diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index ed62718fa4..e2674754d6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -123,6 +123,11 @@ It's important to understand the following prerequisites prior to creating indic >[!IMPORTANT] > Only external IPs can be added to the indicator list. Indicators cannot be created for internal IPs. +> For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge leverages Network Protection (link) to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS):
+> NOTE: +>- IP is supported for all three protocols +>- Encrypted URLs can only be blocked on first party browsers +>- Full URL path blocks can be applied on the domain level and all unencrypted URLs >[!NOTE] >There may be up to 2 hours latency (usually less) between the time the action is taken, and the URL and IP being blocked.