept each set of permissions. +12. Once the scan is complete, reports are available on the SHIELD web instance. + 1. Click **Discover** in the left navigation pane and click **Overview**. \ No newline at end of file diff --git a/docs/SHIELD/index.md b/docs/SHIELD/index.md index fbe2eca..7cd435f 100644 --- a/docs/SHIELD/index.md +++ b/docs/SHIELD/index.md @@ -2,24 +2,20 @@ ## Overview +SHIELD is a hybrid SaaS solution with a customer-installed app in their Azure tenant. The SHIELD app service is an orchestration tool that simplifies the deployment, management, and maintenance of Microsoft's Secure Privileged Access architecture. With SHIELD, you can automate the deployment of complex security infrastructures, device management, and user management while adhering to security best practices. SHIELD helps organizations to reduce the time and expertise required for deployment from a year or more to just a few minutes. -SHIELD is a hybrid SaaS solution with a customer-installed app in their Azure tenant. The SHIELD app service is an orchestration tool that simplifies the deployment, management, and maintenance of Microsoft's Secure Privileged Access architecture. With SHIELD, you can automate the deployment of complex security infrastructures, device management, and user management while adhering to security best practices. SHIELD helps organizations to reduce the time and expertise required for deployment from a year or more to just a few minutes. - - -SHI operates a centralized SaaS service in its own Azure tenant known as the Data Gateway. This is a SaaS component shared by multiple customers using tenant isolation via access token claims cryptographically signed by Microsoft Entra ID. It provides storage, analysis, and reporting services for SHIELD data. The SHIELD app service collects and processes data within the customer tenant before providing abstracted & fully anonymized data results back to the Data Gateway for reporting and analysis. - +SHI operates a centralized SaaS service in its own Azure tenant known as the Data Gateway. This is a SaaS component shared by multiple customers using tenant isolation via access token claims cryptographically signed by Microsoft Entra ID. It provides storage, analysis, and reporting services for SHIELD data. The SHIELD app service collects and processes data within the customer tenant before providing abstracted & fully anonymized data results back to the Data Gateway for reporting and analysis. !!! info "Security Considerations" - SHI does not manage or access the SHIELD app service runtime. Where authorized by the customer, the SHIELD app service may initiate configuration changes in the customer's tenant using delegated or application permissions explicitly consented to by the customer. All requirements can be set up by the delivery team or customer prior to engagement. Note that these configuration changes are deployed as security policies which will need further customer action to associate them with users. + SHI does not manage or access the SHIELD app service runtime. Where authorized by the customer, the SHIELD app service may initiate configuration changes in the customer's tenant using delegated or application permissions explicitly consented to by the customer. All requirements can be set up by the delivery team or customer prior to engagement. Note that these configuration changes are deployed as security policies which will need further customer action to associate them with users. ## Architecture Topology The following diagram shows the high-level SHIELD deployment and trust boundaries between the customer tenant, SHI's SaaS tenant, and Microsoft Entra ID. SHIELD components that are deployed to customer environments are outlined in red. -![This diagram illustrates a multi-tenant Microsoft Azure topology showing a vendor (SHI) tenant and a customer tenant within the Microsoft Azure Global boundary. Key components: the SHI tenant contains a Data Gateway and ShiLab.com; Microsoft Entra ID is shown as the identity service bridging or present in the environment; the Customer Tenant contains a SHIELD Resource Group which houses SHIELD, auxiliary components (SHIELD VNet, PS Proxy service, Key Vault, network interfaces, DNS zones) and customer resources. The relationships indicate the logical grouping of resources by tenant and resource group and highlight where identity and gateway components reside relative to the customer SHIELD deployment.](../assets/images/Overview/Overview-Light.png#only-light){ loading=lazy } -![This diagram illustrates a multi-tenant Microsoft Azure topology showing a vendor (SHI) tenant and a customer tenant within the Microsoft Azure Global boundary. Key components: the SHI tenant contains a Data Gateway and ShiLab.com; Microsoft Entra ID is shown as the identity service bridging or present in the environment; the Customer Tenant contains a SHIELD Resource Group which houses SHIELD, auxiliary components (SHIELD VNet, PS Proxy service, Key Vault, network interfaces, DNS zones) and customer resources. The relationships indicate the logical grouping of resources by tenant and resource group and highlight where identity and gateway components reside relative to the customer SHIELD deployment.](../assets/images/Overview/Overview-Dark.png#only-dark){ loading=lazy } - +![This diagram illustrates a multi-tenant Microsoft Azure topology showing a vendor (SHI) tenant and a customer tenant within the Microsoft Azure Global boundary. Key components: the SHI tenant contains a Data Gateway and ShiLab.com; Microsoft Entra ID is shown as the identity service bridging or present in the environment; the Customer Tenant contains a SHIELD Resource Group which houses SHIELD, auxiliary components (SHIELD VNet, PS Proxy service, Key Vault, network interfaces, DNS zones) and customer resources. The relationships indicate the logical grouping of resources by tenant and resource group and highlight where identity and gateway components reside relative to the customer SHIELD deployment.](../assets/Images/Overview/Overview-Light.png#only-light){ loading=lazy } +![This diagram illustrates a multi-tenant Microsoft Azure topology showing a vendor (SHI) tenant and a customer tenant within the Microsoft Azure Global boundary. Key components: the SHI tenant contains a Data Gateway and ShiLab.com; Microsoft Entra ID is shown as the identity service bridging or present in the environment; the Customer Tenant contains a SHIELD Resource Group which houses SHIELD, auxiliary components (SHIELD VNet, PS Proxy service, Key Vault, network interfaces, DNS zones) and customer resources. The relationships indicate the logical grouping of resources by tenant and resource group and highlight where identity and gateway components reside relative to the customer SHIELD deployment.](../assets/Images/Overview/Overview-Dark.png#only-dark){ loading=lazy } ## Audience @@ -44,7 +40,7 @@ Check out this page for more details: [Getting Started - Prerequisites](Prerequi ## Installation -The SHIELD installer ('SHIELD - Desktop') is downloaded to the customer tenant and executed by an administrator. During installation, the administrator is required to authenticate interactively to the customers' Azure tenant. The installer uses this authenticated session to provision an Azure App Service and associated resources directly into the tenant under the customers' ownership and governance. No resources are deployed without explicit customer action and consent, and the resulting App Service operates entirely within the customers' Azure subscription. +The SHIELD installer ('SHIELD - Desktop') is downloaded to the customer tenant and executed by an administrator. During installation, the administrator is required to authenticate interactively to the customers' Azure tenant. The installer uses this authenticated session to provision an Azure App Service and associated resources directly into the tenant under the customers' ownership and governance. No resources are deployed without explicit customer action and consent, and the resulting App Service operates entirely within the customers' Azure subscription. The installer provisions the SHIELD UI web application and associated components to the customer's tenant. ## SHIELD Module Overview @@ -53,7 +49,7 @@ Depending on licensing, the following components will be available from the UI: [SHIELD Discover](https://docs.shilab.com/SHIELD/Discover/) The Discover module enables advanced licensing intelligence and compliance reporting for Microsoft 365 services. It interrogates the Graph API, Defender API and Purview API to extract licensing information for the customer's tenant. It can then generate compliance reports for later analysis. -```mermaid +``` mermaid flowchart TD subgraph m365["Primary Inputs"] graphApi[Microsoft Graph API] @@ -89,12 +85,7 @@ flowchart TD Click this link to see more on [Secure Privileged Access](https://learn.microsoft.com/en-us/security/privileged-access-workstations/overview) - - - - - -```mermaid +``` mermaid flowchart TD B[SHIELD Defend] B --> C[Security and readiness checks] @@ -110,13 +101,13 @@ flowchart TD ``` +

-[SHIELD Deploy](https://docs.shilab.com/SHIELD/Deploy/) SHIELD's Deploy module provides the foundation for a secure environment using Microsoft's Securing Privileged Access (SPA) architecture. This module automates the provisioning of security-critical components such as identity boundaries, privileged access zones, Conditional Access policies, and more. - +[SHIELD Deploy](https://docs.shilab.com/SHIELD/Deploy/) SHIELD's Deploy module provides the foundation for a secure environment using Microsoft's Securing Privileged Access (SPA) architecture. This module automates the provisioning of security-critical components such as identity boundaries, privileged access zones, Conditional Access policies, and more. -```mermaid +``` mermaid flowchart TD B[Deploy Module] @@ -136,6 +127,7 @@ flowchart TD D2 --> H D2 --> I ``` +

diff --git a/docs/assets/Images/Screenshots/example-1-endpoint-detection-and-response-dark.png b/docs/assets/Images/Screenshots/example-1-endpoint-detection-and-response-dark.png new file mode 100644 index 0000000..e487b53 Binary files /dev/null and b/docs/assets/Images/Screenshots/example-1-endpoint-detection-and-response-dark.png differ diff --git a/docs/assets/Images/Screenshots/example-1-endpoint-detection-and-response-light.png b/docs/assets/Images/Screenshots/example-1-endpoint-detection-and-response-light.png new file mode 100644 index 0000000..627214f Binary files /dev/null and b/docs/assets/Images/Screenshots/example-1-endpoint-detection-and-response-light.png differ diff --git a/docs/assets/Images/Screenshots/example-2-identity-theft-protection-dark.png b/docs/assets/Images/Screenshots/example-2-identity-theft-protection-dark.png new file mode 100644 index 0000000..6caa18a Binary files /dev/null and b/docs/assets/Images/Screenshots/example-2-identity-theft-protection-dark.png differ diff --git a/docs/assets/Images/Screenshots/example-2-identity-theft-protection-light.png b/docs/assets/Images/Screenshots/example-2-identity-theft-protection-light.png new file mode 100644 index 0000000..ecd9ea3 Binary files /dev/null and b/docs/assets/Images/Screenshots/example-2-identity-theft-protection-light.png differ