RexCommand uses Microsoft Defender Indicators to detect web domains that are likely to be AI chatbots. RexCommand maintains the indicator list for you—once you enable the required Defender setting and connect Defender to RexCommand, RexCommand manages the rest.
This article walks you through the required Defender configuration and an optional step to improve browser telemetry outside of Microsoft Edge (for example, Google Chrome).
Prerequisites
A Microsoft Defender for Endpoint subscription Plan 3 (P3) or higher.
An account with admin permissions to change settings in Microsoft Defender for Endpoint.
For Shadow AI detection using Defender: Windows 10 version 1709 or later on each device you want covered.
Outcome
After you complete this article:
Custom network indicators are enabled in Microsoft Defender for Endpoint (required).
(Optional) Network protection is enabled on endpoints to improve telemetry for non-Edge browsers (for example, Chrome).
You are fully connected to Microsoft Defender with RexCommand.
Step 1 (required): Enable Custom network indicators
Navigate to https://security.microsoft.com/.
In the Navigation Menubar, scroll down and select System.
Select Settings.
Select Endpoints.
On the Endpoints screen, scroll to Advanced features.
Find Custom network indicators and toggle it On (if it is not already enabled).
If you do not see Custom network indicators, confirm you are signed in with an account that can manage Microsoft Defender for Endpoint settings.
Step 2 (optional): Improve telemetry for browsers outside Microsoft Edge
This step can improve Shadow AI detection reporting for browsers such as Google Chrome.
Prerequisites for this step
An endpoint management service (for example, Microsoft Intune) to run a policy or script across devices.
Test these settings on a small group of devices before broad deployment, and follow your organisation’s change control process.
Use your endpoint management tool to run the following commands on each Windows device you want included in reporting:
Set-MpPreference -EnableNetworkProtection Enabled reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v QuicAllowed /t REG_DWORD /d 0 /f reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v EncryptedClientHelloEnabled /t REG_DWORD /d 0 /f
Confirm the commands have run successfully across your target devices.
You typically deploy these commands using a device policy, script, or package.