diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index a8772fc430..cc3c06085a 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -59,9 +59,6 @@ ####### [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) - - - #### [Auto investigation and remediation](windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md) #### [Secure score](windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md) ##### [Threat analytics dashboard](windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) @@ -69,9 +66,7 @@ ##### [Query data using Advanced hunting](windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md) ###### [Advanced hunting reference](windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md) ###### [Advanced hunting query language best practices](windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) - - - +##### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md) #### [Management and APIs](windows-defender-atp/management-apis.md) @@ -128,8 +123,6 @@ ####### [Run antivirus scan API](windows-defender-atp/run-av-scan-windows-defender-advanced-threat-protection.md) ####### [Stop and quarantine file API](windows-defender-atp/stop-quarantine-file-windows-defender-advanced-threat-protection.md) - - ######User ####### [Get alert related user information](windows-defender-atp/get-alert-related-user-info-windows-defender-advanced-threat-protection.md) ####### [Get user information](windows-defender-atp/get-user-information-windows-defender-advanced-threat-protection.md) @@ -137,9 +130,6 @@ ####### [Get user related machines](windows-defender-atp/get-user-related-machines-windows-defender-advanced-threat-protection.md) -##### [Understand threat intelligence concepts](windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md) - - #### [Microsoft threat protection](windows-defender-atp/threat-protection-integration.md) @@ -168,25 +158,6 @@ ### [Configure and manage capabilities](windows-defender-atp/onboard.md) -#### [Onboard machines](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md) -##### [Onboard previous versions of Windows](windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md) -##### [Onboard Windows 10 machines](windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md) -###### [Onboard machines using Group Policy](windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md) -###### [Onboard machines using System Center Configuration Manager](windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -###### [Onboard machines using Mobile Device Management tools](windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -####### [Onboard machines using Microsoft Intune](windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) -###### [Onboard machines using a local script](windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md) -###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) -##### [Onboard servers](windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md) -##### [Onboard non-Windows machines](windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) -##### [Run a detection test on a newly onboarded machine](windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md) -##### [Run simulated attacks on machines](windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md) -##### [Configure proxy and Internet connectivity settings](windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md) -##### [Troubleshoot onboarding issues](windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) -###### [Troubleshoot subscription and portal access issues](windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) - - - #### [Configure attack surface reduction](windows-defender-atp/configure-attack-surface-reduction.md) ##### [Hardware-based isolation](windows-defender-application-guard/install-wd-app-guard.md) ###### [Group Policy settings](windows-defender-application-guard/configure-wd-app-guard.md) @@ -269,29 +240,64 @@ - - - #### [Manage auto investigation and remediation](windows-defender-atp/manage-auto-investigation-windows-defender-advanced-threat-protection.md) #### [Configure Secure score dashboard security controls](windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md) - +#### [Configure Windows Defender Security Center settings](windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md) +##### General +###### [Update data retention settings](windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md) +###### [Configure alert notifications](windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md) +###### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) +###### [Enable Secure score security controls](windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md) +###### [Configure advanced features](windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md) + +##### Permissions +###### [Use basic permissions to access the portal](windows-defender-atp/basic-permissions-windows-defender-advanced-threat-protection.md) +###### [Manage portal access using RBAC](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md) +####### [Create and manage roles](windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md) +####### [Create and manage machine groups](windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md) +######## [Create and manage machine tags](windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md) + +##### APIs +###### [Enable Threat intel](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) +###### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) + +#####Rules +###### [Manage suppression rules](windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md) +###### [Manage automation allowed/blocked](windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) +###### [Manage automation file uploads](windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) +###### [Manage automation folder exclusions](windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) + +#####Machine management +###### [Onboarding machines](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md) +###### [Offboarding machines](windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md) + +##### [Configure Windows Defender Security Center time zone settings](windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md) + #### Management and API support -##### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) -###### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) -###### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md) -###### [Configure HP ArcSight to pull alerts](windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md) -###### [Windows Defender ATP alert API fields](windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md) -###### [Pull alerts using REST API](windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) -###### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md) - - +##### [Onboard machines](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md) +###### [Onboard previous versions of Windows](windows-defender-atp/onboard-downlevel-windows-defender-advanced-threat-protection.md) +###### [Onboard Windows 10 machines](windows-defender-atp/configure-endpoints-windows-defender-advanced-threat-protection.md) +####### [Onboard machines using Group Policy](windows-defender-atp/configure-endpoints-gp-windows-defender-advanced-threat-protection.md) +####### [Onboard machines using System Center Configuration Manager](windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) +####### [Onboard machines using Mobile Device Management tools](windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) +######## [Onboard machines using Microsoft Intune](windows-defender-atp/configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) +####### [Onboard machines using a local script](windows-defender-atp/configure-endpoints-script-windows-defender-advanced-threat-protection.md) +####### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp/configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) +###### [Onboard servers](windows-defender-atp/configure-server-endpoints-windows-defender-advanced-threat-protection.md) +###### [Onboard non-Windows machines](windows-defender-atp/configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) +###### [Run a detection test on a newly onboarded machine](windows-defender-atp/run-detection-test-windows-defender-advanced-threat-protection.md) +###### [Run simulated attacks on machines](windows-defender-atp/attack-simulations-windows-defender-advanced-threat-protection.md) +###### [Configure proxy and Internet connectivity settings](windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection.md) +###### [Troubleshoot onboarding issues](windows-defender-atp/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) +####### [Troubleshoot subscription and portal access issues](windows-defender-atp/troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) + ##### API for custom alerts ###### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) ###### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md) @@ -302,41 +308,26 @@ ####### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md) ####### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) + +##### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) +###### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) +###### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md) +###### [Configure HP ArcSight to pull alerts](windows-defender-atp/configure-arcsight-windows-defender-advanced-threat-protection.md) +###### [Windows Defender ATP alert API fields](windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md) +###### [Pull alerts using REST API](windows-defender-atp/pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) +###### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md) + + ##### Reporting ###### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) -#### [Configure Windows Defender Security Center settings](windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md) - -##### General -###### [Update data retention settings](windows-defender-atp/data-retention-settings-windows-defender-advanced-threat-protection.md) -###### [Configure alert notifications](windows-defender-atp/configure-email-notifications-windows-defender-advanced-threat-protection.md) -###### [Enable and create Power BI reports using Windows Defender Security center data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) -###### [Enable Secure score security controls](windows-defender-atp/enable-secure-score-windows-defender-advanced-threat-protection.md) -###### [Configure advanced features](windows-defender-atp/advanced-features-windows-defender-advanced-threat-protection.md) - -##### Permissions +##### Role-based access control ###### [Use basic permissions to access the portal](windows-defender-atp/basic-permissions-windows-defender-advanced-threat-protection.md) ###### [Manage portal access using RBAC](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md) ####### [Create and manage roles](windows-defender-atp/user-roles-windows-defender-advanced-threat-protection.md) ####### [Create and manage machine groups](windows-defender-atp/machine-groups-windows-defender-advanced-threat-protection.md) ######## [Create and manage machine tags](windows-defender-atp/machine-tags-windows-defender-advanced-threat-protection.md) -##### APIs -###### [Enable Threat intel](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) - -#####Rules -###### [Manage suppression rules](windows-defender-atp/manage-suppression-rules-windows-defender-advanced-threat-protection.md) -###### [Manage automation allowed/blocked](windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -###### [Manage automation file uploads](windows-defender-atp/manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) -###### [Manage automation folder exclusions](windows-defender-atp/manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) - -#####Machine management -###### [Onboarding machines](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md) -###### [Offboarding machines](windows-defender-atp/offboard-machines-windows-defender-advanced-threat-protection.md) - -##### [Configure Windows Defender Security Center time zone settings](windows-defender-atp/time-settings-windows-defender-advanced-threat-protection.md) - ### [Troubleshoot Windows Defender ATP](windows-defender-atp/troubleshoot-wdatp.md) diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 4a3cf7e8aa..a602087508 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -101,12 +101,9 @@ Create custom threat intelligence and use a powerful search and query tool to hu **Management and APIs**
Integrate Windows Defender Advanced Threat Protection into your existing workflows. - [Onboarding](windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md) -- [Configuration](windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md) -- [Operating system baseline compliance](windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md) - [API and SIEM integration](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) -- [SIEM connectors](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) - [Exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md) -- [RBAC](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md) +- [Role-based access control (RBAC)](windows-defender-atp/rbac-windows-defender-advanced-threat-protection.md) - [Reporting and trends](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md) diff --git a/windows/security/threat-protection/windows-defender-atp/TOC.md b/windows/security/threat-protection/windows-defender-atp/TOC.md index ce6c1a7223..8e00c71335 100644 --- a/windows/security/threat-protection/windows-defender-atp/TOC.md +++ b/windows/security/threat-protection/windows-defender-atp/TOC.md @@ -1,6 +1,5 @@ # [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md) - ## [Overview](overview.md) ### [Attack surface reduction](overview-attack-surface-reduction.md) #### [Hardware-based isolation](overview-hardware-based-isolation.md) @@ -24,8 +23,10 @@ ##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) ##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) ##### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md) + #### Machines list ##### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md) +##### [Manage machine group and tags](investigate-machines-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags) ##### [Alerts related to this machine](investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine) ##### [Machine timeline](investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline) ###### [Search for specific events](investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events) @@ -33,6 +34,7 @@ ###### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) ###### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) + #### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md) ##### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md) ###### [Collect investigation package](respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines) @@ -42,7 +44,7 @@ ###### [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network) ###### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation) ###### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center) - + ##### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md) ###### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network) ###### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine) @@ -53,27 +55,23 @@ ###### [Submit files for analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis) ###### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports) ###### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis) - - - - + ### [Auto investigation and remediation](automated-investigations-windows-defender-advanced-threat-protection.md) ### [Secure score](overview-secure-score-windows-defender-advanced-threat-protection.md) -#### [Threat analytics](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) +#### [Threat analytics dashboard](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) ### [Advanced hunting](overview-hunting-windows-defender-advanced-threat-protection.md) #### [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md) ##### [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md) ##### [Advanced hunting query language best practices](advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) +#### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) ### [Management and APIs](management-apis.md) -#### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) #### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md) #####Actor ###### [Get actor information](get-actor-information-windows-defender-advanced-threat-protection.md) ###### [Get actor related alerts](get-actor-related-alerts-windows-defender-advanced-threat-protection.md) - #####Alerts ###### [Get alerts](get-alerts-windows-defender-advanced-threat-protection.md) ###### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection.md) @@ -129,17 +127,16 @@ ###### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection.md) ###### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection.md) - - + ### [Microsoft threat protection](threat-protection-integration.md) #### [Protect users, data, and devices with conditional access](conditional-access-windows-defender-advanced-threat-protection.md) -#### [Microsoft Cloud App Security integration](microsoft-cloud-app-security-integration.md) ### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) +### [Access the Windows Defender Security Center Community Center](community-windows-defender-advanced-threat-protection.md) + ## [Get started](get-started.md) ### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) ### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) - ### [Preview features](preview-windows-defender-advanced-threat-protection.md) ### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) ### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) @@ -151,31 +148,28 @@ ##### [Exploit protection](../windows-defender-exploit-guard/evaluate-exploit-protection.md) ##### [Network Protection](../windows-defender-exploit-guard/evaluate-network-protection.md) ##### [Controlled folder access](../windows-defender-exploit-guard/evaluate-controlled-folder-access.md) -##### [Attack surface reduction controls](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) +##### [Attack surface reduction](../windows-defender-exploit-guard/evaluate-attack-surface-reduction.md) ##### [Network firewall](../windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) -#### [Evaluate next gen protection](../windows-defender-antivirus/evaluate-windows-defender-antivirus.md) - - -### [Access the Windows Defender Security Center Community Center](community-windows-defender-advanced-threat-protection.md) - - +#### [Evaluate next generation protection](../windows-defender-antivirus/evaluate-windows-defender-antivirus.md) ## [Configure and manage capabilities](onboard.md) ### [Configure attack surface reduction](configure-attack-surface-reduction.md) #### [Hardware-based isolation](../windows-defender-application-guard/install-wd-app-guard.md) ##### [Group Policy settings](../windows-defender-application-guard/configure-wd-app-guard.md) +#### [Application control](../windows-defender-application-control/windows-defender-application-control.md) #### [Exploit protection](../windows-defender-exploit-guard/enable-exploit-protection.md) ##### [Customize exploit protection](../windows-defender-exploit-guard/customize-exploit-protection.md) ##### [Import/export configurations](../windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) #### [Network protection](../windows-defender-exploit-guard/enable-network-protection.md) #### [Controlled folder access](../windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md) ##### [Customize controlled folder access](../windows-defender-exploit-guard/customize-controlled-folders-exploit-guard.md) -#### [Attack surface reduction](../windows-defender-exploit-guard/enable-attack-surface-reduction.md) +#### [Attack surface reduction controls](../windows-defender-exploit-guard/enable-attack-surface-reduction.md) ##### [Customize attack surface reduction](../windows-defender-exploit-guard/customize-attack-surface-reduction.md) #### [Network firewall](../windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md) + ### [Configure next generation protection](../windows-defender-antivirus/configure-windows-defender-antivirus-features.md) #### [Utilize Microsoft cloud-delivered protection](../windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) ##### [Enable cloud-delivered protection](../windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) @@ -190,12 +184,11 @@ #### [Antivirus compatibility](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md) ##### [Use limited periodic antivirus scanning](../windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md) - -#### [Deploy, manage updates, and report on Windows Defender Antivirus](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md) -##### [Deploy and enable Windows Defender Antivirus](../windows-defender-antivirus/deploy-windows-defender-antivirus.md) +#### [Deploy, manage updates, and report on antivirus](../windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md) +##### [Deploy and enable antivirus](../windows-defender-antivirus/deploy-windows-defender-antivirus.md) ###### [Deployment guide for VDI environments](../windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md) -##### [Report on Windows Defender Antivirus protection](../windows-defender-antivirus/report-monitor-windows-defender-antivirus.md) -###### [Troubleshoot Windows Defender Antivirus reporting in Update Compliance](../windows-defender-antivirus/troubleshoot-reporting.md) +##### [Report on antivirus protection](../windows-defender-antivirus/report-monitor-windows-defender-antivirus.md) +###### [Troubleshoot antivirus reporting in Update Compliance](../windows-defender-antivirus/troubleshoot-reporting.md) ##### [Manage updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md) ###### [Manage protection and definition updates](../windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md) ###### [Manage when protection updates should be downloaded and applied](../windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md) @@ -203,25 +196,24 @@ ###### [Manage event-based forced updates](../windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md) ###### [Manage updates for mobile devices and VMs](../windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md) - #### [Customize, initiate, and review the results of scans and remediation](../windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) -##### [Configure and validate exclusions in Windows Defender AV scans](../windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) +##### [Configure and validate exclusions in antivirus scans](../windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) ###### [Configure and validate exclusions based on file name, extension, and folder location](../windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) ###### [Configure and validate exclusions for files opened by processes](../windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) -###### [Configure exclusions in Windows Defender AV on Windows Server 2016](../windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) -##### [Configure scanning options in Windows Defender AV](../windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) +###### [Configure antivirus exclusions Windows Server 2016](../windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) +##### [Configure scanning antivirus options](../windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) ##### [Configure remediation for scans](../windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) ##### [Configure scheduled scans](../windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) ##### [Configure and run scans](../windows-defender-antivirus/run-scan-windows-defender-antivirus.md) ##### [Review scan results](../windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) -##### [Run and review the results of a Windows Defender Offline scan](../windows-defender-antivirus/windows-defender-offline.md) -#### [Restore quarantined files in Windows Defender AV](../windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) -#### [Manage Windows Defender AV in your business](../windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -##### [Use Group Policy settings to configure and manage Windows Defender AV](../windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage Windows Defender AV](../windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -##### [Use PowerShell cmdlets to configure and manage Windows Defender AV](../windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -##### [Use Windows Management Instrumentation (WMI) to configure and manage Windows Defender AV](../windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -##### [Use the mpcmdrun.exe commandline tool to configure and manage Windows Defender AV](../windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) +##### [Run and review the results of an offline scan](../windows-defender-antivirus/windows-defender-offline.md) +#### [Restore quarantined files](../windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) +#### [Manage antivirus in your business](../windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) +##### [Use Group Policy settings to configure and manage antivirus](../windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) +##### [Use System Center Configuration Manager and Microsoft Intune to configure and manage antivirus](../windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) +##### [Use PowerShell cmdlets to configure and manage antivirus](../windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) +##### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](../windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) +##### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](../windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) #### [Manage scans and remediation](../windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) ##### [Configure and validate exclusions in antivirus scans](../windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) @@ -241,56 +233,72 @@ ##### [Use PowerShell cmdlets to manage next generation protection](../windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) ##### [Use Windows Management Instrumentation (WMI) to manage next generation protection](../windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) ##### [Use the mpcmdrun.exe command line tool to manage next generation protection](../windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) + + ### [Manage auto investigation and remediation](manage-auto-investigation-windows-defender-advanced-threat-protection.md) -### [Configure the security controls in Secure score dashboard](secure-score-dashboard-windows-defender-advanced-threat-protection.md) - +### [Configure Secure score dashboard security controls](secure-score-dashboard-windows-defender-advanced-threat-protection.md) +### [Configure Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md) +#### General +##### [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md) +##### [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md) +##### [Enable and create Power BI reports using Windows Defender Security center data](powerbi-reports-windows-defender-advanced-threat-protection.md) +##### [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md) +##### [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md) + +#### Permissions +##### [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md) +##### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md) +###### [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) +###### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) +####### [Create and manage machine tags](machine-tags-windows-defender-advanced-threat-protection.md) + +#### APIs +##### [Enable Threat intel](enable-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) + +####Rules +##### [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md) +##### [Manage automation allowed/blocked](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) +##### [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) +##### [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) + +####Machine management +##### [Onboarding machines](onboard-configure-windows-defender-advanced-threat-protection.md) +##### [Offboarding machines](offboard-machines-windows-defender-advanced-threat-protection.md) + +#### [Configure Windows Defender Security Center time zone settings](time-settings-windows-defender-advanced-threat-protection.md) + ### Management and API support - -##### [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md) -###### [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md) -###### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) -####### [Onboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) -####### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) -####### [Onboard machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) -######## [Onboard machines using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) -####### [Onboard machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) -####### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) -###### [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md) -###### [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) -###### [Run a detection test on a newly onboarded machine](run-detection-test-windows-defender-advanced-threat-protection.md) -###### [Run simulated attacks on machines](attack-simulations-windows-defender-advanced-threat-protection.md) -###### [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) -###### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) -####### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) - -#### [Configure Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md) -#####General -###### [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md) -###### [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md) -###### [Enable and create Power BI reports using Windows Defender Security center data](powerbi-reports-windows-defender-advanced-threat-protection.md) -###### [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md) -###### [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md) -#####Permissions -###### [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md) -###### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md) -####### [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) -####### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) -####### [Create and manage machine tags](machine-tags-windows-defender-advanced-threat-protection.md) -#####APIs -###### [Enable Threat intel](enable-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) -#####Rules -###### [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md) -###### [Manage automation allowed/blocked](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md) -###### [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md) -###### [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md) -#####Machine management -###### [Onboarding machines](onboard-configure-windows-defender-advanced-threat-protection.md) -###### [Offboarding machines](offboard-machines-windows-defender-advanced-threat-protection.md) -##### [Configure Windows Defender Security Center time zone settings](time-settings-windows-defender-advanced-threat-protection.md) +#### [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md) +##### [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md) +##### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) +###### [Onboard machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) +####### [Onboard machines using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune) +###### [Onboard machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) +###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) +##### [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md) +##### [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) +##### [Run a detection test on a newly onboarded machine](run-detection-test-windows-defender-advanced-threat-protection.md) +##### [Run simulated attacks on machines](attack-simulations-windows-defender-advanced-threat-protection.md) +##### [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) +##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) +###### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md) + +#### API for custom alerts +##### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) +##### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) +###### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md) +###### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) +###### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) +###### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) +###### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) +###### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) + #### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md) ##### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md) @@ -300,51 +308,32 @@ ##### [Pull alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md) -#### API for custom alerts -##### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md) -##### [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md) -###### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md) -####### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md) -####### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md) -####### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md) -####### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md) -###### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md) - #### Reporting ##### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md) -### Manage Microsoft threat protection integration -#### [Configure Microsoft Cloud App Security integration](microsoft-cloud-app-security-config.md) +#### Role-based access control +##### [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md) +##### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md) +###### [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md) +###### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md) +####### [Create and manage machine tags](machine-tags-windows-defender-advanced-threat-protection.md) + ## [Troubleshoot Windows Defender ATP](troubleshoot-wdatp.md) - ###Troubleshoot sensor state #### [Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md) #### [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) #### [Inactive machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) #### [Misconfigured machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) #### [Review sensor events and errors on machines with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md) - -### [Troubleshoot service issues](troubleshoot-windows-defender-advanced-threat-protection.md) -#### [Check service health](service-status-windows-defender-advanced-threat-protection.md) +### [Troubleshoot Windows Defender ATP service issues](troubleshoot-windows-defender-advanced-threat-protection.md) +#### [Check service health](service-status-windows-defender-advanced-threat-protection.md) ###Troubleshoot attack surface reduction #### [Network protection](../windows-defender-exploit-guard/troubleshoot-np.md) #### [Attack surface reduction rules](../windows-defender-exploit-guard/troubleshoot-asr.md) ### [Troubleshoot next generation protection](../windows-defender-antivirus/troubleshoot-windows-defender-antivirus.md) - - - - - - - - - - - -