mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-15 14:57:23 +00:00
update prerelease
This commit is contained in:
Joey Caparas
parent
2bfae6c154
commit
2d308c2873
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Windows Defender ATP with.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
The **Alerts queue** shows a list of alerts that were flagged from endpoints in your network. Alerts are displayed in queues according to their current status. In each queue, you'll see details such as the severity of alerts and the number of machines the alerts were raised on.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Understand what data fields are exposed as part of the alerts API and how they map to the Windows Defender ATP portal.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 09/01/2017
|
||||
- Office 365
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender ATP users and access permissions are managed in Azure Active Directory (AAD). Use the following methods to assign security roles.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
The sensor health tile provides information on the individual endpoint’s ability to provide sensor data and communicate with the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Windows Defender ATP alerts.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can configure Windows Defender ATP to send email notifications to specified recipients for new alerts. This feature enables you to identify a group of individuals who will immediately be informed and can act on alerts based on their severity.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.date: 09/01/2017
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
> [!NOTE]
|
||||
> To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can use mobile device management (MDM) solutions to configure endpoints. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage endpoints.
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 09/01/2017
|
||||
- Linux
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender Security Center provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Windows Defender Security Center and better protect your organization's network. This experience leverages on a third-party security products’ sensor data.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 09/01/2017
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- System Center 2012 Configuration Manager or later versions
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
<span id="sccm1606"/>
|
||||
## Configure endpoints using System Center Configuration Manager (current branch) version 1606
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network.
|
||||
|
||||
|
||||
@ -18,7 +18,7 @@ ms.date: 09/01/2017
|
||||
**Applies to:**
|
||||
- Virtual desktop infrastructure (VDI) machines
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Endpoints in your organization must be configured so that the Windows Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Windows Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 09/01/2017
|
||||
- Windows Server 2016
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Pull alerts using supported security information and events management (SIEM) tools
|
||||
Windows Defender ATP supports (SIEM) tools to pull alerts. Windows Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
You'll need to configure Splunk so that it can pull Windows Defender ATP alerts.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can define custom alert definitions and indicators of compromise (IOC) using the threat intelligence API. Creating custom threat intelligence alerts allows you to generate specific alerts that are applicable to your organization.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
The **Security operations dashboard** displays a snapshot of:
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
This section covers some of the most frequently asked questions regarding privacy and data handling for Windows Defender ATP.
|
||||
> [!NOTE]
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 09/01/2017
|
||||
- Windows Defender
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Windows Defender Advanced Threat Protection agent depends on Windows Defender Antivirus for some capabilities such as file scanning.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Before you can create custom threat intelligence (TI) using REST API, you'll need to set up the custom threat intelligence application through the Windows Defender ATP portal.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Enable security information and event management (SIEM) integration so you can pull alerts from the Windows Defender ATP portal using your SIEM solution or by connecting directly to the alerts REST API.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/library/aa745633(v=bts.10).aspx) on individual endpoints.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
With the Windows Defender ATP threat intelligence API, you can create custom threat intelligence alerts that can help you keep track of possible attack activities in your organization.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Machines that are categorized as misconfigured or inactive can be flagged due to varying causes. This section provides some explanations as to what might have caused a machine to be categorized as inactive or misconfigured.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
During the onboarding process, a wizard takes you through the general settings of Windows Defender ATP. After onboarding, you might want to update some settings which you'll be able to do through the **Preferences setup** menu.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 09/01/2017
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Investigate alerts that are affecting your network, what they mean, and how to resolve them. Use the alert details view to see various tiles that provide information about alerts. You can also manage an alert and see alert metadata along with other information that can help you make better decisions on how to approach them.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Examine possible communication between your machines and external internet protocol (IP) addresses.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 09/01/2017
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Investigate machines
|
||||
Investigate the details of an alert raised on a specific machine to identify other behaviors or events that might be related to the alert or the potential scope of breach.
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Investigate user account entities
|
||||
Identify user accounts with the most active alerts (displayed on dashboard as "Users at risk") and investigate cases of potential compromised credentials, or pivot on the associated user account when investigating an alert or machine to identify possible lateral movement between machines with that user account.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
The **Machines list** shows a list of the machines in your network, the domain of each machine, when it last reported and the local IP Address it reported on, its **Health state**, the number of active alerts on each machine categorized by alert severity level, and the number of active malware detections. This view allows viewing machines ranked by risk or sensor health state, and keeping track of all machines that are reporting sensor data in your network.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender ATP notifies you of possible malicious events, attributes, and contextual information through alerts. A summary of new alerts is displayed in the **Security operations dashboard**, and you can access all alerts in the **Alerts queue** menu.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
There are some minimum requirements for onboarding your network and endpoints.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
You need to onboard to Windows Defender ATP before you can use the service.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Antivirus optimization tile provides a list of recommendations to affected machines. Taking action on the recommendations will help improve your overall organizational security:
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Enterprise security teams can use the Windows Defender ATP portal to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches.
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Understand the security status of your organization, including the status of machines, alerts, and investigations using the Windows Defender ATP reporting feature that integrates with Power BI.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
This article provides PowerShell code examples for using the custom threat intelligence API.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Use the **Preferences setup** menu to modify general settings, advanced features, enable the preview experience, email notifications, and the custom threat intelligence feature.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Turn on the preview experience setting to be among the first to try upcoming features.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Windows Defender ATP service is constantly being updated to include new feature enhancements and capabilities.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender ATP supports the OAuth 2.0 protocol to pull alerts from the portal.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Before you begin
|
||||
You must [install](http://docs.python-requests.org/en/master/user/install/#install) the "[requests](http://docs.python-requests.org/en/master/)" python library.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Quickly respond to detected attacks by stopping and quarantining files or blocking a file. After taking action on files, you can check activity details on the Action center.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Quickly respond to detected attacks by isolating machines or collecting an investigation package. After taking action on machines, you can check activity details on the Action center.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
|
||||
You can take response actions on machines and files to quickly respond to detected attacks so that you can contain or reduce and prevent further damage caused by malicious attackers in your organization.
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Security Analytics dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
The **Service health** provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues. If there are issues, you'll see details related to the issue such as when the issue was detected, what the preliminary root cause is, and the expected resolution time.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Use the **Settings** menu  to configure the time zone, suppression rules, and view license information.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Advanced cybersecurity attacks comprise of multiple complex malicious events, attributes, and contextual information. Identifying and deciding which of these activities qualify as suspicious can be a challenging task. Your knowledge of known attributes and abnormal activities specific to your industry is fundamental in knowing when to call an observed behavior as suspicious.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
You might need to troubleshoot issues while using the custom threat intelligence feature.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
You might need to troubleshoot the Windows Defender ATP onboarding process if you encounter issues.
|
||||
This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the endpoints.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
|
||||
You might need to troubleshoot issues while pulling alerts in your SIEM tools.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
This section addresses issues that might arise as you use the Windows Defender Advanced Threat service.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
Understand threat intelligence concepts, then enable the custom threat intelligence application so that you can proceed to create custom threat intelligence alerts that are specific to your organization.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
A typical security breach investigation requires a member of a security operations team to:
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[! include [Prerelease information](prerelease.md)]
|
||||
[! include[Prerelease information](prerelease.md)]
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=technet-wd-atp-abovefoldlink1)
|
||||
>
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user