mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-26 15:53:40 +00:00
Merge branch 'master' of https://github.com/MicrosoftDocs/windows-docs-pr
This commit is contained in:
greg-lindsay
@ -93,7 +93,7 @@ The following is a high-level view of the main wifi components in Windows.
|
||||
- Managing connectivity of wireless networks</td></tr>
|
||||
<tr><td><img src="images/msm.png" alt="Media Specific Module"></td><td>The <b>Media Specific Module</b> (MSM) handles security aspects of connection being established.</td></tr>
|
||||
<tr><td><img src="images/wifi-stack.png" alt="Native WiFi stack"></td><td>The <b>Native WiFi stack</b> consists of drivers and wireless APIs to interact with wireless miniports and the supporting user-mode Wlansvc.</td></tr>
|
||||
<tr><td><img src="images/miniport.png" alt="Miniport"></td><td>Third-party <b>wireless miniport</b> drivers interface with the upper wireless stack to provide notifications to and receive commands from Windows.</td></tr>
|
||||
<tr><td><img src="images/miniport.png" alt="Wireless miniport"></td><td>Third-party <b>wireless miniport</b> drivers interface with the upper wireless stack to provide notifications to and receive commands from Windows.</td></tr>
|
||||
</table>
|
||||
|
||||
|
||||
|
||||
@ -121,28 +121,28 @@ Since there is no Event Viewer in Windows 10 Mobile, you can use the [Field Medi
|
||||
1. Download and install the [Field Medic]( https://go.microsoft.com/fwlink/p/?LinkId=718232) app from the store.
|
||||
2. Open the Field Medic app and then click on **Advanced**.
|
||||
|
||||
|
||||
|
||||
|
||||
3. Click on **Choose with ETW provider to use**.
|
||||
|
||||
|
||||
|
||||
|
||||
4. Check **Enterprise** and un-check the rest.
|
||||
|
||||
|
||||
|
||||
|
||||
5. In the app, click on **Start Logging** and then perform the operation that you want to troubleshoot.
|
||||
|
||||
|
||||
|
||||
|
||||
6. When the operation is done, click on **Stop Logging**.
|
||||
|
||||
|
||||
|
||||
|
||||
7. Save the logs. They will be stored in the Field Medic log location on the device.
|
||||
8. You can send the logs via email by attaching the files from **Documents > Field Medic > Reports > ...** folder.
|
||||
|
||||
|
||||
|
||||
|
||||
The following table contains a list of common providers and their corresponding GUIDs.
|
||||
|
||||
|
||||
@ -26,7 +26,6 @@ The features described below are no longer being actively developed, and might b
|
||||
|
||||
|Feature | Details and mitigation | Announced in version |
|
||||
| ----------- | --------------------- | ---- |
|
||||
| Cross-device roaming activity | Activity History for [cross-device roaming](https://docs.microsoft.com/windows/uwp/launch-resume/useractivities) is no longer being developed and might be removed at a future date. | 20H2 |
|
||||
| Microsoft Edge | The legacy version of Microsoft Edge is no longer being developed.| 2004 |
|
||||
| Companion Device Framework | The [Companion Device Framework](https://docs.microsoft.com/windows-hardware/design/device-experiences/windows-hello-companion-device-framework) is no longer under active development.| 2004 |
|
||||
| Dynamic Disks | The [Dynamic Disks](https://docs.microsoft.com/windows/win32/fileio/basic-and-dynamic-disks#dynamic-disks) feature is no longer being developed. This feature will be fully replaced by [Storage Spaces](https://docs.microsoft.com/windows-server/storage/storage-spaces/overview) in a future release.| 2004 |
|
||||
|
||||
@ -14,7 +14,7 @@ audience: ITPro
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 02/17/2021
|
||||
ms.date: 03/08/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
@ -64,7 +64,7 @@ Tamper protection doesn't prevent you from viewing your security settings. And,
|
||||
| Turn tamper protection on (or off) for an individual device | [Manage tamper protection on an individual device](#manage-tamper-protection-on-an-individual-device) |
|
||||
| Turn tamper protection on (or off) for all or part of your organization using Intune <p>Fine-tune tamper protection settings in your organization | [Manage tamper protection for your organization using Intune](#manage-tamper-protection-for-your-organization-using-intune) |
|
||||
| Turn tamper protection on (or off) for your organization with Configuration Manager | [Manage tamper protection for your organization using tenant attach with Configuration Manager, version 2006](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006) |
|
||||
| Turn tamper protection on (or off) in the Microsoft Defender Security Center <p>Manage tamper protection across your tenant <p>(Currently in preview) | [Manage tamper protection for your organization using the Microsoft Defender Security Center](#manage-tamper-protection-for-your-organization-using-the-microsoft-defender-security-center) |
|
||||
| Turn tamper protection on (or off) in the Microsoft Defender Security Center <p>Manage tamper protection across your tenant | [Manage tamper protection for your organization using the Microsoft Defender Security Center](#manage-tamper-protection-for-your-organization-using-the-microsoft-defender-security-center) |
|
||||
| View details about tampering attempts on devices | [View information about tampering attempts](#view-information-about-tampering-attempts) |
|
||||
| Review your security recommendations | [Review security recommendations](#review-your-security-recommendations) |
|
||||
| Review the list of frequently asked questions (FAQs) | [Browse the FAQs](#view-information-about-tampering-attempts) |
|
||||
@ -85,7 +85,9 @@ Here's what you see in the Windows Security app:
|
||||
|
||||
|
||||
1. Select **Start**, and start typing *Security*. In the search results, select **Windows Security**.
|
||||
|
||||
2. Select **Virus & threat protection** > **Virus & threat protection settings**.
|
||||
|
||||
3. Set **Tamper Protection** to **On** or **Off**.
|
||||
|
||||
## Manage tamper protection for your organization using Intune
|
||||
@ -95,9 +97,13 @@ If you are part of your organization's security team, and your subscription incl
|
||||
### Requirements for managing tamper protection in Intune
|
||||
|
||||
- You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations.
|
||||
|
||||
- Your organization uses [Intune to manage devices](https://docs.microsoft.com/intune/fundamentals/what-is-device-management). ([Intune licenses](https://docs.microsoft.com/intune/fundamentals/licenses) are required; Intune is included in Microsoft 365 E5.)
|
||||
|
||||
- Your Windows devices must be running Windows 10 OS [1709](https://docs.microsoft.com/windows/release-health/status-windows-10-1709), [1803](https://docs.microsoft.com/windows/release-health/status-windows-10-1803), [1809](https://docs.microsoft.com/windows/release-health/status-windows-10-1809-and-windows-server-2019) or later. (For more information about releases, see [Windows 10 release information](https://docs.microsoft.com/windows/release-health/release-information).)
|
||||
|
||||
- You must be using Windows security with [security intelligence](https://www.microsoft.com/wdsi/definitions) updated to version 1.287.60.0 (or above).
|
||||
|
||||
- Your devices must be using anti-malware platform version 4.18.1906.3 (or above) and anti-malware engine version 1.1.15500.X (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).)
|
||||
|
||||
### Turn tamper protection on (or off) in Intune
|
||||
@ -105,12 +111,15 @@ If you are part of your organization's security team, and your subscription incl
|
||||
|
||||
|
||||
1. Go to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com) and sign in with your work or school account.
|
||||
|
||||
2. Select **Devices** > **Configuration Profiles**.
|
||||
|
||||
3. Create a profile that includes the following settings:
|
||||
- **Platform: Windows 10 and later**
|
||||
- **Profile type: Endpoint protection**
|
||||
- **Category: Microsoft Defender Security Center**
|
||||
- **Tamper Protection: Enabled**
|
||||
|
||||
4. Assign the profile to one or more groups.
|
||||
|
||||
### Are you using Windows OS 1709, 1803, or 1809?
|
||||
@ -120,7 +129,9 @@ If you are using Windows 10 OS [1709](https://docs.microsoft.com/windows/release
|
||||
#### Use PowerShell to determine whether tamper protection is turned on
|
||||
|
||||
1. Open the Windows PowerShell app.
|
||||
|
||||
2. Use the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps&preserve-view=true) PowerShell cmdlet.
|
||||
|
||||
3. In the list of results, look for `IsTamperProtected`. (A value of *true* means tamper protection is enabled.)
|
||||
|
||||
## Manage tamper protection for your organization with Configuration Manager, version 2006
|
||||
@ -133,9 +144,11 @@ If you're using [version 2006 of Configuration Manager](https://docs.microsoft.c
|
||||
|
||||
|
||||
1. Set up tenant attach. See [Microsoft Endpoint Manager tenant attach: Device sync and device actions](https://docs.microsoft.com/mem/configmgr/tenant-attach/device-sync-actions).
|
||||
|
||||
2. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Endpoint security** > **Antivirus**, and choose **+ Create Policy**.<br/>
|
||||
- In the **Platform** list, select **Windows 10 and Windows Server (ConfigMgr)**.
|
||||
- In the **Profile** list, select **Windows Security experience (preview)**. <br/>
|
||||
|
||||
3. Deploy the policy to your device collection.
|
||||
|
||||
### Need help with this?
|
||||
@ -147,24 +160,29 @@ See the following resources:
|
||||
|
||||
## Manage tamper protection for your organization using the Microsoft Defender Security Center
|
||||
|
||||
Currently in preview, tamper protection can be turned on or off in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)). Here are a few points to keep in mind:
|
||||
Tamper protection can be turned on or off for your tenant using the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)). Here are a few points to keep in mind:
|
||||
|
||||
- When you use the Microsoft Defender Security Center to manage tamper protection, you do not have to use Intune or the tenant attach method.
|
||||
|
||||
- When you manage tamper protection in the Microsoft Defender Security Center, the setting is applied tenant wide, affecting all of your devices that are running Windows 10, Windows Server 2016, or Windows Server 2019. To fine-tune tamper protection (such as having tamper protection on for some devices but off for others), use either [Intune](#manage-tamper-protection-for-your-organization-using-intune) or [Configuration Manager with tenant attach](#manage-tamper-protection-for-your-organization-with-configuration-manager-version-2006).
|
||||
|
||||
- If you have a hybrid environment, tamper protection settings configured in Intune take precedence over settings configured in the Microsoft Defender Security Center.
|
||||
- Tamper protection is generally available; however, the ability to manage tamper protection in the Microsoft Defender Security Center is currently in preview.
|
||||
|
||||
### Requirements for managing tamper protection in the Microsoft Defender Security Center
|
||||
|
||||
- You must have appropriate [permissions](../microsoft-defender-atp/assign-portal-access.md), such as global admin, security admin, or security operations.
|
||||
|
||||
- Your Windows devices must be running one of the following versions of Windows:
|
||||
- Windows 10
|
||||
- [Windows Server 2019](/windows-server/get-started-19/whats-new-19)
|
||||
- Windows Server, version [1803](https://docs.microsoft.com/windows/release-health/status-windows-10-1803) or later
|
||||
- [Windows Server 2016](/windows-server/get-started/whats-new-in-windows-server-2016)
|
||||
- For more information about releases, see [Windows 10 release information](https://docs.microsoft.com/windows/release-health/release-information).
|
||||
|
||||
- Your devices must be [onboarded to Microsoft Defender for Endpoint](../microsoft-defender-atp/onboarding.md).
|
||||
|
||||
- Your devices must be using anti-malware platform version 4.18.2010.7 (or above) and anti-malware engine version 1.1.17600.5 (or above). ([Manage Microsoft Defender Antivirus updates and apply baselines](manage-updates-baselines-microsoft-defender-antivirus.md).)
|
||||
|
||||
- [Cloud-delivered protection must be turned on](enable-cloud-protection-microsoft-defender-antivirus.md).
|
||||
|
||||
### Turn tamper protection on (or off) in the Microsoft Defender Security Center
|
||||
@ -172,7 +190,9 @@ Currently in preview, tamper protection can be turned on or off in the Microsoft
|
||||
|
||||
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in.
|
||||
|
||||
2. Choose **Settings**.
|
||||
|
||||
3. Go to **General** > **Advanced features**, and then turn tamper protection on.
|
||||
|
||||
## View information about tampering attempts
|
||||
|
||||
@ -218,7 +218,7 @@ Defender for Endpoint integrates with System Center Endpoint Protection. The int
|
||||
The following steps are required to enable this integration:
|
||||
- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie).
|
||||
|
||||
- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting.
|
||||
- [Configure the SCEP client Cloud Protection Service membership](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus) to the **Advanced** setting.
|
||||
|
||||
<br>
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 80 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 76 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 81 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 68 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 70 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 156 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 151 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 157 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 42 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 23 KiB |
@ -96,12 +96,12 @@ Grant Full Disk Access to the following components:
|
||||
- Microsoft Defender for Endpoint
|
||||
- Identifier: `com.microsoft.wdav`
|
||||
- Identifier Type: Bundle ID
|
||||
- Code Requirement: identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /\* exists \*/ and certificate leaf[field.1.2.840.113635.100.6.1.13] /\* exists \*/ and certificate leaf[subject.OU] = UBF8T346G9
|
||||
- Code Requirement: `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`
|
||||
|
||||
- Microsoft Defender for Endpoint Security Extension
|
||||
- Identifier: `com.microsoft.wdav.epsext`
|
||||
- Identifier Type: Bundle ID
|
||||
- Code Requirement: identifier "com.microsoft.wdav.epsext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9
|
||||
- Code Requirement: `identifier "com.microsoft.wdav.epsext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`
|
||||
|
||||
### Network extension policy
|
||||
|
||||
@ -110,7 +110,7 @@ As part of the Endpoint Detection and Response capabilities, Microsoft Defender
|
||||
- Filter type: Plugin
|
||||
- Plugin bundle identifier: `com.microsoft.wdav`
|
||||
- Filter data provider bundle identifier: `com.microsoft.wdav.netext`
|
||||
- Filter data provider designated requirement: identifier "com.microsoft.wdav.netext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9
|
||||
- Filter data provider designated requirement: `identifier "com.microsoft.wdav.tunnelext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`
|
||||
- Filter sockets: `true`
|
||||
|
||||
## Check installation status
|
||||
|
||||
@ -512,7 +512,7 @@ These steps are applicable of macOS 10.15 (Catalina) or newer.
|
||||
|
||||
- Identifier: `com.microsoft.wdav`
|
||||
- Identifier Type: Bundle ID
|
||||
- Code Requirement: identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /\* exists \*/ and certificate leaf[field.1.2.840.113635.100.6.1.13] /\* exists \*/ and certificate leaf[subject.OU] = UBF8T346G9
|
||||
- Code Requirement: `identifier "com.microsoft.wdav" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`
|
||||
|
||||
|
||||
|
||||
@ -537,7 +537,7 @@ These steps are applicable of macOS 10.15 (Catalina) or newer.
|
||||
|
||||
- Identifier: `com.microsoft.wdav.epsext`
|
||||
- Identifier Type: Bundle ID
|
||||
- Code Requirement: identifier "com.microsoft.wdav.epsext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9
|
||||
- Code Requirement: `identifier "com.microsoft.wdav.epsext" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = UBF8T346G9`
|
||||
|
||||
10. Select **+ Add**.
|
||||
|
||||
|
||||
@ -90,4 +90,4 @@ Devices that are not matched to any groups are added to Ungrouped devices (defau
|
||||
|
||||
- [Manage portal access using role-based based access control](rbac.md)
|
||||
- [Create and manage device tags](machine-tags.md)
|
||||
- [Get list of tenant device groups using Graph API](get-machinegroups-collection.md)
|
||||
- [Get list of tenant device groups using Graph API](https://docs.microsoft.com/graph/api/device-list-memberof)
|
||||
|
||||
@ -85,8 +85,8 @@ Access to Defender for Endpoint is done through a browser, supporting the follow
|
||||
## Hardware and software requirements
|
||||
|
||||
### Supported Windows versions
|
||||
- Windows 7 SP1 Enterprise
|
||||
- Windows 7 SP1 Pro
|
||||
- Windows 7 SP1 Enterprise ([Requires ESU for support](https://docs.microsoft.com/troubleshoot/windows-client/windows-7-eos-faq/windows-7-extended-security-updates-faq).)
|
||||
- Windows 7 SP1 Pro ([Requires ESU for support](https://docs.microsoft.com/troubleshoot/windows-client/windows-7-eos-faq/windows-7-extended-security-updates-faq).)
|
||||
- Windows 8.1 Enterprise
|
||||
- Windows 8.1 Pro
|
||||
- Windows 10 Enterprise
|
||||
|
||||
@ -60,14 +60,10 @@ Topic | Description
|
||||
:---|:---
|
||||
[Onboard previous versions of Windows](onboard-downlevel.md)| Onboard Windows 7 and Windows 8.1 devices to Defender for Endpoint.
|
||||
[Onboard Windows 10 devices](configure-endpoints.md) | You'll need to onboard devices for it to report to the Defender for Endpoint service. Learn about the tools and methods you can use to configure devices in your enterprise.
|
||||
[Onboard servers](configure-server-endpoints.md) | Onboard Windows Server 2012 R2 and Windows Server 2016 to Defender for Endpoint
|
||||
[Onboard servers](configure-server-endpoints.md) | Onboard Windows Server 2008 R2 SP1, Windows Server 2012 R2, Windows Server 2016, Windows Server (SAC) version 1803 and later, Windows Server 2019 and later, and Windows Server 2019 core edition to Defender for Endpoint.
|
||||
[Onboard non-Windows devices](configure-endpoints-non-windows.md) | Defender for Endpoint provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Microsoft Defender Security Center and better protect your organization's network. This experience leverages on a third-party security products' sensor data.
|
||||
[Run a detection test on a newly onboarded device](run-detection-test.md) | Run a script on a newly onboarded device to verify that it is properly reporting to the Defender for Endpoint service.
|
||||
[Configure proxy and Internet settings](configure-proxy-internet.md)| Enable communication with the Defender for Endpoint cloud service by configuring the proxy and Internet connectivity settings.
|
||||
[Troubleshoot onboarding issues](troubleshoot-onboarding.md) | Learn about resolving issues that might arise during onboarding.
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -44,23 +44,37 @@ Selecting an alert's name in Defender for Endpoint will land you on its alert pa
|
||||
3. The **alert story** displays all entities related to the alert, interconnected by a tree view. The alert in the title will be the one in focus when you first land on your selected alert's page. Entities in the alert story are expandable and clickable, to provide additional information and expedite response by allowing you to take actions right in the context of the alert page. Use the alert story to start your investigation. Learn how in [Investigate alerts in Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts).
|
||||
4. The **details pane** will show the details of the selected alert at first, with details and actions related to this alert. If you select any of the affected assets or entities in the alert story, the details pane will change to provide contextual information and actions for the selected object.
|
||||
|
||||
|
||||
Note the detection status for your alert.
|
||||
- Prevented – The attempted suspicious action was avoided. For example, a file either wasn’t written to disk or executed.
|
||||
|
||||
- Blocked – Suspicious behavior was executed and then blocked. For example, a process was executed but because it subsequently exhibited suspicious behaviors, the process was terminated.
|
||||
|
||||
- Detected – An attack was detected and is possibly still active.
|
||||
|
||||
|
||||
Note the detection status for your alert. Blocked, or prevented means actions were already taken by Defender for Endpoint.
|
||||
Start by reviewing the *automated investigation details* in your alert's details pane, to see which actions were already taken, as well as reading the alert's description for recommended actions.
|
||||
|
||||
|
||||
|
||||
You can then also review the *automated investigation details* in your alert's details pane, to see which actions were already taken, as well as reading the alert's description for recommended actions.
|
||||
|
||||
|
||||
|
||||
Other information available in the details pane when the alert opens includes MITRE techniques, source, and additional contextual details.
|
||||
|
||||
|
||||
|
||||
|
||||
## Review affected assets
|
||||
|
||||
Selecting a device or a user card in the affected assets sections will switch to the details of the device or user in the details pane.
|
||||
|
||||
- **For devices** the details pane will display information about the device itself, like Domain, Operating System, and IP. Active alerts and the logged on users on that device are also available. You can take immediate action by isolating the device, restricting app execution, or running an antivirus scan. Alternatively, you could collect an investigation package, initiate an automated investigation, or go to the device page to investigate from the device's point of view.
|
||||
- **For users** the details pane will display detailed user information, such as the user's SAM name and SID, as well as logon types performed by this user and any alerts and incidents related to it. You can select *Open user page* to continue the investigation from that user's point of view.
|
||||
- **For devices**, the details pane will display information about the device itself, like Domain, Operating System, and IP. Active alerts and the logged on users on that device are also available. You can take immediate action by isolating the device, restricting app execution, or running an antivirus scan. Alternatively, you could collect an investigation package, initiate an automated investigation, or go to the device page to investigate from the device's point of view.
|
||||
|
||||
|
||||
|
||||
|
||||
- **For users**, the details pane will display detailed user information, such as the user's SAM name and SID, as well as logon types performed by this user and any alerts and incidents related to it. You can select *Open user page* to continue the investigation from that user's point of view.
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -44,7 +44,7 @@ Advanced hunting is a query-based threat-hunting tool that lets you explore up t
|
||||
|
||||
- [DeviceTvmSoftwareVulnerabilitiesKB](advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md) - Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available
|
||||
|
||||
- [DeviceTvmSecureConfigurationAssessment](advanced-hunting-devicetvmsecureconfigurationassessment-table.md) - Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices
|
||||
- [DeviceTvmSecureConfigurationAssessment](advanced-hunting-devicetvmsecureconfigurationassessment-table.md) - Threat and vulnerability management assessment events, indicating the status of various security configurations on devices
|
||||
|
||||
- [DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md) - Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks
|
||||
|
||||
|
||||
@ -105,7 +105,7 @@ From the flyout, you can choose any of the following options:
|
||||
- [**Exception options**](tvm-exception.md) - Submit an exception, provide justification, and set exception duration if you can't remediate the issue yet.
|
||||
|
||||
>[!NOTE]
|
||||
>When a software change is made on a device, it typically takes 2 hours for the data to be reflected in the security portal. Configuration changes can take 12 hours. However, it may sometimes take longer.
|
||||
>When a software change is made on a device, it typically takes 2 hours for the data to be reflected in the security portal. However, it may sometimes take longer. Configuration changes can take anywhere from 4 to 24 hours.
|
||||
|
||||
### Investigate changes in device exposure or impact
|
||||
|
||||
|
||||
@ -658,7 +658,7 @@ See the following example:
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## See Also
|
||||
|
||||
|
||||
Reference in New Issue
Block a user