mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-20 12:53:38 +00:00
revised index file
This commit is contained in:
Justin Hall
@ -30,7 +30,7 @@ The distributed systems on which these technologies were built involved several
|
||||
* [Device Registration](#device-registration)
|
||||
|
||||
## Directories ##
|
||||
Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2. The
|
||||
Hybrid Windows Hello for Business needs two directories: on-premises Active Directory and a cloud Azure Active Directory. The minimum required domain functional and forest functional levels for Windows Hello for Business deployment is Windows Server 2008 R2.
|
||||
|
||||
A hybrid Windows Hello for Business deployment needs an Azure Active Directory subscription. The hybrid key trust deployment, does not need a premium Azure Active Directory subscription.
|
||||
|
||||
|
||||
@ -57,9 +57,7 @@
|
||||
####### [View deep analysis reports](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports)
|
||||
####### [Troubleshoot deep analysis](windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis)
|
||||
|
||||
##### [Query data using Advanced hunting](windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
###### [Advanced hunting reference](windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
|
||||
###### [Advanced hunting query language best practices](windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
|
||||
##### [Security operations dashboard](windows-defender-atp/security-operations-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
@ -67,6 +65,14 @@
|
||||
#### [Secure score](windows-defender-atp/overview-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
##### [Threat analytics dashboard](windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
#### [Advanced hunting](windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection.md)
|
||||
##### [Query data using Advanced hunting](windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
###### [Advanced hunting reference](windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
|
||||
###### [Advanced hunting query language best practices](windows-defender-atp/advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
#### [Management and APIs](windows-defender-atp/management-apis.md)
|
||||
##### [Supported Windows Defender ATP APIs](windows-defender-atp/supported-apis-windows-defender-advanced-threat-protection.md)
|
||||
######Actor
|
||||
@ -285,15 +291,15 @@
|
||||
###### [Troubleshoot SIEM tool integration issues](windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
#### API for custom alerts
|
||||
##### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md)
|
||||
###### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
###### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md)
|
||||
###### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md)
|
||||
###### [Python code examples](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md)
|
||||
###### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
###### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### API for custom alerts
|
||||
###### [Enable the custom threat intelligence application](windows-defender-atp/enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
###### [Use the Windows Defender ATP exposed APIs](windows-defender-atp/exposed-apis-windows-defender-advanced-threat-protection.md)
|
||||
####### [Use the threat intelligence API to create custom alerts](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
####### [Create custom threat intelligence alerts](windows-defender-atp/custom-ti-api-windows-defender-advanced-threat-protection.md)
|
||||
####### [PowerShell code examples](windows-defender-atp/powershell-example-code-windows-defender-advanced-threat-protection.md)
|
||||
####### [Python code examples](windows-defender-atp/python-example-code-windows-defender-advanced-threat-protection.md)
|
||||
####### [Experiment with custom threat intelligence alerts](windows-defender-atp/experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
####### [Troubleshoot custom threat intelligence issues](windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
##### Reporting
|
||||
###### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp/powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
BIN
windows/security/threat-protection/images/AH_icon.png
Normal file
BIN
windows/security/threat-protection/images/AH_icon.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 3.6 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 140 KiB After Width: | Height: | Size: 360 KiB |
@ -5,28 +5,28 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
ms.date: 02/05/2018
|
||||
author: dansimp
|
||||
ms.date: 08/16/2018
|
||||
---
|
||||
|
||||
# Threat Protection
|
||||
Windows Defender Advanced Threat Protection (ATP) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Windows Defender ATP protects endpoints from cyber threats; detects advanced attacks and data breaches, automates security incidents and improves security posture.
|
||||
|
||||
<table>
|
||||
<tr style="text-align:center;">
|
||||
<td><a href="#asr"><img src="images/ASR_icon.png"> <br> <b>Attack surface reduction</b></a></td>
|
||||
<td><a href="#ngp"><img src="images/ngp_icon.png"><br> <b>Next generation protection</b></a></td>
|
||||
<td><a href="#edr"><img src="images/edr_icon.png"><br> <b>Endpoint detection and response</b></a></td>
|
||||
<td><a href="#ai"><img src="images/AR_icon.png"><br> <b>Auto investigation and remediation</b></a></td>
|
||||
<td><a href="#ss"><img src="images/SS_icon.png"><br> <b>Secure score</b></a></td>
|
||||
<td><a href="#ah"><br> <b>Advanced hunting</b></a></td>
|
||||
<tr>
|
||||
<td><a href="#asr"><center><img src="images/ASR_icon.png"> <br><b>Attack surface reduction</b></center></a></td>
|
||||
<td><center><a href="#ngp"><img src="images/ngp_icon.png"><br> <b>Next generation protection</b></a></center></td>
|
||||
<td><center><a href="#edr"><img src="images/edr_icon.png"><br> <b>Endpoint detection and response</b></a></center></td>
|
||||
<td><center><a href="#ai"><img src="images/AR_icon.png"><br> <b>Auto investigation and remediation</b></a></center></td>
|
||||
<td><center><a href="#ss"><img src="images/SS_icon.png"><br><b>Secure score</b></a></center></td>
|
||||
<td><center><img src="images/AH_icon.png"><a href="#ah"><br><b>Advanced hunting</b></a></center></td>
|
||||
</tr>
|
||||
<tr style="text-align:center;">
|
||||
<tr>
|
||||
<td colspan="6">
|
||||
<a href="#apis"><b>Management and APIs</a></b></td>
|
||||
<a href="#apis"><center><b>Management and APIs</a></b></center></td>
|
||||
</tr>
|
||||
<tr style="text-align:center;">
|
||||
<td colspan="6"><a href="#mtp"><b>Microsoft threat protection</a></b></td>
|
||||
<tr>
|
||||
<td colspan="6"><a href="#mtp"><center><b>Microsoft threat protection</a></center></b></td>
|
||||
</tr>
|
||||
</table>
|
||||
<br>
|
||||
@ -90,6 +90,14 @@ Windows Defender ATP includes a secure score to help you dynamically assess the
|
||||
- [Secure score](/windows-defender-atp/secure-score-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
- [Threat analytics](/windows-defender-atp/threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
<a name="hunt"></a>
|
||||
|
||||
**Advanced hunting**<br>
|
||||
Create custom threat intelligence and use a powerful search and query tool to hunt for possible threats in your organization.
|
||||
|
||||
- [Custom TI](windows-defender-atp/use-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
- [Realtime and historical hunting](windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
<a name="apis"></a>
|
||||
|
||||
**Management and APIs**<br>
|
||||
|
||||
@ -50,7 +50,7 @@ To configure the Group Policy settings described in this topic:
|
||||
|
||||
Also see the [Manage when protection updates should be downloaded and applied](manage-protection-update-schedule-windows-defender-antivirus.md) and [Prevent or allow users to locally modify policy settings](configure-local-policy-overrides-windows-defender-antivirus.md) topics.
|
||||
|
||||
## Quick scan versus full scan
|
||||
## Quick scan versus full scan and custom scan
|
||||
|
||||
When you set up scheduled scans, you can set up whether the scan should be a full or quick scan.
|
||||
|
||||
@ -62,6 +62,8 @@ In most instances, this means a quick scan is adequate to find malware that wasn
|
||||
|
||||
A full scan can be useful on endpoints that have encountered a malware threat to identify if there are any inactive components that require a more thorough clean-up. In this instance, you may want to use a full scan when running an [on-demand scan](run-scan-windows-defender-antivirus.md).
|
||||
|
||||
A custom scan allows you to specify the files and folders to scan, such as a USB drive.
|
||||
|
||||
## Set up scheduled scans
|
||||
|
||||
Scheduled scans will run at the day and time you specify. You can use Group Policy, PowerShell, and WMI to configure scheduled scans.
|
||||
|
||||
@ -54,9 +54,7 @@
|
||||
###### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports)
|
||||
###### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis)
|
||||
|
||||
#### [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
##### [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
|
||||
##### [Advanced hunting query language best practices](advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
#### [Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -64,6 +62,11 @@
|
||||
### [Secure score](overview-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
#### [Threat analytics](threat-analytics-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
### [Advanced hunting](overview-hunting-windows-defender-advanced-threat-protection.md)
|
||||
#### [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
##### [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
|
||||
##### [Advanced hunting query language best practices](advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
### [Management and APIs](management-apis.md)
|
||||
#### [Supported Windows Defender ATP APIs](supported-apis-windows-defender-advanced-threat-protection.md)
|
||||
#####Actor
|
||||
@ -265,7 +268,7 @@
|
||||
|
||||
|
||||
|
||||
### [Manage automatic investigation and remediation](manage-auto-investigation-windows-defender-advanced-threat-protection.md)
|
||||
### [Manage auto investigation and remediation](manage-auto-investigation-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
### [Configure Secure score dashboard security controls](secure-score-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
@ -289,16 +292,10 @@
|
||||
####### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
###### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
#### Reporting
|
||||
##### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
### [Configure Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md)
|
||||
####General
|
||||
##### [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
@ -330,43 +327,7 @@
|
||||
##### [Offboarding machines](offboard-machines-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
#### [Configure Windows Defender Security Center time zone settings](time-settings-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
|
||||
|
||||
### [Configure Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md)
|
||||
####General
|
||||
##### [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable and create Power BI reports using Windows Defender Security center data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
####Permissions
|
||||
##### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
|
||||
##### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
####APIs
|
||||
##### [Enable Threat intel](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
####Rules
|
||||
##### [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation allowed/blocked](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
####Machine management
|
||||
##### [Onboarding machines](onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
##### [Offboarding machines](offboard-machines-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
#### [Configure Windows Defender Security Center time zone settings](time-settings-windows-defender-advanced-threat-protection.md)
|
||||
### [Configure Windows Defender Security Center time zone settings](time-settings-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
## [Troubleshoot Windows Defender ATP](troubleshoot-wdatp.md)
|
||||
@ -376,11 +337,12 @@
|
||||
#### [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
#### [Inactive machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines)
|
||||
#### [Misconfigured machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines)
|
||||
### [Review sensor events and errors on machines with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md)
|
||||
#### [Review sensor events and errors on machines with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
### [Troubleshoot Windows Defender ATP service issues](troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
### [Troubleshoot service issues](troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
#### [Check service health](service-status-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
###Troubleshoot attack surface reduction
|
||||
#### [Network protection](../windows-defender-exploit-guard/troubleshoot-np.md)
|
||||
#### [Attack surface reduction rules](../windows-defender-exploit-guard/troubleshoot-asr.md)
|
||||
|
||||
@ -10,7 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 06/13/2018
|
||||
ms.date: 08/15/2018
|
||||
---
|
||||
|
||||
# Query data using Advanced hunting in Windows Defender ATP
|
||||
@ -34,7 +34,8 @@ First, we define a time filter to review only records from the previous seven da
|
||||
|
||||
We then add a filter on the _FileName_ to contain only instances of _powershell.exe_.
|
||||
|
||||
Afterwards, we add a filter on the _ProcessCommandLine_
|
||||
Afterwards, we add a filter on the _ProcessCommandLine_.
|
||||
|
||||
Finally, we project only the columns we're interested in exploring and limit the results to 100 and click **Run query**.
|
||||
|
||||
You have the option of expanding the screen view so you can focus on your hunting query and related results.
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 48 KiB After Width: | Height: | Size: 53 KiB |
Reference in New Issue
Block a user