Workflow for Harden Windows Security Using GUI + Intune

[zygmuntszpak]

Hi,
Thanks very much for building such a wonderful resource and application. I would be grateful if you could comment on a suggested workflow for using your application in conjunction with Intune. For example, how would one best make use of "AppControl Manger" + Intune?

Presumably, one doesn't want to apply anything directly to a PC using your application, but rather export the settings as files which are then uploaded to intune and deployed via intune?

Best wishes,
Zygmunt

[HotCakeX]

Hello,
Thank you 🙏

For Intune, i recently added totally automated remote deployment:
https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-To-Upload-App-Control-Policies-To-Intune-Using-AppControl-Manager

When I get back to my computer (hopefully today), i'll finish working on a feature that allows you to automatically retrieve MDE Advanced Hunting logs through the AppControl Manager.

That'll offer a completes workflow where you can Deploy policies to remote systems + Audit them + create supplemental policies using MDE AH logs + deploy supplemental policies, all through the Microsoft Graph and without leaving the app.

I'm constantly adding more features for remote/cloud scenarios. If you have any feature requests or ideas in mind, feel free to open a suggestion so i can implement it.

[HotCakeX]

Released the update i was talking about, that's more MS Graph/Intune integration
https://github.com/HotCakeX/Harden-Windows-Security/releases/tag/AppControlManager.v.1.8.8.0

[dspencer42]

That looks great! Honestly I am absolutely loving this system! It blows away everything MS offers for it.

I would throw out there that as a suggestion\ask\would be nice kind of thing..

I am sadly not able to connect AppControl Manager to invune via graphs (Not a technical issue) but I would love to have under the MDE Advanced Hunting tab, one additional tab.

One that had the Kusto queries to drop into MDE to generate a properly formatted CSV to import back into the app.

[HotCakeX]

Thank you! @dspencer42

That's a good suggestion, so like a button that you press and see queries like these with a copy button to quickly copy and paste them in MDE portal's website?

DeviceEvents
| where ActionType startswith "AppControlCodeIntegrity"
   or ActionType startswith "AppControlCIScriptBlocked"
   or ActionType startswith "AppControlCIScriptAudited"

or

DeviceEvents
| where (ActionType startswith "AppControlCodeIntegrity"
    or ActionType startswith "AppControlCIScriptBlocked"
    or ActionType startswith "AppControlCIScriptAudited")
    and DeviceName == "mainframe"

[HotCakeX]

Added what you requested to the latest AppControl Manager version: https://github.com/HotCakeX/Harden-Windows-Security/releases/tag/AppControlManager.v.1.8.9.0