From b38d3bbf8f92c610a8711eb5d7ad229bc3102a36 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 21 Jan 2020 14:48:37 -0800 Subject: [PATCH] add note --- .../microsoft-defender-atp/manage-indicators.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md index ed62718fa4..e2674754d6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-indicators.md @@ -123,6 +123,11 @@ It's important to understand the following prerequisites prior to creating indic >[!IMPORTANT] > Only external IPs can be added to the indicator list. Indicators cannot be created for internal IPs. +> For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge leverages Network Protection (link) to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS):
+> NOTE: +>- IP is supported for all three protocols +>- Encrypted URLs can only be blocked on first party browsers +>- Full URL path blocks can be applied on the domain level and all unencrypted URLs >[!NOTE] >There may be up to 2 hours latency (usually less) between the time the action is taken, and the URL and IP being blocked.