From 7b6ee81e5b803bda2fdda2bc61718fed2fe218ba Mon Sep 17 00:00:00 2001 From: VLG17 <41186174+VLG17@users.noreply.github.com> Date: Mon, 6 Jun 2022 16:31:46 +0300 Subject: [PATCH 1/3] add note https://github.com/MicrosoftDocs/windows-itpro-docs/issues/10344 --- .../create-wdac-deny-policy.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md index 3203610df6..3f07cd2b87 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md @@ -45,6 +45,9 @@ To create effective WDAC deny policies, it's crucial to understand how WDAC pars 5. If no rule exists for the file and it's not allowed based on ISG or MI, then the file is blocked implicitly. +> [!NOTE] +> If your WDAC policy does not have an explicit rule to allow or deny a binary to run, then WDAC will make a call to the cloud to determine whether the binary is familiar and safe. However, if your policy already authorizes or denies the binary, then WDAC will not make a call to the cloud. More details can be found [here](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph?source=docs#how-does-the-integration-between-wdac-and-the-intelligent-security-graph-work). + ## Interaction with Existing Policies ### Adding Allow Rules From b1e3f3ac2fe8be28b1477d09be7cac2c7472a9fc Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 6 Jun 2022 08:16:43 -0700 Subject: [PATCH 2/3] Update create-wdac-deny-policy.md --- .../create-wdac-deny-policy.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md index 3f07cd2b87..339843477d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md @@ -14,7 +14,6 @@ author: jgeurten ms.reviewer: jsuther1974 ms.author: dansimp manager: dansimp -ms.date: 03/22/2022 ms.technology: windows-sec --- From c6ab5439a2c480117b3bc0c41ac1da81d6b49106 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 6 Jun 2022 08:19:06 -0700 Subject: [PATCH 3/3] Update create-wdac-deny-policy.md --- .../create-wdac-deny-policy.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md index 339843477d..d7e1d5636c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-deny-policy.md @@ -45,7 +45,7 @@ To create effective WDAC deny policies, it's crucial to understand how WDAC pars 5. If no rule exists for the file and it's not allowed based on ISG or MI, then the file is blocked implicitly. > [!NOTE] -> If your WDAC policy does not have an explicit rule to allow or deny a binary to run, then WDAC will make a call to the cloud to determine whether the binary is familiar and safe. However, if your policy already authorizes or denies the binary, then WDAC will not make a call to the cloud. More details can be found [here](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph?source=docs#how-does-the-integration-between-wdac-and-the-intelligent-security-graph-work). +> If your WDAC policy does not have an explicit rule to allow or deny a binary to run, then WDAC will make a call to the cloud to determine whether the binary is familiar and safe. However, if your policy already authorizes or denies the binary, then WDAC will not make a call to the cloud. For more details, see [How does the integration between WDAC and the Intelligent Security Graph work?](use-windows-defender-application-control-with-intelligent-security-graph.md#how-does-the-integration-between-wdac-and-the-intelligent-security-graph-work). ## Interaction with Existing Policies