Microsoft Defender
Virtual Ninja Show
Covering everything from basics to advanced insights, this show explores a broad range of subjects and highlights how Microsoft Defender differentiates from other security solutions by serving as the operational layer for unified, coordinated, predictive protection across your entire digital landscape. Every episode is designed to boost your expertise so you can enhance your organization’s security.
Resources
Find the right tools
Download Ninja Cat backgrounds
Add Ninja Cat to your Microsoft Teams meeting using our collection of backgrounds.
Download nowOn demand sessions
Filters
Enhanced Salesforce connector in Defender for Cloud Apps
Recent ShinyHunters campaigns have shown how attackers can exploit trusted Salesforce integrations, OAuth applications, and SaaS-to-SaaS trust relationships to gain persistent access and quietly exfiltrate sensitive business data. Senior Security Researcher Doug Cranston joins us to share key lessons learned from investigating these attacks and examine emerging techniques used to abuse modern cloud application ecosystems. Discover how the Salesforce connector for Microsoft Defender for Cloud Apps provides near-real-time telemetry, richer investigative context, and deeper visibility into connected applications.
Doug Cranston
Microsoft
Microsoft Teams Security: Emerging threats and new critical Defender capabilities
In this episode, we dive into the attacks targeting Microsoft Teams—phishing, impersonation, malicious calls, and other social engineering techniques used by threat actors today. Dive in as Jeremy Beckley and Malvika Balaraj explain how Defender XDR detections are being developed to help SOC teams gain visibility into these attacks, and recent Microsoft Defender for Office 365 capabilities that help customers protect, detect, investigate, and respond to emerging Teams-based threats.
Jeremy Beckley
Microsoft
Malvika Balaraj
Microsoft
Securing local AI agents with Microsoft Defender
In this episode, Senior Product Manager Eitan Shteinberg explains why local AI agents are now an endpoint security concern, how security teams can discover agents running on Windows endpoints, and how Defender provides visibility into agent, user, device, and configuration context. Learn how Defender XDR helps SOC teams investigate agent activity, review blocked behavior, and hunt across local agent, endpoint, identity, and alert data, and ultimately helps organizations safely adopt local AI agents by giving security teams visibility, control, runtime protection for supported scenarios, and investigation workflows in Defender XDR.
Eitan Shteinberg
Microsoft
Microsoft Purview: Custom Posture Reporting
In this episode, Senior Product Manager Sarahzin Shane breaks down how Custom Posture Reports transform complex security data into clear, actionable insights. Rather than focusing on isolated alerts, these reports give organizations a scalable way to evaluate whether their data protection controls are truly effective. Tune in to explore how teams can tailor reporting to align with their most critical risks, priorities, and compliance goals—helping security leaders move from reactive monitoring to proactive decision-making.
Sarahzin Shane
Microsoft
One policy engine to govern them all: Securing agentic AI with Microsoft Purview
In this episode, returning expert guest Innocent Wafula joins us to explore how organizations can securely scale Agentic AI across platforms using Microsoft Purview as the centralized policy engine. Through a live architecture walkthrough, you’ll see how agents built on Microsoft Foundry and AWS Bedrock can leverage the same Purview instance for real-time policy evaluation and unified data protection. Learn how a “build anywhere, govern once” approach empowers developers to innovate faster while enabling security teams to maintain centralized control over sensitive data.
Redefining identity security for the modern enterprise
In today’s threat landscape, identity is the primary attack surface—and the most critical control plane for securing modern enterprises. As organizations expand across cloud, hybrid, SaaS, and now AI-driven environments, traditional approaches to identity security are no longer enough.Join Microsoft experts to learn how Microsoft is redefining the discipline with a unified, end-to-end solution that spans identity infrastructure, access control, and threat detection and response. This differentiated approach brings these layers together into a continuous, real-time feedback loop, enabling organizations to see identity activity as it happens, understand relationships and risk in context, and act quickly when threats emerge.
Jared Ross
Microsoft
Martin Schvartzman
Microsoft
Security Copilot chat experience in Microsoft Defender
Senior Product Manager Yuval Derman joins us for this episode to discuss the Security Copilot chat experience in Microsoft Defender and how assistive AI is transforming modern security operations. Learn how Security Copilot serves as the AI layer across Microsoft’s integrated security platform, enabling SOC teams to work faster and more effectively through context-aware, natural language experiences embedded directly into their workflow. Discover how analysts can investigate incidents, correlate signals across alerts, identities, and devices, and accelerate response actions using real-time Defender telemetry.
Yuval Derman
Microsoft
Estimate costs with confidence using the new Sentinel Cost Estimator
Product Manager Shubh Khandhadia introduces the new Microsoft Sentinel Cost Estimator, a web-based tool on the Microsoft Sentinel pricing page that helps sellers, customers, and partners estimate costs before deployment. Learn how to access and use the estimator, model ingestion, storage, and query costs, understand key meters and included benefits, and build 3-year projections to support more effective long-term planning.
Shubh Khandhadia
Microsoft
Seamless Migration to the Unified MDI Sensor (V3)
Learn how Microsoft Defender for Identity enables a streamlined migration from the classic (v2.x) sensor to the unified (v3.x) sensor. Ronit Litinski joins us to talk through the new portal‑based migration experience that allows customers to transition with no downtime, no data duplication, and continuous protection—while gaining visibility into migration readiness, progress, and post‑migration configuration to optimize identity threat coverage.
Ronit Litinsky
Microsoft
The future of identity protection with Predictive Shielding
In this episode we explore how predictive shielding is anticipating attacks before they unfold. Nimrod Roimy and Aviv Sharon join us to share how Microsoft is the first vendor to leverage attack path graphs to detect early signs of compromise, pioneering a way to harden devices that store critical identities and proactively block domain-wide breaches. Tune in to learn how identity-based attack paths are exploited and how organizations can stop identity takeover before it spreads.
Aviv Sharon
Microsoft
Nimrod Roimy
Microsoft
Beyond KQL: Unlocking SOC Insights with Sentinel data lake Jupyter Notebooks
Principal Product Managers Javier Soriano and David Hoerster introduce Jupyter Notebooks, explore the benefits they offer, and highlight their value within Microsoft Sentinel’s data lake. Join them for a step-by-step walkthrough on getting started, reading from and writing to the data lake, scheduling recurring notebook tasks, and applying advanced techniques to shape and analyze your data. You’ll also see how GitHub Copilot Chat can help streamline notebook development to take your data lake to the next level.
David Hoerster
Microsoft
Javier Soriano
Microsoft
Extending Attack Disruption beyond Microsoft: third‑party signals in action
Attack Disruption is a high-confidence, scenario-driven capability for containing active threats across Microsoft security workloads, and as organizations increasingly rely on third-party identity, cloud, and email platforms, extending protection beyond first-party signals is critical. In this episode, we focus on Attack Disruption for third-party integrations, including supported products and the attack scenarios now covered using external signals. Tune in to discover the required integrations, permissions, and key configuration considerations to help you get started.
Christos Ventouris
Microsoft
Ofer Schreiber
Microsoft
Autonomous AI Agents in Microsoft Defender
Corina returns to showcase three new Microsoft Defender agents: the alert triage agent, threat intelligence briefing agent, and dynamic threat detection agent. Discover how these advanced AI capabilities, guided by proper SOC expertise, can operate autonomously to help teams scale faster and strengthen their security posture. Tune in to learn essential best practices for communicating effectively with agents so they can better enhance and streamline your workflow.
Watch Part 1: New skills in Microsoft Defender
Corina Feuerstein
Microsoft
New skills in Microsoft Defender
Explore the journey of using AI in modern cyber defense and how this transformative technology is reshaping security operations. Returning expert Corina Feuerstein shares valuable insights of how SOC teams can benefit from AI skills built into Microsoft Defender to enable faster, smarter, and more resilient cyber defense.
Watch Part 2: Autonomous AI Agents in Microsoft Defender
Corina Feuerstein
Microsoft
New AI-powered SIEM migration experience
Discover the enhanced migration workflow and the key benefits it brings to organizations transitioning their SIEM platforms. Senior Product Manager Yossi Hasson joins us to provide hands-on guidance and best practices for migrating from Splunk and QRadar to Microsoft Sentinel, while also addressing common questions and challenges teams encounter along the way.
Yossi Hasson
Microsoft
Technical AI Agent foundations and Microsoft Entra Agent ID
Anton Staykov joins to share a technical overview of the new Microsoft Entra Agent ID, explaining what AI agents are, how they operate, and how their behavior evolves through data and interactions. This episode covers the foundations of a new identity model to support AI Agent deployments, enforcing ownership and manage permissions and lifecycle for agent identities. Tune in to gain a practical understanding of this new feature in Microsoft Entra.
Anton Staykov
Microsoft
Inside OAuth App: Risks, Real Attacks, and How Microsoft Defender Shuts Them Down
Product Manager Kijo Girardi and Senior Security Researcher Shaleen Dev P.K. break down what OAuth apps really are – and their related risky relationship with attackers. Tune in to walk through the threat landscape, learn how Microsoft Defender detects suspicious OAuth activity, and how attack disruption automatically contains malicious app scenarios in real time. Don’t miss the bonus practical hunting query to help you track OAuth app behavior and spot trouble before it spreads.