<story><title>Zeek is now a component of Microsoft Windows</title><url>https://corelight.com/company/zeek-now-component-of-microsoft-windows</url></story><parent_chain><item><author>Beached</author><text>the details here are insanely thin on the how. is this rolled out to every windows 10&amp;#x2F;11 os in the next security kb? is this a windows feature that can be enabled by enterprise editing only? do I need defender atp license for it? can I fw the data to my detection engine at my enterprise like normal or does this go to a cloud console in azure somewhere first? is this designed to be available to enterprises, or data to improve Microsoft&amp;#x27;s defender product?&lt;p&gt;if ms is getting this data, how the hell can they afford the disk space?! my bro implementation was 250GB&amp;#x2F;h of disk space for 20k endpoints. I can only fathom what all windows agents would generate.&lt;p&gt;soo many questions around this still</text></item></parent_chain><comment><author>worewood</author><text>That one is easy, having worked with space-constrained data collection myself (not personal data, it&amp;#x27;s sensor data so no ethical concerns).&lt;p&gt;You do a &amp;quot;pre-summarization&amp;quot; of the data on the client side, and just send a report to the mothership. Consequence of this is that it will result in using CPU resources of the client - and that explains why the telemetry service eats so much of it on Windows.</text></comment>
<story><title>Zeek is now a component of Microsoft Windows</title><url>https://corelight.com/company/zeek-now-component-of-microsoft-windows</url></story><parent_chain><item><author>Beached</author><text>the details here are insanely thin on the how. is this rolled out to every windows 10&amp;#x2F;11 os in the next security kb? is this a windows feature that can be enabled by enterprise editing only? do I need defender atp license for it? can I fw the data to my detection engine at my enterprise like normal or does this go to a cloud console in azure somewhere first? is this designed to be available to enterprises, or data to improve Microsoft&amp;#x27;s defender product?&lt;p&gt;if ms is getting this data, how the hell can they afford the disk space?! my bro implementation was 250GB&amp;#x2F;h of disk space for 20k endpoints. I can only fathom what all windows agents would generate.&lt;p&gt;soo many questions around this still</text></item></parent_chain><comment><author>Godel_unicode</author><text>It’s being rolled out as a capability in MDE:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;techcommunity.microsoft.com&amp;#x2F;t5&amp;#x2F;microsoft-defender-for-endpoint&amp;#x2F;microsoft-defender-for-endpoint-announcements-at-microsoft&amp;#x2F;ba-p&amp;#x2F;3646025&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;techcommunity.microsoft.com&amp;#x2F;t5&amp;#x2F;microsoft-defender-fo...&lt;/a&gt;</text></comment>