When our security team is investigating an alert, our standard process is to identify the source of the malicious activity and create a custom indicator (File Hash, IP Address, URL/Domain, Certificate) in the Defender portal. A major blocker for us is the ability to do this at scale. If we know a particular IP Address is the source of an active malware campaign, why shouldn't we block that IP Address for all of our clients?
The ability to create custom indicators in all of our clients' tenants would be incredibly valuable to us, and I believe Nerdio is well positioned to solve this problem.
Comments (2 comments)