From 37218250511453a86e6372a2cbbb9c865d24c33f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 9 Sep 2019 14:11:23 -0700 Subject: [PATCH] add - intenal ips cant be added to indicator list --- .../microsoft-defender-atp/manage-indicators.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index ca531ec4a1..f0cf3d6772 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -121,6 +121,10 @@ It's important to understand the following prerequisites prior to creating indic - The Antimalware client version must be 4.18.1906.x or later. - Supported on machines on Windows 10, version 1709 or later. - Ensure that **Custom network indicators** is enabled in **Microsoft Defender Security Center > Settings > Advanced features**. For more information, see [Advanced features](advanced-features.md). + + +>[!IMPORTANT] +> Only external IPs can be added to the indicator list. Indicators cannot be created for internal IPs. >[!NOTE] >There may be up to 2 hours latency (usually less) between the time the action is taken, and the URL and IP being blocked.