mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-25 23:33:35 +00:00
Merge branch 'master' into jreeds-offline
This commit is contained in:
Jeff Reeds (Aquent LLC)
@ -1345,7 +1345,7 @@ This security group has not changed since Windows Server 2008.
|
||||
|
||||
Members of the DnsUpdateProxy group are DNS clients. They are permitted to perform dynamic updates on behalf of other clients (such as DHCP servers). A DNS server can develop stale resource records when a DHCP server is configured to dynamically register host (A) and pointer (PTR) resource records on behalf of DHCP clients by using dynamic update. Adding clients to this security group mitigates this scenario.
|
||||
|
||||
However, to protect against unsecured records or to permit members of the DnsUpdateProxy group to register records in zones that allow only secured dynamic updates, you must create a dedicated user account and configure DHCP servers to perform DNS dynamic updates by using the credentials of this account (user name, password, and domain). Multiple DHCP servers can use the credentials of one dedicated user account.
|
||||
However, to protect against unsecured records or to permit members of the DnsUpdateProxy group to register records in zones that allow only secured dynamic updates, you must create a dedicated user account and configure DHCP servers to perform DNS dynamic updates by using the credentials of this account (user name, password, and domain). Multiple DHCP servers can use the credentials of one dedicated user account. This group exists only if the DNS server role is or was once installed on a domain controller in the domain.
|
||||
|
||||
For information, see [DNS Record Ownership and the DnsUpdateProxy Group](https://technet.microsoft.com/library/dd334715.aspx).
|
||||
|
||||
@ -1365,7 +1365,7 @@ This security group has not changed since Windows Server 2008.
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-21-<domain>-1103</p></td>
|
||||
<td><p>S-1-5-21-<domain>-<variable RID></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
@ -1406,7 +1406,7 @@ This security group has not changed since Windows Server 2008.
|
||||
|
||||
### <a href="" id="bkmk-dnsadmins"></a>DnsAdmins
|
||||
|
||||
Members of DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions.
|
||||
Members of DNSAdmins group have access to network DNS information. The default permissions are as follows: Allow: Read, Write, Create All Child objects, Delete Child objects, Special Permissions. This group exists only if the DNS server role is or was once installed on a domain controller in the domain.
|
||||
|
||||
For more information about security and DNS, see [DNSSEC in Windows Server 2012](https://technet.microsoft.com/library/dn593694(v=ws.11).aspx).
|
||||
|
||||
@ -1426,7 +1426,7 @@ This security group has not changed since Windows Server 2008.
|
||||
<tbody>
|
||||
<tr class="odd">
|
||||
<td><p>Well-Known SID/RID</p></td>
|
||||
<td><p>S-1-5-21-<domain>-1102</p></td>
|
||||
<td><p>S-1-5-21-<domain>-<variable RID></p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td><p>Type</p></td>
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Local Accounts (Windows 10)
|
||||
description: Local Accounts
|
||||
description: Learn how to secure and manage access to the resources on a standalone or member server for services or users.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -18,7 +18,7 @@ ms.reviewer:
|
||||
|
||||
# Additional mitigations
|
||||
|
||||
Windows Defender Credential Guard can provide mitigations against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Windows Defender Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, re-using previously stolen credentials prior to Windows Defender Device Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigations also must be deployed to make the domain environment more robust.
|
||||
Windows Defender Credential Guard can provide mitigation against attacks on derived credentials and prevent the use of stolen credentials elsewhere. However, PCs can still be vulnerable to certain attacks, even if the derived credentials are protected by Windows Defender Credential Guard. These attacks can include abusing privileges and use of derived credentials directly from a compromised device, re-using previously stolen credentials prior to Windows Defender Credential Guard, and abuse of management tools and weak application configurations. Because of this, additional mitigation also must be deployed to make the domain environment more robust.
|
||||
|
||||
## Restricting domain users to specific domain-joined devices
|
||||
|
||||
|
||||
@ -58,7 +58,7 @@ When Windows Defender Credential Guard is enabled on Windows 10, the Java GSS AP
|
||||
|
||||
The following issue affects Cisco AnyConnect Secure Mobility Client:
|
||||
|
||||
- [Blue screen on Windows 10 computers running Windows Defender Device Guard and Windows Defender Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692) \*
|
||||
- [Blue screen on Windows 10 computers running Hypervisor-Protected Code Integrity and Windows Defender Credential Guard with Cisco Anyconnect 4.3.04027](https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc66692) \*
|
||||
|
||||
*Registration required to access this article.
|
||||
|
||||
@ -91,16 +91,16 @@ See the following article on Citrix support for Secure Boot:
|
||||
Windows Defender Credential Guard is not supported by either these products, products versions, computer systems, or Windows 10 versions:
|
||||
|
||||
- For Windows Defender Credential Guard on Windows 10 with McAfee Encryption products, see:
|
||||
[Support for Windows Defender Device Guard and Windows Defender Credential Guard on Windows 10 with McAfee encryption products](https://kc.mcafee.com/corporate/index?page=content&id=KB86009)
|
||||
[Support for Hypervisor-Protected Code Integrity and Windows Defender Credential Guard on Windows 10 with McAfee encryption products](https://kc.mcafee.com/corporate/index?page=content&id=KB86009)
|
||||
|
||||
- For Windows Defender Credential Guard on Windows 10 with Check Point Endpoint Security Client, see:
|
||||
[Check Point Endpoint Security Client support for Microsoft Windows 10 Windows Defender Credential Guard and Windows Defender Device Guard features](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113912)
|
||||
[Check Point Endpoint Security Client support for Microsoft Windows 10 Windows Defender Credential Guard and Hypervisor-Protected Code Integrity features](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113912)
|
||||
|
||||
- For Windows Defender Credential Guard on Windows 10 with VMWare Workstation
|
||||
[Windows 10 host fails when running VMWare Workstation when Windows Defender Credential Guard is enabled](https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2146361)
|
||||
|
||||
- For Windows Defender Credential Guard on Windows 10 with specific versions of the Lenovo ThinkPad
|
||||
[ThinkPad support for Windows Defender Device Guard and Windows Defender Credential Guard in Microsoft Windows 10 – ThinkPad](https://support.lenovo.com/in/en/solutions/ht503039)
|
||||
[ThinkPad support for Hypervisor-Protected Code Integrity and Windows Defender Credential Guard in Microsoft Windows 10 – ThinkPad](https://support.lenovo.com/in/en/solutions/ht503039)
|
||||
|
||||
- For Windows Defender Credential Guard on Windows 10 with Symantec Endpoint Protection
|
||||
[Windows 10 with Windows Defender Credential Guard and Symantec Endpoint Protection 12.1](https://www.symantec.com/connect/forums/windows-10-device-guard-credentials-guard-and-sep-121)
|
||||
|
||||
@ -24,7 +24,7 @@ ms.reviewer:
|
||||
|
||||
|
||||
## Enable Windows Defender Credential Guard
|
||||
Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy), the [registry](#enable-windows-defender-credential-guard-by-using-the-registry), or the Windows Defender Device Guard and Windows Defender Credential Guard [hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine.
|
||||
Windows Defender Credential Guard can be enabled either by using [Group Policy](#enable-windows-defender-credential-guard-by-using-group-policy), the [registry](#enable-windows-defender-credential-guard-by-using-the-registry), or the Hypervisor-Protected Code Integrity (HVCI) and Windows Defender Credential Guard [hardware readiness tool](https://www.microsoft.com/download/details.aspx?id=53337). Windows Defender Credential Guard can also protect secrets in a Hyper-V virtual machine, just as it would on a physical machine.
|
||||
The same set of procedures used to enable Windows Defender Credential Guard on physical machines applies also to virtual machines.
|
||||
|
||||
|
||||
@ -36,10 +36,11 @@ You can use Group Policy to enable Windows Defender Credential Guard. This will
|
||||
2. Double-click **Turn On Virtualization Based Security**, and then click the **Enabled** option.
|
||||
3. In the **Select Platform Security Level** box, choose **Secure Boot** or **Secure Boot and DMA Protection**.
|
||||
4. In the **Credential Guard Configuration** box, click **Enabled with UEFI lock**, and then click **OK**. If you want to be able to turn off Windows Defender Credential Guard remotely, choose **Enabled without lock**.
|
||||
5. In the **Secure Launch Configuration** box, choose **Not Configured**, **Enabled** or **Disabled**. Check [this article](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection) for more details.
|
||||
|
||||
|
||||
|
||||
|
||||
5. Close the Group Policy Management Console.
|
||||
6. Close the Group Policy Management Console.
|
||||
|
||||
To enforce processing of the group policy, you can run ```gpupdate /force```.
|
||||
|
||||
@ -85,7 +86,8 @@ You can do this by using either the Control Panel or the Deployment Image Servic
|
||||
```
|
||||
dism /image:<WIM file name> /Enable-Feature /FeatureName:IsolatedUserMode
|
||||
```
|
||||
NOTE: In Windows 10, version 1607 and later, the Isolated User Mode feature has been integrated into the core operating system. Running the command in step 3 above is therefore no longer required.
|
||||
> [!NOTE]
|
||||
> In Windows 10, version 1607 and later, the Isolated User Mode feature has been integrated into the core operating system. Running the command in step 3 above is therefore no longer required.
|
||||
|
||||
> [!TIP]
|
||||
> You can also add these features to an online image by using either DISM or Configuration Manager.
|
||||
@ -111,15 +113,15 @@ You can do this by using either the Control Panel or the Deployment Image Servic
|
||||
|
||||
<span id="hardware-readiness-tool"/>
|
||||
|
||||
### Enable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool
|
||||
### Enable Windows Defender Credential Guard by using the HVCI and Windows Defender Credential Guard hardware readiness tool
|
||||
|
||||
You can also enable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
You can also enable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
|
||||
```
|
||||
DG_Readiness_Tool.ps1 -Enable -AutoReboot
|
||||
```
|
||||
> [!IMPORTANT]
|
||||
> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
> This is a known issue.
|
||||
|
||||
### Review Windows Defender Credential Guard performance
|
||||
@ -136,13 +138,13 @@ You can view System Information to check that Windows Defender Credential Guard
|
||||
|
||||
|
||||
|
||||
You can also check that Windows Defender Credential Guard is running by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
You can also check that Windows Defender Credential Guard is running by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
|
||||
```
|
||||
DG_Readiness_Tool_v3.6.ps1 -Ready
|
||||
```
|
||||
> [!IMPORTANT]
|
||||
> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
> This is a known issue.
|
||||
|
||||
> [!NOTE]
|
||||
@ -207,19 +209,20 @@ To disable Windows Defender Credential Guard, you can use the following set of p
|
||||
> [!NOTE]
|
||||
> Credential Guard and Device Guard are not currently supported when using Azure IaaS VMs. These options will be made available with future Gen 2 VMs.
|
||||
|
||||
For more info on virtualization-based security and Windows Defender Device Guard, see [Windows Defender Device Guard deployment guide](/windows/device-security/device-guard/device-guard-deployment-guide).
|
||||
For more info on virtualization-based security and HVCI, see [Enable virtualization-based protection of code integrity](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity
|
||||
).
|
||||
|
||||
<span id="turn-off-with-hardware-readiness-tool"/>
|
||||
|
||||
#### Disable Windows Defender Credential Guard by using the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool
|
||||
#### Disable Windows Defender Credential Guard by using the HVCI and Windows Defender Credential Guard hardware readiness tool
|
||||
|
||||
You can also disable Windows Defender Credential Guard by using the [Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
You can also disable Windows Defender Credential Guard by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md).
|
||||
|
||||
```
|
||||
DG_Readiness_Tool_v3.6.ps1 -Disable -AutoReboot
|
||||
```
|
||||
> [!IMPORTANT]
|
||||
> When running the Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
> When running the HVCI and Windows Defender Credential Guard hardware readiness tool on a non-English operating system, within the script, change `*$OSArch = $(gwmi win32_operatingsystem).OSArchitecture` to be `$OSArch = $((gwmi win32_operatingsystem).OSArchitecture).tolower()` instead, in order for the tool to work.
|
||||
> This is a known issue.
|
||||
|
||||
#### Disable Windows Defender Credential Guard for a virtual machine
|
||||
@ -232,5 +235,3 @@ Set-VMSecurity -VMName <VMName> -VirtualizationBasedSecurityOptOut $true
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -87,7 +87,7 @@ The following tables describe baseline protections, plus protections for improve
|
||||
> [!NOTE]
|
||||
> Beginning with Windows 10, version 1607, Trusted Platform Module (TPM 2.0) must be enabled by default on new shipping computers.
|
||||
>
|
||||
> If you are an OEM, see [PC OEM requirements for Windows Defender Device Guard and Windows Defender Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
|
||||
> If you are an OEM, see [PC OEM requirements for Windows Defender Credential Guard](https://msdn.microsoft.com/library/windows/hardware/mt767514.aspx).
|
||||
|
||||
### Baseline protections
|
||||
|
||||
@ -98,7 +98,7 @@ The following tables describe baseline protections, plus protections for improve
|
||||
| Hardware: **Trusted Platform Module (TPM)** | **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.<br>[TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations) | A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. |
|
||||
| Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)| UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. |
|
||||
| Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).| UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise<br><blockquote><p><strong>Important:</strong><br> Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. Only Windows Defender Device Guard is supported in this configuration.</p></blockquote> |Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. |
|
||||
| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise<br><blockquote><p><strong>Important:</strong><br> Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard. </p></blockquote> |Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. |
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The following tables list additional qualifications for improved security. We strongly recommend meeting the additional qualifications to significantly strengthen the level of security that Windows Defender Credential Guard can provide.
|
||||
|
||||
@ -29,7 +29,7 @@ By enabling Windows Defender Credential Guard, the following features and soluti
|
||||
|
||||
- **Hardware security** NTLM, Kerberos, and Credential Manager take advantage of platform security features, including Secure Boot and virtualization, to protect credentials.
|
||||
- **Virtualization-based security** Windows NTLM and Kerberos derived credentials and other secrets run in a protected environment that is isolated from the running operating system.
|
||||
- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate Windows Defender Device Guard and other security strategies and architectures.
|
||||
- **Better protection against advanced persistent threats** When Credential Manager domain credentials, NTLM, and Kerberos derived credentials are protected using virtualization-based security, the credential theft attack techniques and tools used in many targeted attacks are blocked. Malware running in the operating system with administrative privileges cannot extract secrets that are protected by virtualization-based security. While Windows Defender Credential Guard is a powerful mitigation, persistent threat attacks will likely shift to new attack techniques and you should also incorporate other security strategies and architectures.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 432 KiB |
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Conditional Access
|
||||
description: Learn more about conditional access in Azure Active Directory.
|
||||
description: Ensure that only approved users can access your devices, applications, and services from anywhere by enabling single sign-on with Azure Active Directory.
|
||||
keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, conditional access
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -63,11 +63,11 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning
|
||||
|
||||
| Phase | Description |
|
||||
| :----: | :----------- |
|
||||
| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task.|
|
||||
| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task. Note: the Automatic Device Join tasks is triggered on domain join as well as retried every hour. It does not solely depend on the user sign-in.|
|
||||
|B | The task queries Active Directory using the LDAP protocol for the keywords attribute on service connection point stored in the configuration partition in Active Directory (CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=contoso,DC=com). The value returned in the keywords attribute determines if device registration is directed to Azure Device Registration Service (ADRS) or the enterprise device registration service hosted on-premises.|
|
||||
|C | For the managed environment, the task creates an initial authentication credential in the form of a self-signed certificate. The task write the certificate to the userCertificate attribute on the computer object in Active Directory using LDAP.
|
||||
|D |The computer cannot authenticate to Azure DRS until a device object representing the computer that includes the certificate on the userCertificate attribute is created in Azure Active Directory. Azure AD Connect detects an attribute change. On the next synchronization cycle, Azure AD Connect sends the userCertificate, object GUID, and computer SID to Azure DRS. Azure DRS uses the attribute information to create a device object in Azure Active Directory.|
|
||||
|E | The Automatic Device Join task triggers with each user sign-in and tries to authenticate the computer to Azure Active Directory using the corresponding private key of the public key in the userCertificate attribute. Azure Active Directory authenticates the computer and issues a ID token to the computer.|
|
||||
|E | The Automatic Device Join task triggers with each user sign-in or every hour, and tries to authenticate the computer to Azure Active Directory using the corresponding private key of the public key in the userCertificate attribute. Azure Active Directory authenticates the computer and issues a ID token to the computer.|
|
||||
|F | The task creates TPM bound (preferred) RSA 2048 bit key-pair known as the device key (dkpub/dkpriv). The application create a certificate request using dkpub and the public key and signs the certificate request with using dkpriv. Next, the application derives second key pair from the TPM's storage root key. This is the transport key (tkpub/tkpriv).|
|
||||
|G | The task sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then updates the device object in Azure Active Directory and sends the device ID and the device certificate to the client.|
|
||||
|H | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the task exits.|
|
||||
@ -78,7 +78,7 @@ Device Registration is a prerequisite to Windows Hello for Business provisioning
|
||||
|
||||
| Phase | Description |
|
||||
| :----: | :----------- |
|
||||
| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task.|
|
||||
| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task. Note: the Automatic Device Join tasks is triggered on domain join as well as retried every hour. It does not solely depend on the user sign-in. |
|
||||
|B | The task queries Active Directory using the LDAP protocol for the keywords attribute on service connection point stored in the configuration partition in Active Directory (CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=contoso,DC=com). The value returned in the keywords attribute determines if device registration is directed to Azure Device Registration Service (ADRS) or the enterprise device registration service hosted on-premises.|
|
||||
|C | For the federated environments, the computer authenticates the enterprise device registration endpoint using Windows integrated authentication. The enterprise device registration service creates and returns a token that includes claims for the object GUID, computer SID, and domain joined state. The task submits the token and claims to Azure Active Directory where it is validated. Azure Active Directory returns an ID token to the running task.
|
||||
|D | The application creates TPM bound (preferred) RSA 2048 bit key-pair known as the device key (dkpub/dkpriv). The application create a certificate request using dkpub and the public key and signs the certificate request with using dkpriv. Next, the application derives second key pair from the TPM's storage root key. This is the transport key (tkpub/tkpriv).|
|
||||
|
||||
@ -33,6 +33,7 @@ Before adding Azure Active Directory (Azure AD) joined devices to your existing
|
||||
- Certificate Revocation List (CRL) Distribution Point (CDP)
|
||||
- 2016 Domain Controllers
|
||||
- Domain Controller certificate
|
||||
- Network infrastructure in place to reach your on-premises domain controller. If the machines are external, this can be achieved using any VPN solution.
|
||||
|
||||
### Azure Active Directory Connect synchronization
|
||||
Azure AD join, as well as hybrid Azure AD join devices register the user's Windows Hello for Business credential with Azure. To enable on-premises authentication, the credential must be synchronized to the on-premises Active Directory, regardless whether you are using a key or a certificate. Ensure you have Azure AD Connect installed and functioning properly. To learn more about Azure AD Connect, read [Integrate your on-premises directories with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/connect/active-directory-aadconnect).
|
||||
|
||||
@ -21,14 +21,14 @@ ms.reviewer:
|
||||
**Applies to**
|
||||
- Windows 10, version 1703 or later
|
||||
- Hybrid deployment
|
||||
- Certificate trust
|
||||
- Key trust
|
||||
|
||||
|
||||
## Directory Synchronization
|
||||
|
||||
In hybrid deployments, users register the public portion of their Windows Hello for Business credential with Azure. Azure AD Connect synchronizes the Windows Hello for Business public key to Active Directory.
|
||||
|
||||
The key-trust model needs Windows Server 2016 domain controllers, which configures the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually.
|
||||
The key-trust model needs Windows Server 2016 domain controllers, which configure the key registration permissions automatically; however, the certificate-trust model does not and requires you to add the permissions manually.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you already have a Windows Server 2016 domain controller in your domain, you can skip **Configure Permissions for Key Synchronization**. In this case, you should use the pre-created group KeyAdmins in step 3 of the "Group Memberships for the Azure AD Connect Service Account" section of this article.
|
||||
@ -61,6 +61,9 @@ Sign-in a domain controller or management workstation with _Domain Admin_ equiva
|
||||
5. In the **Enter the object names to select** text box, type the name of the Azure AD Connect service account. Click **OK**.
|
||||
6. Click **OK** to return to **Active Directory Users and Computers**.
|
||||
|
||||
> [!NOTE]
|
||||
> If your AD forest has multiple domains. Please make sure you add the ADConnect sync service account (that is, MSOL_12121212) into "Enterprise Key Admins" group to gain permission across the domains in the forest.
|
||||
|
||||
### Section Review
|
||||
|
||||
> [!div class="checklist"]
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Hello for Business Key Trust New Installation
|
||||
description: Learn how to perform a hybrid key trust deployment of Windows Hello for Business, for systems with no previous installations.
|
||||
description: Learn how to configure a hybrid key trust deployment of Windows Hello for Business, for systems with no previous installations.
|
||||
keywords: identity, PIN, biometric, Hello, passport, WHFB
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -66,7 +66,7 @@ Key trust deployments do not need client issued certificates for on-premises aut
|
||||
The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below.
|
||||
|
||||
* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL.
|
||||
* Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name).
|
||||
* The certificate Subject section should contain the directory path of the server object (the distinguished name).
|
||||
* The certificate Key Usage section must contain Digital Signature and Key Encipherment.
|
||||
* Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None].
|
||||
* The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5).
|
||||
|
||||
@ -80,8 +80,8 @@ Sign-in a certificate authority or management workstations with _Enterprise Admi
|
||||
|
||||
The certificate template is configured to supersede all the certificate templates provided in the certificate templates superseded templates list. However, the certificate template and the superseding of certificate templates is not active until you publish the certificate template to one or more certificate authorities.
|
||||
|
||||
>[!NOTE]
|
||||
>The Domain Controller Certificate must be present in the NTAuth store. By default, Microsoft Enterprise CAs are added to the NTAuth store. If you are using a 3rd party CA, this may not be done by default. If the Domain Controller Certificate is not present in the NTAuth store, user authentication will fail.
|
||||
> [!NOTE]
|
||||
> The domain controller's certificate must chain to a root in the NTAuth store. By default, the Active Directory Certificate Authority's root certificate is added to the NTAuth store. If you are using a third-party CA, this may not be done by default. If the domain controller certificate does not chain to a root in the NTAuth store, user authentication will fail.
|
||||
|
||||
### Publish Certificate Templates to a Certificate Authority
|
||||
|
||||
|
||||
@ -143,13 +143,14 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C
|
||||
|
||||
|
||||
3. Under **Use the following restricted mode**:
|
||||
- If you want to require either [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) or Windows Defender Remote Credential Guard, choose **Prefer Windows Defender Remote Credential Guard**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used.
|
||||
- If you want to require either [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.remote-desktop-services-enable-restricted-admin-mode.aspx) or Windows Defender Remote Credential Guard, choose **Restrict Credential Delegation**. In this configuration, Windows Defender Remote Credential Guard is preferred, but it will use Restricted Admin mode (if supported) when Windows Defender Remote Credential Guard cannot be used.
|
||||
|
||||
> **Note:** Neither Windows Defender Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server.
|
||||
> [!NOTE]
|
||||
> Neither Windows Defender Remote Credential Guard nor Restricted Admin mode will send credentials in clear text to the Remote Desktop server.
|
||||
|
||||
- If you want to require Windows Defender Remote Credential Guard, choose **Require Windows Defender Remote Credential Guard**. With this setting, a Remote Desktop connection will succeed only if the remote computer meets the [requirements](#reqs) listed earlier in this topic.
|
||||
- If you want to require Windows Defender Remote Credential Guard, choose **Require Remote Credential Guard**. With this setting, a Remote Desktop connection will succeed only if the remote computer meets the [requirements](#reqs) listed earlier in this topic.
|
||||
|
||||
- If you want to require Restricted Admin mode, choose **Require Restricted Admin**. For information about Restricted Admin mode, see the table in [Comparing Windows Defender Remote Credential Guard with other Remote Desktop connection options](#comparing-remote-credential-guard-with-other-remote-desktop-connection-options), earlier in this topic.
|
||||
- If you want to require Restricted Admin mode, choose **Require Restricted Admin**. For information about Restricted Admin mode, see the table in [Comparing Windows Defender Remote Credential Guard with other Remote Desktop connection options](#comparing-remote-credential-guard-with-other-remote-desktop-connection-options), earlier in this topic.
|
||||
|
||||
4. Click **OK**.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: VPN connection types (Windows 10)
|
||||
description: tbd
|
||||
description: Learn about Windows VPN platform clients and the VPN connection-type features that can be configured.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
|
||||
@ -239,12 +239,12 @@ if ($VPNprofilefile -ne "" -and $FileExtension -eq ".ps1")
|
||||
|
||||
# Extract the Profile XML from the ps1 file #
|
||||
|
||||
$regex = '(?sm).*^*.<VPNPROFILE>\r?\n(.*?)\r?\n</VPNProfile>.*'
|
||||
$regex = '(?sm).*^*.<VPNProfile>\r?\n(.*?)\r?\n</VPNProfile>.*'
|
||||
|
||||
# Create xml format variable to compare with the optimize list #
|
||||
|
||||
$xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1'
|
||||
[xml]$VPNprofilexml="<VPNPROFILE>"+$xmlbody+"</VPNPROFILE>"
|
||||
[xml]$VPNprofilexml="<VPNProfile>"+$xmlbody+"</VPNProfile>"
|
||||
|
||||
# Loop through each address found in VPNPROFILE XML section #
|
||||
foreach ($Route in $VPNprofilexml.VPNProfile.Route)
|
||||
@ -349,7 +349,7 @@ if ($VPNprofilefile -ne "" -and $FileExtension -eq ".xml")
|
||||
$In_VPN_Only=$null # Variable to hold IP Addresses that only appear in the VPN profile XML file #
|
||||
|
||||
# Extract the Profile XML from the XML file #
|
||||
$regex = '(?sm).*^*.<VPNPROFILE>\r?\n(.*?)\r?\n</VPNProfile>.*'
|
||||
$regex = '(?sm).*^*.<VPNProfile>\r?\n(.*?)\r?\n</VPNProfile>.*'
|
||||
|
||||
# Create xml format variable to compare with optimize list #
|
||||
$xmlbody=(Get-Content -Raw $VPNprofilefile) -replace $regex, '$1'
|
||||
@ -367,7 +367,7 @@ if ($VPNprofilefile -ne "" -and $FileExtension -eq ".xml")
|
||||
|
||||
# In VPN list only #
|
||||
$In_VPN_only =$ARRVPN | Where {$optimizeIpsv4 -NotContains $_}
|
||||
[array]$Inpfile = get-content $VPNprofilefile
|
||||
[System.Collections.ArrayList]$Inpfile = get-content $VPNprofilefile
|
||||
|
||||
if ($In_Opt_Only.Count -gt 0 )
|
||||
{
|
||||
@ -377,10 +377,10 @@ if ($VPNprofilefile -ne "" -and $FileExtension -eq ".xml")
|
||||
{
|
||||
# Add the missing IP address(es) #
|
||||
$IPInfo=$NewIP.Split("/")
|
||||
$inspoint = $Inpfile[0].IndexOf("</VPNProfile")
|
||||
$routes += "<Route>"+"<Address>"+$IPInfo[0].Trim()+"</Address>"+"<PrefixSize>"+$IPInfo[1].Trim()+"</PrefixSize>"+"<ExclusionRoute>true</ExclusionRoute>"+"</Route>"
|
||||
$routes += "<Route>`n"+"`t<Address>"+$IPInfo[0].Trim()+"</Address>`n"+"`t<PrefixSize>"+$IPInfo[1].Trim()+"</PrefixSize>`n"+"`t<ExclusionRoute>true</ExclusionRoute>`n"+"</Route>`n"
|
||||
}
|
||||
$Inpfile = $Inpfile[0].Insert($inspoint,$routes)
|
||||
$inspoint = $Inpfile.IndexOf("</VPNProfile>")
|
||||
$Inpfile.Insert($inspoint,$routes)
|
||||
|
||||
# Update filename and write new XML file #
|
||||
$NewFileName=(Get-Item $VPNprofilefile).Basename + "-NEW.xml"
|
||||
|
||||
@ -123,7 +123,7 @@ The following table defines which Windows features require TPM support.
|
||||
TPM Platform Crypto Provider Key Storage Provider| Yes | Yes | Yes
|
||||
Virtual Smart Card | Yes | Yes | Yes
|
||||
Certificate storage | No | Yes | Yes | TPM is only required when the certificate is stored in the TPM.
|
||||
Autopilot | Yes | No | Yes | TPM 2.0 and UEFI firmware is required for white glove and self-deploying scenarios.
|
||||
Autopilot | No | N/A | Yes | If you intend to deploy a scenario which requires TPM (such as white glove and self-deploying mode), then TPM 2.0 and UEFI firmware are required.
|
||||
SecureBIO | Yes | No | Yes | TPM 2.0 and UEFI firmware is required.
|
||||
DRTM | Yes | No | Yes | TPM 2.0 and UEFI firmware is required.
|
||||
|
||||
|
||||
@ -71,7 +71,7 @@ Microsoft has made a concerted effort to enlighten several of our more popular a
|
||||
|
||||
- Microsoft Messaging
|
||||
|
||||
- Microsoft Remote Desktop
|
||||
- Microsoft Remote Desktop
|
||||
|
||||
> [!NOTE]
|
||||
> Microsoft Visio, Microsoft Office Access and Microsoft Project are not enlightended apps and need to be exempted from WIP policy. If they are allowed, there is a risk of data loss. For example, if a device is workplace-joined and managed and the user leaves the company, metadata files that the apps rely on remain encrypted and the apps stop functioining.
|
||||
@ -81,6 +81,8 @@ Microsoft still has apps that are unenlightened, but which have been tested and
|
||||
|
||||
- Skype for Business
|
||||
|
||||
- Microsoft Teams (build 1.3.00.12058 and later)
|
||||
|
||||
## Adding enlightened Microsoft apps to the allowed apps list
|
||||
|
||||
> [!NOTE]
|
||||
|
||||
@ -62,12 +62,9 @@
|
||||
|
||||
|
||||
#### [Device control]()
|
||||
##### [Code integrity](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
|
||||
##### [Control USB devices](device-control/control-usb-devices-using-intune.md)
|
||||
|
||||
##### [Device Guard]()
|
||||
###### [Code integrity](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md)
|
||||
|
||||
|
||||
|
||||
#### [Exploit protection]()
|
||||
##### [Protect devices from exploits](microsoft-defender-atp/exploit-protection.md)
|
||||
@ -200,7 +197,8 @@
|
||||
#### [Better together: Windows Defender Antivirus and Office 365](windows-defender-antivirus/office-365-windows-defender-antivirus.md)
|
||||
|
||||
|
||||
### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md)
|
||||
### [Microsoft Defender Advanced Threat Protection for Mac]()
|
||||
#### [Overview of Microsoft Defender ATP for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md)
|
||||
#### [What's New](microsoft-defender-atp/mac-whatsnew.md)
|
||||
|
||||
#### [Deploy]()
|
||||
@ -225,7 +223,8 @@
|
||||
#### [Resources](microsoft-defender-atp/mac-resources.md)
|
||||
|
||||
|
||||
### [Microsoft Defender Advanced Threat Protection for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md)
|
||||
### [Microsoft Defender Advanced Threat Protection for Linux]()
|
||||
#### [Overview of Microsoft Defender ATP for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md)
|
||||
#### [What's New](microsoft-defender-atp/linux-whatsnew.md)
|
||||
#### [Deploy]()
|
||||
##### [Manual deployment](microsoft-defender-atp/linux-install-manually.md)
|
||||
@ -239,6 +238,7 @@
|
||||
##### [Configure and validate exclusions](microsoft-defender-atp/linux-exclusions.md)
|
||||
##### [Static proxy configuration](microsoft-defender-atp/linux-static-proxy-configuration.md)
|
||||
##### [Set preferences](microsoft-defender-atp/linux-preferences.md)
|
||||
##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/linux-pua.md)
|
||||
|
||||
#### [Troubleshoot]()
|
||||
##### [Troubleshoot installation issues](microsoft-defender-atp/linux-support-install.md)
|
||||
@ -246,6 +246,7 @@
|
||||
##### [Troubleshoot performance issues](microsoft-defender-atp/linux-support-perf.md)
|
||||
|
||||
|
||||
#### [Privacy](microsoft-defender-atp/linux-privacy.md)
|
||||
#### [Resources](microsoft-defender-atp/linux-resources.md)
|
||||
|
||||
### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md)
|
||||
@ -328,8 +329,9 @@
|
||||
#### [Behavioral blocking and containment](microsoft-defender-atp/behavioral-blocking-containment.md)
|
||||
#### [EDR in block mode](microsoft-defender-atp/edr-in-block-mode.md)
|
||||
|
||||
### [Automated investigation and response]()
|
||||
### [Automated investigation and response (AIR)]()
|
||||
#### [Overview of AIR](microsoft-defender-atp/automated-investigations.md)
|
||||
#### [Configure AIR capabilities](microsoft-defender-atp/configure-automated-investigations-remediation.md)
|
||||
|
||||
### [Advanced hunting]()
|
||||
#### [Advanced hunting overview](microsoft-defender-atp/advanced-hunting-overview.md)
|
||||
@ -349,10 +351,10 @@
|
||||
##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md)
|
||||
##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md)
|
||||
##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md)
|
||||
##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-tvm-softwareinventory-table.md)
|
||||
##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-tvm-softwarevulnerability-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-tvm-configassessment-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-tvm-secureconfigkb-table.md)
|
||||
##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md)
|
||||
##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md)
|
||||
#### [Apply query best practices](microsoft-defender-atp/advanced-hunting-best-practices.md)
|
||||
|
||||
### [Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md)
|
||||
@ -413,7 +415,7 @@
|
||||
##### [Manage portal access using RBAC](microsoft-defender-atp/rbac.md)
|
||||
###### [Create and manage roles](microsoft-defender-atp/user-roles.md)
|
||||
###### [Create and manage machine groups](microsoft-defender-atp/machine-groups.md)
|
||||
####### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md)
|
||||
###### [Create and manage machine tags](microsoft-defender-atp/machine-tags.md)
|
||||
|
||||
#### [APIs]()
|
||||
##### [Enable SIEM integration](microsoft-defender-atp/enable-siem-integration.md)
|
||||
@ -659,7 +661,6 @@
|
||||
### [How Microsoft identifies malware and PUA](intelligence/criteria.md)
|
||||
### [Submit files for analysis](intelligence/submission-guide.md)
|
||||
### [Safety Scanner download](intelligence/safety-scanner-download.md)
|
||||
### [Industry antivirus tests](intelligence/top-scoring-industry-antivirus-tests.md)
|
||||
### [Industry collaboration programs](intelligence/cybersecurity-industry-partners.md)
|
||||
#### [Virus information alliance](intelligence/virus-information-alliance-criteria.md)
|
||||
#### [Microsoft virus initiative](intelligence/virus-initiative-criteria.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 1102(S) The audit log was cleared. (Windows 10)
|
||||
description: Describes security event 1102(S) The audit log was cleared.
|
||||
description: Though you shouldn't normally see it, this event generates every time Windows Security audit log is cleared. This is for event 1102(S).
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 1104(S) The security log is now full. (Windows 10)
|
||||
description: Describes security event 1104(S) The security log is now full.
|
||||
description: This event generates every time Windows security log becomes full and the event log retention method is set to "Do not overwrite events."
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: 1105(S) Event log automatic backup. (Windows 10)
|
||||
description: Describes security event 1105(S) Event log automatic backup.
|
||||
description: This event generates every time Windows security log becomes full and new event log file was created.
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Enable virtualization-based protection of code integrity
|
||||
description: This article explains the steps to opt in to using HVCI on Windows devices.
|
||||
title: Enable virtualization-based protection of code integrity
|
||||
description: This article explains the steps to opt in to using HVCI on Windows devices.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: medium
|
||||
@ -16,7 +16,7 @@ ms.reviewer:
|
||||
|
||||
# Enable virtualization-based protection of code integrity
|
||||
|
||||
**Applies to**
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
@ -25,13 +25,13 @@ Some applications, including device drivers, may be incompatible with HVCI.
|
||||
This can cause devices or software to malfunction and in rare cases may result in a blue screen. Such issues may occur after HVCI has been turned on or during the enablement process itself.
|
||||
If this happens, see [Troubleshooting](#troubleshooting) for remediation steps.
|
||||
|
||||
>[!NOTE]
|
||||
>Because it makes use of *Mode Based Execution Control*, HVCI works better with Intel Kaby Lake or AMD Zen 2 CPUs and newer. Processors without MBEC will rely on an emulation of this feature, called *Restricted User Mode*, which has a bigger impact on performance.
|
||||
> [!NOTE]
|
||||
> Because it makes use of *Mode Based Execution Control*, HVCI works better with Intel Kaby Lake or AMD Zen 2 CPUs and newer. Processors without MBEC will rely on an emulation of this feature, called *Restricted User Mode*, which has a bigger impact on performance.
|
||||
|
||||
## HVCI Features
|
||||
|
||||
* HVCI protects modification of the Control Flow Guard (CFG) bitmap.
|
||||
* HVCI also ensure your other Truslets, like Credential Guard, have a valid certificate.
|
||||
* HVCI also ensures that your other trusted processes, like Credential Guard, have got a valid certificate.
|
||||
* Modern device drivers must also have an EV (Extended Validation) certificate and should support HVCI.
|
||||
|
||||
## How to turn on HVCI in Windows 10
|
||||
@ -54,7 +54,7 @@ Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP]
|
||||
### Enable HVCI using Group Policy
|
||||
|
||||
1. Use Group Policy Editor (gpedit.msc) to either edit an existing GPO or create a new one.
|
||||
2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**.
|
||||
2. Navigate to **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard**.
|
||||
3. Double-click **Turn on Virtualization Based Security**.
|
||||
4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be disabled remotely or select **Enabled without UEFI lock**.
|
||||
|
||||
@ -290,9 +290,9 @@ WDAC protects against malware running in the guest virtual machine. It does not
|
||||
Set-VMSecurity -VMName <VMName> -VirtualizationBasedSecurityOptOut $true
|
||||
```
|
||||
|
||||
### Requirements for running HVCI in Hyper-V virtual machines
|
||||
### Requirements for running HVCI in Hyper-V virtual machines
|
||||
- The Hyper-V host must run at least Windows Server 2016 or Windows 10 version 1607.
|
||||
- The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10.
|
||||
- The Hyper-V virtual machine must be Generation 2, and running at least Windows Server 2016 or Windows 10.
|
||||
- HVCI and [nested virtualization](https://docs.microsoft.com/virtualization/hyper-v-on-windows/user-guide/nested-virtualization) can be enabled at the same time
|
||||
- Virtual Fibre Channel adapters are not compatible with HVCI. Before attaching a virtual Fibre Channel Adapter to a virtual machine, you must first opt out of virtualization-based security using `Set-VMSecurity`.
|
||||
- The AllowFullSCSICommandSet option for pass-through disks is not compatible with HVCI. Before configuring a pass-through disk with AllowFullSCSICommandSet, you must first opt out of virtualization-based security using `Set-VMSecurity`.
|
||||
|
||||
BIN
windows/security/threat-protection/images/lab-creation-page.png
Normal file
BIN
windows/security/threat-protection/images/lab-creation-page.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 135 KiB |
@ -44,6 +44,9 @@ ms.topic: conceptual
|
||||
|
||||
<a name="tvm"></a>
|
||||
|
||||
|
||||
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4obJq]
|
||||
|
||||
**[Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)**<br>
|
||||
This built-in capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.
|
||||
|
||||
|
||||
@ -36,8 +36,6 @@
|
||||
|
||||
## [Safety Scanner download](safety-scanner-download.md)
|
||||
|
||||
## [Industry tests](top-scoring-industry-antivirus-tests.md)
|
||||
|
||||
## [Industry collaboration programs](cybersecurity-industry-partners.md)
|
||||
|
||||
### [Virus information alliance](virus-information-alliance-criteria.md)
|
||||
|
||||
@ -1,112 +0,0 @@
|
||||
---
|
||||
title: Top scoring in industry tests (AV-TEST, AV Comparatives, SE Labs, MITRE ATT&CK)
|
||||
ms.reviewer:
|
||||
description: Microsoft Defender ATP consistently achieves high scores in independent tests. View the latest scores and analysis.
|
||||
keywords: Windows Defender Antivirus, av reviews, antivirus test, av testing, latest av scores, detection scores, security product testing, security industry tests, industry antivirus tests, best antivirus, av-test, av-comparatives, SE labs, MITRE ATT&CK, endpoint protection platform, EPP, endpoint detection and response, EDR, Windows 10, Microsoft Defender Antivirus, WDAV, MDATP, Microsoft Threat Protection, security, malware, av, antivirus, scores, scoring, next generation protection, ranking, success
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: secure
|
||||
ms.sitesec: library
|
||||
ms.localizationpriority: high
|
||||
ms.author: ellevin
|
||||
author: levinec
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
search.appverid: met150
|
||||
---
|
||||
|
||||
# Top scoring in industry tests
|
||||
|
||||
Microsoft Defender Advanced Threat Protection ([Microsoft Defender ATP](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp)) technologies consistently achieve high scores in independent tests, demonstrating the strength of its enterprise threat protection capabilities. Microsoft aims to be transparent about these test scores. This page summarizes the results and provides analysis.
|
||||
|
||||
## Next generation protection
|
||||
|
||||
[Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) consistently performs highly in independent tests, displaying how it is a top choice in the antivirus market. Keep in mind, these tests only provide results for antivirus and do not test for additional security protections.
|
||||
|
||||
Windows Defender Antivirus is the [next generation protection](https://www.youtube.com/watch?v=Xy3MOxkX_o4) capability in the [Microsoft Defender ATP Windows 10 security stack](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) that addresses the latest and most sophisticated threats today. In some cases, customers might not even know they were protected because a cyberattack is stopped [milliseconds after a campaign starts](https://cloudblogs.microsoft.com/microsoftsecure/2018/03/07/behavior-monitoring-combined-with-machine-learning-spoils-a-massive-dofoil-coin-mining-campaign). That's because Windows Defender Antivirus and other [endpoint protection platform (EPP)](https://www.microsoft.com/security/blog/2019/08/23/gartner-names-microsoft-a-leader-in-2019-endpoint-protection-platforms-magic-quadrant/) capabilities in Microsoft Defender ATP detect and stops malware at first sight with [machine learning](https://cloudblogs.microsoft.com/microsoftsecure/2018/06/07/machine-learning-vs-social-engineering), [artificial intelligence](https://cloudblogs.microsoft.com/microsoftsecure/2018/02/14/how-artificial-intelligence-stopped-an-emotet-outbreak), behavioral analysis, and other advanced technologies.
|
||||
<br><br>
|
||||
|
||||
**Download the latest transparency report: [Examining industry test results, November 2019](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4kagp)**
|
||||
|
||||
### AV-TEST: Protection score of 5.5/6.0 in the latest test
|
||||
|
||||
The AV-TEST Product Review and Certification Report tests on three categories: protection, performance, and usability. The following scores are for the Protection category which has two scores: Real-World Testing and the AV-TEST reference set (known as "Prevalent Malware").
|
||||
|
||||
- January - February 2020 AV-TEST Business User test: [Protection score 5.5/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/february-2020/microsoft-windows-defender-antivirus-4.18-200614/) <sup>**Latest**</sup>
|
||||
|
||||
Windows Defender Antivirus achieved an overall Protection score of 5.5/6.0, with 21,008 malware samples used.
|
||||
|
||||
- November - December 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/december-2019/microsoft-windows-defender-antivirus-4.18-195015/)
|
||||
|
||||
- September - October 2019 AV-TEST Business User test: [Protection score 5.5/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/october-2019/microsoft-windows-defender-antivirus-4.18-194115/)
|
||||
|
||||
- July — August 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/august-2019/microsoft-windows-defender-antivirus-4.18-193215/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4kagp)
|
||||
|
||||
- May — June 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/june-2019/microsoft-windows-defender-antivirus-4.18-192415/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl)
|
||||
|
||||
- March — April 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/april-2019/microsoft-windows-defender-antivirus-4.18-191517/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl)
|
||||
|
||||
- January — February 2019 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/february-2019/microsoft-windows-defender-antivirus-4.18-190611/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE33cdd)
|
||||
|
||||
- November — December 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/december-2018/microsoft-windows-defender-antivirus-4.18-185074/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWusR9)
|
||||
|
||||
- September — October 2018 AV-TEST Business User test: [Protection score 6.0/6.0](https://www.av-test.org/en/antivirus/business-windows-client/windows-10/october-2018/microsoft-windows-defender-antivirus-4.18-184174/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWqOqD)
|
||||
|
||||
### AV-Comparatives: Protection rating of 99.6% in the latest test
|
||||
|
||||
Business Security Test consists of three main parts: the Real-World Protection Test that mimics online malware attacks, the Malware Protection Test where the malware enters the system from outside the internet (for example by USB), and the Performance Test that looks at the impact on the system's performance.
|
||||
|
||||
- Business Security Test 2019 (August — November): [Real-World Protection Rate 99.6%](https://www.av-comparatives.org/tests/business-security-test-2019-august-november/) <sup>**Latest**</sup>
|
||||
|
||||
Windows Defender Antivirus has scored consistently high in Real-World Protection Rates over the past year, with 99.6% in the latest test.
|
||||
|
||||
- Business Security Test 2019 Factsheet (August — September): [Real-World Protection Rate 99.9%](https://www.av-comparatives.org/tests/business-security-test-august-september-2019-factsheet/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4kagp)
|
||||
|
||||
- Business Security Test 2019 (March — June): [Real-World Protection Rate 99.9%](https://www.av-comparatives.org/tests/business-security-test-2019-march-june/) | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl)
|
||||
|
||||
- Business Security Test 2018 (August — November): [Real-World Protection Rate 99.6%](https://www.av-comparatives.org/tests/business-security-test-2018-august-november/)
|
||||
|
||||
- Business Security Test 2018 (March — June): [Real-World Protection Rate 98.7%](https://www.av-comparatives.org/tests/business-security-test-2018-march-june/)
|
||||
|
||||
### SE Labs: AAA award in the latest test
|
||||
|
||||
SE Labs tests a range of solutions used by products and services to detect and/or protect against attacks, including endpoint software, network appliances, and cloud services.
|
||||
|
||||
- Enterprise Endpoint Protection October — December 2019: [AAA award](https://selabs.uk/download/enterprise/epp/2019/oct-dec-2019-enterprise.pdf) <sup>**pdf**</sup>
|
||||
|
||||
Microsoft's next-gen protection was named one of the leading products, stopping all targeted attacks and all but two public threats.
|
||||
|
||||
- Enterprise Endpoint Protection July — September 2019: [AAA award](https://selabs.uk/download/enterprise/epp/2019/jul-sep-2019-enterprise.pdf) <sup>**pdf**</sup> | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE4kagp)
|
||||
|
||||
- Enterprise Endpoint Protection April — June 2019: [AAA award](https://selabs.uk/download/enterprise/epp/2019/apr-jun-2019-enterprise.pdf) <sup>**pdf**</sup> | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl)
|
||||
|
||||
- Enterprise Endpoint Protection January — March 2019: [AAA award](https://selabs.uk/download/enterprise/epp/2019/jan-mar-2019-enterprise.pdf) <sup>**pdf**</sup> | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE3Esbl)
|
||||
|
||||
- Enterprise Endpoint Protection October — December 2018: [AAA award](https://selabs.uk/download/enterprise/epp/2018/oct-dec-2018-enterprise.pdf) <sup>**pdf**</sup> | [Analysis](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE33cdd)
|
||||
|
||||
## Endpoint detection & response
|
||||
|
||||
Microsoft Defender ATP [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats.
|
||||
|
||||
|
||||
|
||||
**Read our analysis: [MITRE evaluation highlights industry-leading EDR capabilities in Windows Defender ATP](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/MITRE-evaluation-highlights-industry-leading-EDR-capabilities-in/ba-p/369831)**
|
||||
|
||||
### MITRE: Industry-leading optics and detection capabilities
|
||||
|
||||
MITRE tested the ability of products to detect techniques commonly used by the targeted attack group APT3 (also known as Boron or UPS). To isolate detection capabilities, all protection and prevention features were turned off. Microsoft is happy to be one of the first EDR vendors to sign up for the MITRE evaluation based on the ATT&CK framework. The framework is widely regarded today as the most comprehensive catalog of attacker techniques and tactics.
|
||||
|
||||
- ATT&CK-based evaluation: [Leading optics and detection capabilities](https://www.microsoft.com/security/blog/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/) | [Analysis](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/MITRE-evaluation-highlights-industry-leading-EDR-capabilities-in/ba-p/369831)
|
||||
|
||||
Microsoft Defender ATP delivered comprehensive coverage of attacker techniques across the entire attack chain. Highlights included the breadth of telemetry, the strength of threat intelligence, and the advanced, automatic detection through machine learning, heuristics, and behavior monitoring.
|
||||
|
||||
## To what extent are tests representative of protection in the real world?
|
||||
|
||||
Independent security industry tests aim to evaluate the best antivirus and security products in an unbiased manner. However, it is important to remember that Microsoft sees a wider and broader set of threats beyond what's tested in the evaluations highlighted in this topic. For example, in an average month Microsoft's security products identify over 100 million new threats. Even if an independent tester can acquire and test 1% of those threats, that is a million tests across 20 or 30 products. In other words, the vastness of the malware landscape makes it extremely difficult to evaluate the quality of protection against real world threats.
|
||||
|
||||
The capabilities within Microsoft Defender ATP provide [additional layers of protection](https://cloudblogs.microsoft.com/microsoftsecure/2017/12/11/detonating-a-bad-rabbit-windows-defender-antivirus-and-layered-machine-learning-defenses) that are not factored into industry antivirus tests, and address some of the latest and most sophisticated threats. Isolating AV from the rest of Microsoft Defender ATP creates a partial picture of how Microsoft's security stack operates in the real world. For example, attack surface reduction and endpoint detection & response capabilities can help prevent malware from getting onto devices in the first place. We have proven that [Microsoft Defender ATP components catch samples](https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2ouJA) that Windows Defender Antivirus missed in these industry tests, which is more representative of how effectively Microsoft's security suite protects customers in the real world.
|
||||
|
||||
With independent tests, customers can view one aspect of their security suite but can't assess the complete protection of all the security features. Microsoft is highly engaged in working with several independent testers to evolve security testing to focus on the end-to-end security stack.
|
||||
|
||||
[Learn more about Microsoft Defender ATP](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md) and evaluate it in your own network by signing up for a [90-day trial of Microsoft Defender ATP](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp), or [enabling Preview features on existing tenants](../microsoft-defender-atp/preview-settings.md).
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Guide to removing Microsoft Baseline Security Analyzer (MBSA)
|
||||
description: This article documents the removal of Microsoft Baseline Security Analyzer (MBSA) and provides alternative solutions
|
||||
description: This article documents the removal of Microsoft Baseline Security Analyzer (MBSA) and provides alternative solutions.
|
||||
keywords: MBSA, security, removal
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
|
||||
@ -22,30 +22,34 @@ ms.topic: article
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
## API description
|
||||
|
||||
Adds or remove tag to a specific [Machine](machine.md).
|
||||
|
||||
|
||||
## Limitations
|
||||
|
||||
1. You can post on machines last seen in the past 30 days.
|
||||
|
||||
2. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.
|
||||
|
||||
|
||||
## Permissions
|
||||
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Machine.ReadWrite.All | 'Read and write all machine information'
|
||||
Application | Machine.ReadWrite.All | 'Read and write all machine information'
|
||||
Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information'
|
||||
|
||||
>[!Note]
|
||||
> When obtaining a token using user credentials:
|
||||
>- The user needs to have at least the following role permission: 'Manage security setting' (See [Create and manage roles](user-roles.md) for more information)
|
||||
>
|
||||
>- The user needs to have at least the following role permission: 'Manage security setting'. For more (See [Create and manage roles](user-roles.md) for more information)
|
||||
>- User needs to have access to the machine, based on machine group settings (See [Create and manage machine groups](machine-groups.md) for more information)
|
||||
|
||||
## HTTP request
|
||||
|
||||
```
|
||||
POST https://api.securitycenter.windows.com/api/machines/{id}/tags
|
||||
```
|
||||
@ -58,17 +62,18 @@ Authorization | String | Bearer {token}. **Required**.
|
||||
Content-Type | string | application/json. **Required**.
|
||||
|
||||
## Request body
|
||||
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Value | String | The tag name. **Required**.
|
||||
Action | Enum | Add or Remove. Allowed values are: 'Add' or 'Remove'. **Required**.
|
||||
Value | String | The tag name. **Required**.
|
||||
Action | Enum | Add or Remove. Allowed values are: 'Add' or 'Remove'. **Required**.
|
||||
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200 - Ok response code and the updated Machine in the response body.
|
||||
|
||||
If successful, this method returns 200 - Ok response code and the updated Machine in the response body.
|
||||
|
||||
## Example
|
||||
|
||||
|
||||
@ -1,53 +1,53 @@
|
||||
---
|
||||
title: DeviceTvmSecureConfigurationAssessment table in the advanced hunting schema
|
||||
description: Learn about Threat & Vulnerability Management security assessment events in the DeviceTvmSecureConfigurationAssessment table of the Advanced hunting schema. These events provide machine information as well as security configuration details, impact, and compliance information.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, DeviceTvmSecureConfigurationAssessment
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 11/12/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSecureConfigurationAssessment
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Each row in the `DeviceTvmSecureConfigurationAssessment` table contains an assessment event for a specific security configuration from [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). Use this reference to check the latest assessment results and determine whether devices are compliant.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.|
|
||||
| `Timestamp` | datetime |Date and time when the record was generated |
|
||||
| `ConfigurationId` | string | Unique identifier for a specific configuration |
|
||||
| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls |
|
||||
| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
|
||||
| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) |
|
||||
| `IsCompliant` | boolean | Indicates whether the configuration or policy is properly configured |
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
---
|
||||
title: DeviceTvmSecureConfigurationAssessment table in the advanced hunting schema
|
||||
description: Learn about Threat & Vulnerability Management security assessment events in the DeviceTvmSecureConfigurationAssessment table of the Advanced hunting schema. These events provide machine information as well as security configuration details, impact, and compliance information.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, DeviceTvmSecureConfigurationAssessment
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 11/12/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSecureConfigurationAssessment
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Each row in the `DeviceTvmSecureConfigurationAssessment` table contains an assessment event for a specific security configuration from [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). Use this reference to check the latest assessment results and determine whether devices are compliant.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7.|
|
||||
| `Timestamp` | datetime |Date and time when the record was generated |
|
||||
| `ConfigurationId` | string | Unique identifier for a specific configuration |
|
||||
| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls |
|
||||
| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
|
||||
| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) |
|
||||
| `IsCompliant` | boolean | Indicates whether the configuration or policy is properly configured |
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
@ -1,53 +1,53 @@
|
||||
---
|
||||
title: DeviceTvmSecureConfigurationAssessmentKB table in the advanced hunting schema
|
||||
description: Learn about the various secure configurations assessed by Threat & Vulnerability Management in the DeviceTvmSecureConfigurationAssessmentKB table of the Advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, MITRE ATT&CK framework, knowledge base, KB, DeviceTvmSecureConfigurationAssessmentKB
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 11/12/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSecureConfigurationAssessmentKB
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The `DeviceTvmSecureConfigurationAssessmentKB` table in the advanced hunting schema contains information about the various secure configurations — such as whether a device has automatic updates on — checked by [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). It also includes risk information, related industry benchmarks, and applicable MITRE ATT&CK techniques and tactics. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `ConfigurationId` | string | Unique identifier for a specific configuration |
|
||||
| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) |
|
||||
| `ConfigurationName` | string | Display name of the configuration |
|
||||
| `ConfigurationDescription` | string | Description of the configuration |
|
||||
| `RiskDescription` | string | Description of the associated risk |
|
||||
| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls|
|
||||
| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
|
||||
| `ConfigurationBenchmarks` | string | List of industry benchmarks recommending the same or similar configuration |
|
||||
| `RelatedMitreTechniques` | string | List of Mitre ATT&CK framework techniques related to the configuration |
|
||||
| `RelatedMitreTactics ` | string | List of Mitre ATT&CK framework tactics related to the configuration |
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
---
|
||||
title: DeviceTvmSecureConfigurationAssessmentKB table in the advanced hunting schema
|
||||
description: Learn about the various secure configurations assessed by Threat & Vulnerability Management in the DeviceTvmSecureConfigurationAssessmentKB table of the Advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, security configuration, MITRE ATT&CK framework, knowledge base, KB, DeviceTvmSecureConfigurationAssessmentKB
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 11/12/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSecureConfigurationAssessmentKB
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The `DeviceTvmSecureConfigurationAssessmentKB` table in the advanced hunting schema contains information about the various secure configurations — such as whether a device has automatic updates on — checked by [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md). It also includes risk information, related industry benchmarks, and applicable MITRE ATT&CK techniques and tactics. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `ConfigurationId` | string | Unique identifier for a specific configuration |
|
||||
| `ConfigurationImpact` | string | Rated impact of the configuration to the overall configuration score (1-10) |
|
||||
| `ConfigurationName` | string | Display name of the configuration |
|
||||
| `ConfigurationDescription` | string | Description of the configuration |
|
||||
| `RiskDescription` | string | Description of the associated risk |
|
||||
| `ConfigurationCategory` | string | Category or grouping to which the configuration belongs: Application, OS, Network, Accounts, Security controls|
|
||||
| `ConfigurationSubcategory` | string |Subcategory or subgrouping to which the configuration belongs. In many cases, this describes specific capabilities or features. |
|
||||
| `ConfigurationBenchmarks` | string | List of industry benchmarks recommending the same or similar configuration |
|
||||
| `RelatedMitreTechniques` | string | List of Mitre ATT&CK framework techniques related to the configuration |
|
||||
| `RelatedMitreTactics ` | string | List of Mitre ATT&CK framework tactics related to the configuration |
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
@ -1,56 +1,56 @@
|
||||
---
|
||||
title: DeviceTvmSoftwareInventoryVulnerabilities table in the advanced hunting schema
|
||||
description: Learn about the inventory of software in your devices and their vulnerabilities in the DeviceTvmSoftwareInventoryVulnerabilities table of the advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 11/12/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSoftwareInventoryVulnerabilities
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The `DeviceTvmSoftwareInventoryVulnerabilities` table in the advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software on your devices as well as any known vulnerabilities in these software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. |
|
||||
| `OSVersion` | string | Version of the operating system running on the machine |
|
||||
| `OSArchitecture` | string | Architecture of the operating system running on the machine |
|
||||
| `SoftwareVendor` | string | Name of the software vendor |
|
||||
| `SoftwareName` | string | Name of the software product |
|
||||
| `SoftwareVersion` | string | Version number of the software product |
|
||||
| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system |
|
||||
| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
---
|
||||
title: DeviceTvmSoftwareInventoryVulnerabilities table in the advanced hunting schema
|
||||
description: Learn about the inventory of software in your devices and their vulnerabilities in the DeviceTvmSoftwareInventoryVulnerabilities table of the advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 11/12/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSoftwareInventoryVulnerabilities
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The `DeviceTvmSoftwareInventoryVulnerabilities` table in the advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software on your devices as well as any known vulnerabilities in these software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `DeviceId` | string | Unique identifier for the machine in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the machine |
|
||||
| `OSPlatform` | string | Platform of the operating system running on the machine. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. |
|
||||
| `OSVersion` | string | Version of the operating system running on the machine |
|
||||
| `OSArchitecture` | string | Architecture of the operating system running on the machine |
|
||||
| `SoftwareVendor` | string | Name of the software vendor |
|
||||
| `SoftwareName` | string | Name of the software product |
|
||||
| `SoftwareVersion` | string | Version number of the software product |
|
||||
| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system |
|
||||
| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
@ -1,51 +1,51 @@
|
||||
---
|
||||
title: DeviceTvmSoftwareVulnerabilitiesKB table in the advanced hunting schema
|
||||
description: Learn about the software vulnerabilities tracked by Threat & Vulnerability Management in the DeviceTvmSoftwareVulnerabilitiesKB table of the advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, CVSS, DeviceTvmSoftwareVulnerabilitiesKB
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 11/12/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSoftwareVulnerabilitiesKB
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The `DeviceTvmSoftwareVulnerabilitiesKB` table in the advanced hunting schema contains the list of vulnerabilities [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) assesses devices for. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system |
|
||||
| `CvssScore` | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS) |
|
||||
| `IsExploitAvailable` | boolean | Indicates whether exploit code for the vulnerability is publicly available |
|
||||
| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
| `LastModifiedTime` | datetime | Date and time the item or related metadata was last modified |
|
||||
| `PublishedDate` | datetime | Date vulnerability was disclosed to public |
|
||||
| `VulnerabilityDescription` | string | Description of vulnerability and associated risks |
|
||||
| `AffectedSoftware` | string | List of all software products affected by the vulnerability |
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
---
|
||||
title: DeviceTvmSoftwareVulnerabilitiesKB table in the advanced hunting schema
|
||||
description: Learn about the software vulnerabilities tracked by Threat & Vulnerability Management in the DeviceTvmSoftwareVulnerabilitiesKB table of the advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, windows defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, CVSS, DeviceTvmSoftwareVulnerabilitiesKB
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 11/12/2019
|
||||
---
|
||||
|
||||
# DeviceTvmSoftwareVulnerabilitiesKB
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The `DeviceTvmSoftwareVulnerabilitiesKB` table in the advanced hunting schema contains the list of vulnerabilities [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) assesses devices for. Use this reference to construct queries that return information from the table.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system |
|
||||
| `CvssScore` | string | Severity score assigned to the security vulnerability under th Common Vulnerability Scoring System (CVSS) |
|
||||
| `IsExploitAvailable` | boolean | Indicates whether exploit code for the vulnerability is publicly available |
|
||||
| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
| `LastModifiedTime` | datetime | Date and time the item or related metadata was last modified |
|
||||
| `PublishedDate` | datetime | Date vulnerability was disclosed to public |
|
||||
| `VulnerabilityDescription` | string | Description of vulnerability and associated risks |
|
||||
| `AffectedSoftware` | string | List of all software products affected by the vulnerability |
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
@ -48,10 +48,10 @@ Table and column names are also listed within the Microsoft Defender Security Ce
|
||||
| **[DeviceImageLoadEvents](advanced-hunting-deviceimageloadevents-table.md)** | DLL loading events |
|
||||
| **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Windows Defender Antivirus and exploit protection |
|
||||
| **[DeviceFileCertificateInfo](advanced-hunting-devicefilecertificateinfo-table.md)** | Certificate information of signed files obtained from certificate verification events on endpoints |
|
||||
| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-tvm-softwareinventory-table.md)** | Inventory of software on devices as well as any known vulnerabilities in these software products |
|
||||
| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-tvm-softwarevulnerability-table.md)** | Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available |
|
||||
| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-tvm-configassessment-table.md)** | Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices |
|
||||
| **[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-tvm-secureconfigkb-table.md)** | Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks |
|
||||
| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md)** | Inventory of software on devices as well as any known vulnerabilities in these software products |
|
||||
| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md)** | Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available |
|
||||
| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-devicetvmsecureconfigurationassessment-table.md)** | Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices |
|
||||
| **[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md)** | Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks |
|
||||
|
||||
## Related topics
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Microsoft Defender ATP Flow connector
|
||||
ms.reviewer:
|
||||
description: Microsoft Defender ATP Flow connector
|
||||
description: Use Microsoft Defender ATP Flow connector to automate security and create a flow that will be triggered any time a new alert occurs on your tenant.
|
||||
keywords: flow, supported apis, api, Microsoft flow, query, automation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Microsoft Defender ATP APIs connection to Power BI
|
||||
ms.reviewer:
|
||||
description: Create custom reports using Power BI
|
||||
description: Create a Power Business Intelligence (BI) report on top of Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) APIs.
|
||||
keywords: apis, supported apis, Power BI, reports
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -25,7 +25,7 @@ ms.topic: article
|
||||
|
||||
In this section you will learn create a Power BI report on top of Microsoft Defender ATP APIs.
|
||||
|
||||
The first example demonstrates how to connect Power BI to Advanced Hunting API and the second example demonstrates a connection to our OData APIs (e.g. Machine Actions, Alerts, etc..)
|
||||
The first example demonstrates how to connect Power BI to Advanced Hunting API and the second example demonstrates a connection to our OData APIs, such as Machine Actions or Alerts.
|
||||
|
||||
## Connect Power BI to Advanced Hunting API
|
||||
|
||||
|
||||
@ -23,25 +23,27 @@ ms.custom: asr
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
**Is attack surface reduction (ASR) part of Windows?**
|
||||
## Is attack surface reduction (ASR) part of Windows?
|
||||
|
||||
ASR was originally a feature of the suite of exploit guard features introduced as a major update to Windows Defender Antivirus, in Windows 10 version 1709. Windows Defender Antivirus is the native antimalware component of Windows. However, please note that the full ASR feature-set is only available with a Windows enterprise license. Also note that ASR rule exclusions are managed separately from Windows Defender Antivirus exclusions.
|
||||
ASR was originally a feature of the suite of exploit guard features introduced as a major update to Microsoft Defender Antivirus, in Windows 10 version 1709. Microsoft Defender Antivirus is the native antimalware component of Windows. However, the full ASR feature-set is only available with a Windows enterprise license. Also note that ASR rule exclusions are managed separately from Microsoft Defender Antivirus exclusions.
|
||||
|
||||
**Do I need to have an enterprise license to run ASR rules?**
|
||||
## Do I need to have an enterprise license to run ASR rules?
|
||||
|
||||
The full set of ASR rules and features are only supported if you have an enterprise license for Windows 10. A limited number of rules may work without an enterprise license, if you have Microsoft 365 Business, set Windows Defender Antivirus as your primary security solution, and enable the rules through PowerShell. However, ASR usage without an enterprise license is not officially supported and the full feature-set of ASR will not be available.
|
||||
The full set of ASR rules and features is only supported if you have an enterprise license for Windows 10. A limited number of rules may work without an enterprise license. If you have Microsoft 365 Business, set Microsoft Defender Antivirus as your primary security solution, and enable the rules through PowerShell. However, ASR usage without an enterprise license is not officially supported and the full capabilities of ASR will not be available.
|
||||
|
||||
**Is ASR supported if I have an E3 license?**
|
||||
To learn more about Windows licensing, see [Windows 10 Licensing](https://www.microsoft.com/licensing/product-licensing/windows10?activetab=windows10-pivot:primaryr5) and get the [Volume Licensing guide for Windows 10](https://download.microsoft.com/download/2/D/1/2D14FE17-66C2-4D4C-AF73-E122930B60F6/Windows-10-Volume-Licensing-Guide.pdf).
|
||||
|
||||
Yes. ASR is supported for Windows Enterprise E3 and above. See [Use attack surface reduction rules in Windows 10 Enterprise E3](attack-surface-reduction-rules-in-windows-10-enterprise-e3.md) for more details.
|
||||
## Is ASR supported if I have an E3 license?
|
||||
|
||||
**Which features are supported with an E5 license?**
|
||||
Yes. ASR is supported for Windows Enterprise E3 and above.
|
||||
|
||||
## Which features are supported with an E5 license?
|
||||
|
||||
All of the rules supported with E3 are also supported with E5.
|
||||
|
||||
E5 also added greater integration with Microsoft Defender ATP. With E5, you can [use Microsoft Defender ATP to monitor and review analytics](https://docs.microsoft.com/microsoft-365/security/mtp/monitor-devices?view=o365-worldwide#monitor-and-manage-asr-rule-deployment-and-detections) on alerts in real-time, fine-tune rule exclusions, configure ASR rules, and view lists of event reports.
|
||||
|
||||
**What are the the currently supported ASR rules??**
|
||||
## What are the currently supported ASR rules?
|
||||
|
||||
ASR currently supports all of the rules below:
|
||||
|
||||
@ -52,8 +54,8 @@ ASR currently supports all of the rules below:
|
||||
* [Block JavaScript or VBScript from launching downloaded executable content](attack-surface-reduction.md##block-javascript-or-vbscript-from-launching-downloaded-executable-content)
|
||||
* [Block execution of potentially obfuscated scripts](attack-surface-reduction.md#block-execution-of-potentially-obfuscated-scripts)
|
||||
* [Block Win32 API calls from Office macro](attack-surface-reduction.md#block-win32-api-calls-from-office-macros)
|
||||
* [Use advanced protection against ransomware](attack-surface-reduction.md#use-advanced-protection-against-ransomware)<!-- Note: Because the following link contains characters the validator is not expecting, it throws a warning that the bookmark does not exist. This is a false positive; the link correctly targets the heading, Block credential stealing from the Windows local security authority subsystem (lsass.exe), when selected -->
|
||||
* [Block credential stealing from the Windows local security authority subsystem (lsass.exe)](attack-surface-reduction.md#block-credential-stealing-from-the-windows-local-security-authority-subsystem)
|
||||
* [Use advanced protection against ransomware](attack-surface-reduction.md#use-advanced-protection-against-ransomware)
|
||||
* [Block credential stealing from the Windows local security authority subsystem](attack-surface-reduction.md#block-credential-stealing-from-the-windows-local-security-authority-subsystem) (lsass.exe)
|
||||
* [Block process creations originating from PSExec and WMI commands](attack-surface-reduction.md#block-process-creations-originating-from-psexec-and-wmi-commands)
|
||||
* [Block untrusted and unsigned processes that run from USB](attack-surface-reduction.md#block-untrusted-and-unsigned-processes-that-run-from-usb)
|
||||
* [Block executable files from running unless they meet a prevalence, age, or trusted list criteria](attack-surface-reduction.md#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion)
|
||||
@ -61,39 +63,41 @@ ASR currently supports all of the rules below:
|
||||
* [Block Adobe Reader from creating child processes](attack-surface-reduction.md#block-adobe-reader-from-creating-child-processes)
|
||||
* [Block persistence through WMI event subscription](attack-surface-reduction.md#block-persistence-through-wmi-event-subscription)
|
||||
|
||||
**What are some good recommendations for getting started with ASR?**
|
||||
## What are some good recommendations for getting started with ASR?
|
||||
|
||||
It is generally best to first test how ASR rules will impact your organization before enabling them, by running them in audit mode for a brief period of time. While you are running the rules in audit mode, you can identify any line-of-business applications that might get blocked erroneously, and exclude them from ASR.
|
||||
Test how ASR rules will impact your organization before enabling them by running ASR rules in audit mode for a brief period of time. While you are running the rules in audit mode, you can identify any line-of-business applications that might get blocked erroneously, and exclude them from ASR.
|
||||
|
||||
Larger organizations should consider rolling out ASR rules in "rings," by auditing and enabling rules in increasingly-broader subsets of devices. You can arrange your organization's devices into rings by using Intune or a Group Policy management tool.
|
||||
Larger organizations should consider rolling out ASR rules in "rings," by auditing and enabling rules in increasingly broader subsets of devices. You can arrange your organization's devices into rings by using Intune or a Group Policy management tool.
|
||||
|
||||
**How long should I test an ASR rule in audit mode before enabling it?**
|
||||
## How long should I test an ASR rule in audit mode before enabling it?
|
||||
|
||||
You should keep the rule in audit mode for about 30 days. This amount of time gives you a good baseline for how the rule will operate once it goes live throughout your organization. During the audit period, you can identify any line-of-business applications that might get blocked by the rule, and configure the rule to exclude them.
|
||||
Keep the rule in audit mode for about 30 days to get a good baseline for how the rule will operate once it goes live throughout your organization. During the audit period, you can identify any line-of-business applications that might get blocked by the rule, and configure the rule to exclude them.
|
||||
|
||||
**I'm making the switch from a third-party security solution to Microsoft Defender ATP. Is there an "easy" way to export rules from another security solution to ASR?**
|
||||
## I'm making the switch from a third-party security solution to Microsoft Defender ATP. Is there an "easy" way to export rules from another security solution to ASR?
|
||||
|
||||
Rather than attempting to import sets of rules from another security solution, it is, in most cases, easier and safer to start with the baseline recommendations suggested for your organization by Microsoft Defender ATP, then use tools such as audit mode, monitoring, and analytics to configure your new solution to suit your unique needs. The default configuration for most ASR rules, combined with Defender's real-time protection, will protect against a large number of exploits and vulnerabilities.
|
||||
In most cases, it's easier and better to start with the baseline recommendations suggested by [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/) (Microsoft Defender ATP) than to attempt to import rules from another security solution. Then, use tools such as audit mode, monitoring, and analytics to configure your new solution to suit your unique needs.
|
||||
|
||||
The default configuration for most ASR rules, combined with Microsoft Defender ATP's real-time protection, will protect against a large number of exploits and vulnerabilities.
|
||||
|
||||
From within Microsoft Defender ATP, you can update your defenses with custom indicators, to allow and block certain software behaviors. ASR also allows for some customization of rules, in the form of file and folder exclusions. As a general rule, it is best to audit a rule for a period of time, and configure exclusions for any line-of-business applications that might get blocked.
|
||||
|
||||
**Does ASR support file or folder exclusions that include system variables and wildcards in the path?**
|
||||
## Does ASR support file or folder exclusions that include system variables and wildcards in the path?
|
||||
|
||||
Yes. See [Excluding files and folders from ASR rules](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for more details on excluding files or folders from ASR rules, and [Configure and validate exclusions based on file extension and folder location](../windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists) for more on using system variables and wildcards in excluded file paths.
|
||||
|
||||
**Do ASR rules cover all applications by default?**
|
||||
## Do ASR rules cover all applications by default?
|
||||
|
||||
It depends on the rule. Most ASR rules cover the behavior of Microsoft Office products and services, such as Word, Excel, PowerPoint, and OneNote, or Outlook. Certain ASR rules, such as *Block execution of potentially obfuscated scripts*, are more general in scope.
|
||||
|
||||
**Does ASR support third-party security solutions?**
|
||||
## Does ASR support third-party security solutions?
|
||||
|
||||
ASR uses Microsoft Defender Antivirus to block applications. It is not possible to configure ASR to use another security solution for blocking at this time.
|
||||
|
||||
**I have an E5 license and enabled some ASR rules in conjunction with Microsoft Defender ATP. Is it possible for an ASR event to not show up at all in Microsoft Defender ATP's event timeline?**
|
||||
## I have an E5 license and enabled some ASR rules in conjunction with Microsoft Defender ATP. Is it possible for an ASR event to not show up at all in Microsoft Defender ATP's event timeline?
|
||||
|
||||
Whenever a notification is triggered locally by an ASR rule, a report on the event is also sent to the Microsoft Defender ATP portal. If you're having trouble finding the event, you can filter the events timeline using the search box. You can also view ASR events by visiting **Go to attack surface management**, from the **Configuration management** icon in the Security Center taskbar. The attack surface management page includes a tab for report detections, which includes a full list of ASR rule events reported to Microsoft Defender ATP.
|
||||
|
||||
**I applied a rule using GPO. Now when I try to check the indexing options for the rule in Microsoft Outlook, I get a message stating, 'Access denied'.**
|
||||
## I applied a rule using GPO. Now when I try to check the indexing options for the rule in Microsoft Outlook, I get a message stating, 'Access denied'.
|
||||
|
||||
Try opening the indexing options directly from Windows 10.
|
||||
|
||||
@ -101,23 +105,23 @@ Try opening the indexing options directly from Windows 10.
|
||||
|
||||
1. Enter **Indexing options** into the search box.
|
||||
|
||||
**Are the criteria used by the rule, *Block executable files from running unless they meet a prevalence, age, or trusted list criterion*, configurable by an admin?**
|
||||
## Are the criteria used by the rule, "Block executable files from running unless they meet a prevalence, age, or trusted list criterion," configurable by an admin?
|
||||
|
||||
No. The criteria used by this rule are maintained by Microsoft cloud protection, to keep the trusted list constantly up-to-date with data gathered from around the world. Local admins do not have write access to alter this data. If you are looking to configure this rule to tailor it for your enterprise, you can add certain applications to the exclusions list to prevent the rule from being triggered.
|
||||
No. The criteria used by this rule are maintained by Microsoft cloud protection, to keep the trusted list constantly up to date with data gathered from around the world. Local admins do not have write access to alter this data. If you are looking to configure this rule to tailor it for your enterprise, you can add certain applications to the exclusions list to prevent the rule from being triggered.
|
||||
|
||||
**I enabled the ASR rule, *Block executable files from running unless they meet a prevalence, age, or trusted list criterion*. After some time, I updated a piece of software, and the rule is now blocking it, even though it didn't before. Did something go wrong?**
|
||||
## I enabled the ASR rule, *Block executable files from running unless they meet a prevalence, age, or trusted list criterion*. After some time, I updated a piece of software, and the rule is now blocking it, even though it didn't before. Did something go wrong?
|
||||
|
||||
This rule relies upon each application having a known reputation, as measured by prevalence, age, or inclusion on a list of trusted apps. The rule's decision to block or allow an application is ultimately determined by Microsoft cloud protection's assessment of these criteria.
|
||||
|
||||
Usually, cloud protection can determine that a new version of an application is similar enough to previous versions that it does not need to be re-assessed at length. However, it might take some time for the app to build reputation after switching versions, particularly after a major update. In the meantime, you can add the application to the exclusions list, to prevent this rule from blocking important applications. If you are frequently updating and working with very new versions of applications, you may opt instead to run this rule in audit mode.
|
||||
Usually, cloud protection can determine that a new version of an application is similar enough to previous versions that it does not need to be reassessed at length. However, it might take some time for the app to build reputation after switching versions, particularly after a major update. In the meantime, you can add the application to the exclusions list, to prevent this rule from blocking important applications. If you are frequently updating and working with new versions of applications, you may opt instead to run this rule in audit mode.
|
||||
|
||||
**I recently enabled the ASR rule, *Block credential stealing from the Windows local security authority subsystem (lsass.exe)*, and I am getting a large number of notifications. What is going on?**
|
||||
## I recently enabled the ASR rule, *Block credential stealing from the Windows local security authority subsystem (lsass.exe)*, and I am getting a large number of notifications. What is going on?
|
||||
|
||||
A notification generated by this rule does not necessarily indicate malicious activity; however, this rule is still useful for blocking malicious activity, since malware often target lsass.exe to gain illicit access to accounts. The lsass.exe process stores user credentials in memory after a user has logged in. Windows uses these credentials to validate users and apply local security policies.
|
||||
A notification generated by this rule does not necessarily indicate malicious activity; however, this rule is still useful for blocking malicious activity, since malware often targets lsass.exe to gain illicit access to accounts. The lsass.exe process stores user credentials in memory after a user has logged in. Windows uses these credentials to validate users and apply local security policies.
|
||||
|
||||
Because many legitimate processes throughout a typical day will be calling on lsass.exe for credentials, this rule can be especially noisy. If a known legitimate application causes this rule to generate an excessive amount of notifications, you can add it to the exclusion list. Most other ASR rules will generate a relatively smaller number of notifications, in comparison to this one, since calling on lsass.exe is typical of many applications' normal functioning.
|
||||
Because many legitimate processes throughout a typical day will be calling on lsass.exe for credentials, this rule can be especially noisy. If a known legitimate application causes this rule to generate an excessive number of notifications, you can add it to the exclusion list. Most other ASR rules will generate a relatively smaller number of notifications, in comparison to this one, since calling on lsass.exe is typical of many applications' normal functioning.
|
||||
|
||||
**Is it a good idea to enable the rule, *Block credential stealing from the Windows local security authority subsystem (lsass.exe)*, alongside LSA protection?**
|
||||
## Is it a good idea to enable the rule, *Block credential stealing from the Windows local security authority subsystem (lsass.exe)*, alongside LSA protection?
|
||||
|
||||
Enabling this rule will not provide additional protection if you have [LSA protection](https://docs.microsoft.com/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection#BKMK_HowToConfigure) enabled as well. Both the rule and LSA protection work in much the same way, so having both running at the same time would be redundant. However, sometimes you may not be able to enable LSA protection. In those cases, you can enable this rule to provide equivalent protection against malware that target lsass.exe.
|
||||
|
||||
|
||||
@ -1,53 +0,0 @@
|
||||
---
|
||||
title: Use attack surface reduction rules in Windows 10 Enterprise E3
|
||||
description: ASR rules can help prevent exploits from using apps and scripts to infect machines with malware
|
||||
keywords: Attack surface reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: manage
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
---
|
||||
|
||||
# Use attack surface reduction rules in Windows 10 Enterprise E3
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10 Enterprise E3
|
||||
|
||||
Attack surface reduction rules help prevent actions and apps that are typically used by exploit-seeking malware to infect machines. This feature area includes the rules, monitoring, reporting, and analytics necessary for deployment that are included in [Microsoft Defender Advanced Threat Protection](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), and require the Windows 10 Enterprise E5 license.
|
||||
|
||||
A limited subset of basic attack surface reduction rules can technically be used with Windows 10 Enterprise E3. They can be used without the benefits of reporting, monitoring, and analytics, which provide the ease of deployment and management capabilities necessary for enterprises.
|
||||
|
||||
Attack surface reduction rules are supported on Windows Server 2019 as well as Windows 10 clients.
|
||||
|
||||
The limited subset of rules that can be used in Windows 10 Enterprise E3 include:
|
||||
|
||||
- Block executable content from email client and webmail
|
||||
- Block all Office applications from creating child processes
|
||||
- Block Office applications from creating executable content
|
||||
- Block Office applications from injecting code into other processes
|
||||
- Block JavaScript or VBScript from launching downloaded executable content
|
||||
- Block execution of potentially obfuscated scripts
|
||||
- Block Win32 API calls from Office macro
|
||||
- Use advanced protection against ransomware
|
||||
- Block credential stealing from the Windows local security authority subsystem (lsass.exe)
|
||||
- Block process creations originating from PSExec and WMI commands
|
||||
- Block untrusted and unsigned processes that run from USB
|
||||
|
||||
For more information about these rules, see [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction.md).
|
||||
|
||||
## Related topics
|
||||
|
||||
Topic | Description
|
||||
---|---
|
||||
[Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) | Use a tool to see a number of scenarios that demonstrate how attack surface reduction rules work, and what events would typically be created.
|
||||
[Enable attack surface reduction rules](enable-attack-surface-reduction.md) | Use Group Policy, PowerShell, or MDM CSPs to enable and manage attack surface reduction rules in your network.
|
||||
[Customize attack surface reduction rules](customize-attack-surface-reduction.md) | Exclude specified files and folders from being evaluated by attack surface reduction rules and customize the notification that appears on a user's machine when a rule blocks an app or file.
|
||||
@ -23,9 +23,6 @@ ms.custom: asr
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
Your attack surface is the total number of places where an attacker could compromise your organization's devices or networks. Reducing your attack surface means offering attackers fewer ways to perform attacks.
|
||||
|
||||
Attack surface reduction rules target software behaviors that are often abused by attackers, such as:
|
||||
@ -44,9 +41,11 @@ For more information about configuring attack surface reduction rules, see [Enab
|
||||
|
||||
## Attack surface reduction features across Windows versions
|
||||
|
||||
You can set attack surface reduction rules for computers running the following versions of Windows:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- [Windows Server, version 1803](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) (Semi-Annual Channel) or later
|
||||
You can set attack surface reduction rules for devices running any of the following editions and versions of Windows:
|
||||
- Windows 10 Pro, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows 10 Enterprise, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows Server, [version 1803 (Semi-Annual Channel)](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) or later
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
|
||||
To use the entire feature-set of attack surface reduction rules, you need a [Windows 10 Enterprise license](https://www.microsoft.com/licensing/product-licensing/windows10). With a [Windows E5 license](https://docs.microsoft.com/windows/deployment/deploy-enterprise-licenses), you get advanced management capabilities including monitoring, analytics, and workflows available in [Microsoft Defender Advanced Threat Protection](microsoft-defender-advanced-threat-protection.md), as well as reporting and configuration capabilities in the [Microsoft 365 security center](https://docs.microsoft.com/microsoft-365/security/mtp/overview-security-center). These advanced capabilities aren't available with an E3 license, but you can still use Event Viewer to review attack surface reduction rule events.
|
||||
|
||||
|
||||
@ -136,7 +136,7 @@ The **Evidence** tab shows details related to threats associated with this inves
|
||||
|
||||
### Entities
|
||||
|
||||
The **Entities** tab shows details about entities such as files, process, services, drives, and IP addresses. The table details such as the number of entities that were analyzed. You'll gain insight into details such as how many are remediated, suspicious, or determined to be clean.
|
||||
The **Entities** tab shows details about entities such as files, process, services, drives, and IP addresses. The table details such as the number of entities that were analyzed. You'll gain insight into details such as how many are remediated, suspicious, or had no threats found.
|
||||
|
||||
### Log
|
||||
|
||||
|
||||
@ -30,7 +30,7 @@ The automated investigation feature leverages various inspection algorithms, and
|
||||
|
||||
## How the automated investigation starts
|
||||
|
||||
When an alert is triggered, a security playbook goes into effect. Depending on the security playbook, an automated investigation can start. For example, suppose a malicious file resides on a machine. When that file is detected, an alert is triggered. The automated investigation process begins. Microsoft Defender ATP checks to see if the malicious file is present on any other machines in the organization. Details from the investigation, including verdicts (Malicious, Suspicious, and Clean) are available during and after the automated investigation.
|
||||
When an alert is triggered, a security playbook goes into effect. Depending on the security playbook, an automated investigation can start. For example, suppose a malicious file resides on a machine. When that file is detected, an alert is triggered. The automated investigation process begins. Microsoft Defender ATP checks to see if the malicious file is present on any other machines in the organization. Details from the investigation, including verdicts (*Malicious*, *Suspicious*, and *No threats found*) are available during and after the automated investigation.
|
||||
|
||||
>[!NOTE]
|
||||
>Currently, automated investigation only supports the following OS versions:
|
||||
@ -48,7 +48,7 @@ During and after an automated investigation, you can view details about the inve
|
||||
|**Alerts**| Shows the alert that started the investigation.|
|
||||
|**Machines** |Shows where the alert was seen.|
|
||||
|**Evidence** |Shows the entities that were found to be malicious during the investigation.|
|
||||
|**Entities** |Provides details about each analyzed entity, including a determination for each entity type (*Malicious*, *Suspicious*, or *Clean*). |
|
||||
|**Entities** |Provides details about each analyzed entity, including a determination for each entity type (*Malicious*, *Suspicious*, or *No threats found*). |
|
||||
|**Log** |Shows the chronological detailed view of all the investigation actions taken on the alert.|
|
||||
|**Pending actions** |If there are pending actions on the investigation, the **Pending actions** tab will be displayed where you can approve or reject actions. |
|
||||
|
||||
|
||||
@ -24,26 +24,80 @@ ms.collection:
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
## Behavioral blocking and containment overview
|
||||
## Overview
|
||||
|
||||
Not all cyberattacks involve a simple piece of malware that's found and removed. Some attacks, such as fileless attacks, are much more difficult to identify, let alone contain. Microsoft Defender ATP includes behavioral blocking and containment capabilities that can help identify and stop threats with machine learning, pre- and post-breach. In almost real time, when a suspicious behavior or artifact is detected and determined to be malicious, the threat is blocked. Pre-execution models learn about that threat, and prevent it from running on other endpoints.
|
||||
Today’s threat landscape is overrun by [fileless malware](https://docs.microsoft.com/windows/security/threat-protection/intelligence/fileless-threats) and that lives off the land, highly polymorphic threats that mutate faster than traditional solutions can keep up with, and human-operated attacks that adapt to what adversaries find on compromised machines. Traditional security solutions are not sufficient to stop such attacks; you need artificial intelligence (AI) and machine learning (ML) backed capabilities, such as behavioral blocking and containment, included in [Microsoft Defender ATP](https://docs.microsoft.com/windows/security).
|
||||
|
||||
## Behavioral blocking and containment capabilities
|
||||
Behavioral blocking and containment capabilities can help identify and stop threats, based on their behaviors and process trees even when the threat has started execution. Next-generation protection, EDR, and Microsoft Defender ATP components and features work together in behavioral blocking and containment capabilities.
|
||||
|
||||
Behavioral blocking and containment capabilities include the following:
|
||||
:::image type="content" source="images/mdatp-next-gen-EDR-behavblockcontain.png" alt-text="Behavioral blocking and containment":::
|
||||
|
||||
- **On-client, policy-driven [attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)**. Predefined common attack behaviors are prevented from executing, according to your attack surface reduction rules. When such behaviors attempt to execute, they can be seen in the Microsoft Defender Security Center (https://securitycenter.windows.com) as informational alerts. (Attack surface reduction rules are not enabled by default; you configure your policies in the Microsoft Defender Security Center.)
|
||||
Behavioral blocking and containment capabilities work with multiple components and features of Microsoft Defender ATP to stop attacks immediately and prevent attacks from progressing.
|
||||
|
||||
- **Client behavioral blocking**. Threats on endpoints are detected through machine learning, and then are blocked and remediated automatically. (Client behavioral blocking is enabled by default.)
|
||||
- [Next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) (which includes Microsoft Defender Antivirus) can detect threats by analyzing behaviors, and stop threats that have started running.
|
||||
|
||||
- **Feedback-loop blocking** (also referred to as rapid protection). Threat detections that are assumed to be false negatives are observed through behavioral intelligence. Threats are stopped and prevented from running on other endpoints. (Feedback-loop blocking is enabled by default.)
|
||||
- [Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) (EDR) receives security signals across your network, devices, and kernel behavior. As threats are detected, alerts are created. Multiple alerts of the same type are aggregated into incidents, which makes it easier for your security operations team to investigate and respond.
|
||||
|
||||
- **[Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md)**. Malicious artifacts or behaviors that are observed through post-breach protection are blocked and contained. EDR in block mode works even if Windows Defender Antivirus is not the primary antivirus solution. (EDR in block mode, currently in [limited private preview](edr-in-block-mode.md#can-i-participate-in-the-preview-of-edr-in-block-mode), is not enabled by default; you turn it on in the Microsoft Defender Security Center.)
|
||||
- [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) has a wide range of optics across identities, email, data, and apps, in addition to the network, endpoint, and kernel behavior signals received through EDR. A component of [Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection), Microsoft Defender ATP processes and correlates these signals, raises detection alerts, and connects related alerts in incidents.
|
||||
|
||||
As Microsoft continues to improve threat protection features and capabilities, you can expect more to come in the area of behavioral blocking and containment. Visit the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap) to see what's rolling out now and what's in development.
|
||||
With these capabilities, more threats can be prevented or blocked, even if they start running. Whenever suspicious behavior is detected, the threat is contained, alerts are created, and threats are stopped in their tracks.
|
||||
|
||||
The following image shows an example of an alert that was triggered by behavioral blocking and containment capabilities:
|
||||
|
||||
:::image type="content" source="images/blocked-behav-alert.png" alt-text="Example of an alert through behavioral blocking and containment":::
|
||||
|
||||
## Components of behavioral blocking and containment
|
||||
|
||||
- **On-client, policy-driven [attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction)** Predefined common attack behaviors are prevented from executing, according to your attack surface reduction rules. When such behaviors attempt to execute, they can be seen in the Microsoft Defender Security Center [https://securitycenter.windows.com](https://securitycenter.windows.com) as informational alerts. (Attack surface reduction rules are not enabled by default; you configure your policies in the Microsoft Defender Security Center.)
|
||||
|
||||
- **Client behavioral blocking** Threats on endpoints are detected through machine learning, and then are blocked and remediated automatically. (Client behavioral blocking is enabled by default.)
|
||||
|
||||
- **Feedback-loop blocking** (also referred to as rapid protection) Threat detections that are assumed to be false negatives are observed through behavioral intelligence. Threats are stopped and prevented from running on other endpoints. (Feedback-loop blocking is enabled by default.)
|
||||
|
||||
- **[Endpoint detection and response (EDR) in block mode](edr-in-block-mode.md)** Malicious artifacts or behaviors that are observed through post-breach protection are blocked and contained. EDR in block mode works even if Windows Defender Antivirus is not the primary antivirus solution. (EDR in block mode, currently in preview, is not enabled by default; you turn it on in the Microsoft Defender Security Center.)
|
||||
|
||||
Expect more to come in the area of behavioral blocking and containment, as Microsoft continues to improve threat protection features and capabilities. To see what's planned and rolling out now, visit the [Microsoft 365 roadmap](https://www.microsoft.com/microsoft-365/roadmap).
|
||||
|
||||
## Examples of behavioral blocking and containment in action
|
||||
|
||||
### Example 1: Credential theft attack against 100 organizations
|
||||
|
||||
As described in [In hot pursuit of elusive threats: AI-driven behavior-based blocking stops attacks in their tracks](https://www.microsoft.com/security/blog/2019/10/08/in-hot-pursuit-of-elusive-threats-ai-driven-behavior-based-blocking-stops-attacks-in-their-tracks), a credential theft attack against 100 organizations around the world was stopped by behavioral blocking and containment capabilities. Spear-phishing email messages that contained a lure document were sent to the targeted organizations. If a recipient opened the attachment, a related remote document was able to execute code on the user’s device and load Lokibot malware, which stole credentials, exfiltrated stolen data, and waited for further instructions from a command-and-control server.
|
||||
|
||||
Behavior-based machine learning models in Microsoft Defender ATP caught and stopped the attacker’s techniques at two points in the attack chain:
|
||||
- The first protection layer detected the exploit behavior. Machine learning classifiers in the cloud correctly identified the threat as and immediately instructed the client device to block the attack.
|
||||
- The second protection layer, which helped stop cases where the attack got past the first layer, detected process hollowing, stopped that process, and removed the corresponding files (such as Lokibot).
|
||||
|
||||
While the attack was detected and stopped, alerts, such as an "initial access alert," were triggered and appeared in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)):
|
||||
|
||||
:::image type="content" source="images/behavblockcontain-initialaccessalert.png" alt-text="Initial access alert in the Microsoft Defender Security Center":::
|
||||
|
||||
This example shows how behavior-based machine learning models in the cloud add new layers of protection against attacks, even after they have started running.
|
||||
|
||||
### Example 2: NTML relay - Juicy Potato malware variant
|
||||
|
||||
As described in the recent blog post, [Behavioral blocking and containment: Transforming optics into protection](https://www.microsoft.com/security/blog/2020/03/09/behavioral-blocking-and-containment-transforming-optics-into-protection), in January 2020, Microsoft Defender ATP detected a privilege escalation activity on a device in an organization. An alert called “Possible privilege escalation using NTLM relay” was triggered.
|
||||
|
||||
:::image type="content" source="images/NTLMalertjuicypotato.png" alt-text="NTLM alert for Juicy Potato malware":::
|
||||
|
||||
The threat turned out to be malware; it was a new, not-seen-before variant of a notorious hacking tool called Juicy Potato, which is used by attackers to get privilege escalation on a device.
|
||||
|
||||
Minutes after the alert was triggered, the file was analyzed, and confirmed to be malicious. Its process was stopped and blocked, as shown in the following image:
|
||||
|
||||
:::image type="content" source="images/Artifactblockedjuicypotato.png" alt-text="Artifact blocked":::
|
||||
|
||||
A few minutes after the artifact was blocked, multiple instances of the same file were blocked on the same device, preventing additional attackers or other malware from deploying on the device.
|
||||
|
||||
This example shows that with behavioral blocking and containment capabilities, threats are detected, contained, and blocked automatically.
|
||||
|
||||
## Next steps
|
||||
|
||||
- [Learn more about recent global threat activity](https://www.microsoft.com/wdsi/threats)
|
||||
|
||||
- [Learn more about Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response)
|
||||
|
||||
- [Configure your attack surface reduction rules](attack-surface-reduction.md)
|
||||
|
||||
- [Enable EDR in block mode](edr-in-block-mode.md)
|
||||
- [Enable EDR in block mode](edr-in-block-mode.md)
|
||||
|
||||
- [Get an overview of Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure attack surface reduction
|
||||
description: Configure attack surface reduction
|
||||
description: Use Microsoft Intune, Microsoft Endpoint Configuration Manager, Powershell cmdlets, and Group Policy to configure attack surface reduction.
|
||||
keywords: asr, attack surface reduction, windows defender, microsoft defender, antivirus, av
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -15,7 +15,6 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 07/01/2018
|
||||
---
|
||||
|
||||
# Configure attack surface reduction
|
||||
@ -27,11 +26,7 @@ You can configure attack surface reduction with a number of tools, including:
|
||||
* Group Policy
|
||||
* PowerShell cmdlets
|
||||
|
||||
The topics in this section describe how to configure attack surface reduction. Each topic includes instructions for the applicable configuration tool (or tools).
|
||||
|
||||
## In this section
|
||||
|
||||
Topic | Description
|
||||
Article | Description
|
||||
-|-
|
||||
[Enable hardware-based isolation for Microsoft Edge](../windows-defender-application-guard/install-wd-app-guard.md) | How to prepare for and install Application Guard, including hardware and software requirements
|
||||
[Enable application control](../windows-defender-application-control/windows-defender-application-control.md)|How to control applications run by users and protect kernel mode processes
|
||||
|
||||
@ -0,0 +1,55 @@
|
||||
---
|
||||
title: Configure automated investigation and remediation capabilities
|
||||
description: Set up your automated investigation and remediation capabilities in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
|
||||
keywords: configure, setup, automated, investigation, detection, alerts, remediation, response
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: deniseb
|
||||
author: denisebmsft
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Configure automated investigation and remediation capabilities in Microsoft Defender Advanced Threat Protection
|
||||
|
||||
**Applies to**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
If your organization is using [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/) (Microsoft Defender ATP), [automated investigation and remediation capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) can save your security operations team time and effort. As outlined in [this blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/enhance-your-soc-with-microsoft-defender-atp-automatic/ba-p/848946), these capabilities mimic the ideal steps that a security analyst takes to investigate and remediate threats. [Learn more about automated investigation and remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations).
|
||||
|
||||
To configure automated investigation and remediation, you [turn on the features](#turn-on-automated-investigation-and-remediation), and then you [set up device groups](#set-up-device-groups).
|
||||
|
||||
## Turn on automated investigation and remediation
|
||||
|
||||
1. As a global administrator or security administrator, go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in.
|
||||
2. In the navigation pane, choose **Settings**.
|
||||
3. In the **General** section, select **Advanced features**.
|
||||
4. Turn on both **Automated Investigation** and **Automatically resolve alerts**.
|
||||
|
||||
## Set up device groups
|
||||
|
||||
1. In the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)), on the **Settings** page, under **Permissions**, select **Device groups**.
|
||||
2. Select **+ Add machine group**.
|
||||
3. Create at least one device group, as follows:
|
||||
- Specify a name and description for the device group.
|
||||
- In the **Automation level list**, select a level, such as **Full – remediate threats automatically**. The automation level determines whether remediation actions are taken automatically, or only upon approval. To learn more, see [How threats are remediated](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations#how-threats-are-remediated).
|
||||
- In the **Members** section, use one or more conditions to identify and include devices.
|
||||
- On the **User access** tab, select the [Azure Active Directory groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-manage-groups?context=azure/active-directory/users-groups-roles/context/ugr-context) who should have access to the device group you're creating.
|
||||
4. Select **Done** when you're finished setting up your device group.
|
||||
|
||||
## Next steps
|
||||
|
||||
- [Visit the Action Center to view pending and completed remediation actions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center#the-action-center)
|
||||
|
||||
- [Review and approve actions following an automated investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation)
|
||||
|
||||
- [Manage indicators for files, IP addresses, URLs, or domains](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators)
|
||||
|
||||
@ -52,6 +52,9 @@ From the **Onboarding** card, select **Onboard more machines** to create and ass
|
||||
>[!TIP]
|
||||
>Alternatively, you can navigate to the Microsoft Defender ATP onboarding compliance page in the [Microsoft Azure portal](https://portal.azure.com/) from **All services > Intune > Device compliance > Microsoft Defender ATP**.
|
||||
|
||||
>[!NOTE]
|
||||
> If you want to view the most up-to-date device data, click on **List of devices without ATP sensor**.
|
||||
|
||||
From the device compliance page, create a configuration profile specifically for the deployment of the Microsoft Defender ATP sensor and assign that profile to the machines you want to onboard. To do this, you can either:
|
||||
|
||||
- Select **Create a device configuration profile to configure ATP sensor** to start with a predefined device configuration profile.
|
||||
|
||||
@ -111,7 +111,7 @@ If a proxy or firewall has HTTPS scanning (SSL inspection) enabled, exclude the
|
||||
|
||||
Service location | Microsoft.com DNS record
|
||||
-|-
|
||||
Common URLs for all locations | ```crl.microsoft.com```<br> ```ctldl.windowsupdate.com``` <br>```events.data.microsoft.com```<br>```notify.windows.com```<br> ```settings-win.data.microsoft.com```
|
||||
Common URLs for all locations | ```crl.microsoft.com/pki/crl/*```<br> ```ctldl.windowsupdate.com``` <br>```www.microsoft.com/pkiops/*```<br>```events.data.microsoft.com```<br>```notify.windows.com```<br> ```settings-win.data.microsoft.com```
|
||||
European Union | ```eu.vortex-win.data.microsoft.com``` <br> ```eu-v20.events.data.microsoft.com``` <br> ```usseu1northprod.blob.core.windows.net``` <br>```usseu1westprod.blob.core.windows.net``` <br> ```winatp-gw-neu.microsoft.com``` <br> ```winatp-gw-weu.microsoft.com``` <br>```wseu1northprod.blob.core.windows.net``` <br>```wseu1westprod.blob.core.windows.net``` <br>```automatedirstrprdweu.blob.core.windows.net``` <br>```automatedirstrprdneu.blob.core.windows.net```
|
||||
United Kingdom | ```uk.vortex-win.data.microsoft.com``` <br>```uk-v20.events.data.microsoft.com``` <br>```ussuk1southprod.blob.core.windows.net``` <br>```ussuk1westprod.blob.core.windows.net``` <br>```winatp-gw-uks.microsoft.com``` <br>```winatp-gw-ukw.microsoft.com``` <br>```wsuk1southprod.blob.core.windows.net``` <br>```wsuk1westprod.blob.core.windows.net``` <br>```automatedirstrprduks.blob.core.windows.net``` <br>```automatedirstrprdukw.blob.core.windows.net```
|
||||
United States | ```us.vortex-win.data.microsoft.com``` <br> ```ussus1eastprod.blob.core.windows.net``` <br> ```ussus1westprod.blob.core.windows.net``` <br> ```ussus2eastprod.blob.core.windows.net``` <br> ```ussus2westprod.blob.core.windows.net``` <br> ```ussus3eastprod.blob.core.windows.net``` <br> ```ussus3westprod.blob.core.windows.net``` <br> ```ussus4eastprod.blob.core.windows.net``` <br> ```ussus4westprod.blob.core.windows.net``` <br> ```us-v20.events.data.microsoft.com``` <br> ```winatp-gw-cus.microsoft.com``` <br> ```winatp-gw-eus.microsoft.com``` <br> ```wsus1eastprod.blob.core.windows.net``` <br> ```wsus1westprod.blob.core.windows.net``` <br> ```wsus2eastprod.blob.core.windows.net``` <br> ```wsus2westprod.blob.core.windows.net``` <br> ```automatedirstrprdcus.blob.core.windows.net``` <br> ```automatedirstrprdeus.blob.core.windows.net```
|
||||
|
||||
@ -13,7 +13,7 @@ ms.author: macapara
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
@ -24,8 +24,9 @@ ms.topic: article
|
||||
- Windows Server 2008 R2 SP1
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
- Windows Server, version 1803
|
||||
- Windows Server, 2019 and later
|
||||
- Windows Server (SAC) version 1803 and later
|
||||
- Windows Server 2019 and later
|
||||
- Windows Server 2019 core edition
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
@ -34,12 +35,12 @@ ms.topic: article
|
||||
Microsoft Defender ATP extends support to also include the Windows Server operating system. This support provides advanced attack detection and investigation capabilities seamlessly through the Microsoft Defender Security Center console.
|
||||
|
||||
The service supports the onboarding of the following servers:
|
||||
- Windows Server 2008 R2 SP1
|
||||
- Windows Server 2008 R2 SP1
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
- Windows Server, version 1803
|
||||
- Windows Server (SAC) version 1803 and later
|
||||
- Windows Server 2019 and later
|
||||
|
||||
- Windows Server 2019 core edition
|
||||
|
||||
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
|
||||
|
||||
@ -56,32 +57,36 @@ There are two options to onboard Windows Server 2008 R2 SP1, Windows Server 2012
|
||||
|
||||
|
||||
### Option 1: Onboard servers through Microsoft Defender Security Center
|
||||
You'll need to take the following steps if you choose to onboard servers through Microsoft Defender Security Center.
|
||||
You'll need to take the following steps if you choose to onboard servers through Microsoft Defender Security Center.
|
||||
|
||||
- For Windows Server 2008 R2 SP1, ensure that you fulfill the following requirements:
|
||||
- For Windows Server 2008 R2 SP1 or Windows Server 2012 R2, ensure that you install the following hotfix:
|
||||
- [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/en-us/help/3080149/update-for-customer-experience-and-diagnostic-telemetry)
|
||||
|
||||
- In addition, for Windows Server 2008 R2 SP1, ensure that you fulfill the following requirements:
|
||||
- Install the [February monthly update rollup](https://support.microsoft.com/en-us/help/4074598/windows-7-update-kb4074598)
|
||||
- Install the [Update for customer experience and diagnostic telemetry](https://support.microsoft.com/en-us/help/3080149/update-for-customer-experience-and-diagnostic-telemetry)
|
||||
- Install either [.NET framework 4.5](https://www.microsoft.com/download/details.aspx?id=30653) (or later) or [KB3154518](https://support.microsoft.com/help/3154518/support-for-tls-system-default-versions-included-in-the-net-framework)
|
||||
|
||||
- For Windows Server 2008 R2 SP1 and Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients.
|
||||
|
||||
- For Windows Server 2008 R2 SP1 and Windows Server 2012 R2: Configure and update System Center Endpoint Protection clients.
|
||||
> [!NOTE]
|
||||
> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2.
|
||||
|
||||
> [!NOTE]
|
||||
> This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2008 R2 SP1 and Windows Server 2012 R2.
|
||||
- Turn on server monitoring from Microsoft Defender Security Center.
|
||||
|
||||
- Turn on server monitoring from Microsoft Defender Security Center.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multihoming support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multihoming support.
|
||||
|
||||
Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
|
||||
|
||||
> [!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test.md).
|
||||
|
||||
### Configure and update System Center Endpoint Protection clients
|
||||
|
||||
Microsoft Defender ATP integrates with System Center Endpoint Protection. The integration provides visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
Microsoft Defender ATP integrates with System Center Endpoint Protection. The integration provides visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
|
||||
The following steps are required to enable this integration:
|
||||
- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie)
|
||||
|
||||
The following steps are required to enable this integration:
|
||||
- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie)
|
||||
- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting
|
||||
|
||||
|
||||
@ -90,19 +95,19 @@ The following steps are required to enable this integration:
|
||||
1. In the navigation pane, select **Settings** > **Machine management** > **Onboarding**.
|
||||
|
||||
2. Select Windows Server 2012 R2 and 2016 as the operating system.
|
||||
|
||||
|
||||
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment setup. When the setup completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
|
||||
<span id="server-mma"/>
|
||||
|
||||
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender ATP
|
||||
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender ATP
|
||||
|
||||
1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603).
|
||||
|
||||
2. Using the Workspace ID and Workspace key provided in the previous procedure, choose any of the following installation methods to install the agent on the server:
|
||||
- [Manually install the agent using setup](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-setup) <br>
|
||||
On the **Agent Setup Options** page, choose **Connect the agent to Azure Log Analytics (OMS)**.
|
||||
- [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script).
|
||||
- [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script).
|
||||
|
||||
3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](configure-proxy-internet.md).
|
||||
|
||||
@ -111,7 +116,7 @@ Once completed, you should see onboarded servers in the portal within an hour.
|
||||
<span id="server-proxy"/>
|
||||
|
||||
### Configure server proxy and Internet connectivity settings
|
||||
|
||||
|
||||
- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the <a href="https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway" data-raw-source="[OMS Gateway](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway)">OMS Gateway</a>.
|
||||
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that you [enable access to Microsoft Defender ATP service URLs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
||||
|
||||
@ -122,51 +127,50 @@ Once completed, you should see onboarded servers in the portal within an hour.
|
||||
|
||||
2. Select Windows Server 2008 R2 SP1, 2012 R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Onboard Servers in Azure Security Center**.
|
||||
3. Click **Onboard Servers in Azure Security Center**.
|
||||
|
||||
4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
|
||||
|
||||
|
||||
## Windows Server, version 1803 and Windows Server 2019
|
||||
To onboard Windows Server, version 1803 or Windows Server 2019, refer to the supported methods and versions below.
|
||||
## Windows Server (SAC) version 1803, Windows Server 2019, and Windows Server 2019 Core edition
|
||||
To onboard Windows Server (SAC) version 1803, Windows Server 2019, or Windows Server 2019 Core edition, refer to the supported methods and versions below.
|
||||
|
||||
> [!NOTE]
|
||||
> The Onboarding package for Windows Server 2019 through Microsoft Endpoint Configuration Manager currently ships a script. For more information on how to deploy scripts in Configuration Manager, see [Packages and programs in Configuration Manager](https://docs.microsoft.com/configmgr/apps/deploy-use/packages-and-programs).
|
||||
|
||||
Supported tools include:
|
||||
- Local script
|
||||
- Group Policy
|
||||
- Group Policy
|
||||
- Microsoft Endpoint Configuration Manager
|
||||
- System Center Configuration Manager 2012 / 2012 R2 1511 / 1602
|
||||
- VDI onboarding scripts for non-persistent machines
|
||||
|
||||
For more information, see [Onboard Windows 10 machines](configure-endpoints.md).
|
||||
|
||||
Support for Windows Server, provide deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
Support for Windows Server, provide deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
|
||||
1. Configure Microsoft Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints.md).
|
||||
1. Configure Microsoft Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints.md).
|
||||
|
||||
2. If you're running a third-party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings. Verify that it was configured correctly:
|
||||
|
||||
a. Set the following registry entry:
|
||||
1. Set the following registry entry:
|
||||
- Path: `HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection`
|
||||
- Name: ForceDefenderPassiveMode
|
||||
- Value: 1
|
||||
|
||||
b. Run the following PowerShell command to verify that the passive mode was configured:
|
||||
1. Run the following PowerShell command to verify that the passive mode was configured:
|
||||
|
||||
```PowerShell
|
||||
Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-Sense" ;ID=84}
|
||||
```
|
||||
```PowerShell
|
||||
Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-Sense" ;ID=84}
|
||||
```
|
||||
|
||||
c. Confirm that a recent event containing the passive mode event is found:
|
||||
|
||||
|
||||
1. Confirm that a recent event containing the passive mode event is found:
|
||||
|
||||
|
||||
|
||||
3. Run the following command to check if Windows Defender AV is installed:
|
||||
|
||||
```sc query Windefend```
|
||||
```sc.exe query Windefend```
|
||||
|
||||
If the result is 'The specified service does not exist as an installed service', then you'll need to install Windows Defender AV. For more information, see [Windows Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10).
|
||||
|
||||
@ -184,13 +188,13 @@ The following capabilities are included in this integration:
|
||||
- Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach
|
||||
|
||||
> [!IMPORTANT]
|
||||
> - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default.
|
||||
> - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default.
|
||||
> - If you use Microsoft Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
|
||||
> - When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created and the Microsoft Defender ATP data is stored in Europe by default. If you need to move your data to another location, you need to contact Microsoft Support to reset the tenant. Server endpoint monitoring utilizing this integration has been disabled for Office 365 GCC customers.
|
||||
|
||||
|
||||
|
||||
## Offboard servers
|
||||
You can offboard Windows Server, version 1803 and Windows 2019 in the same method available for Windows 10 client machines.
|
||||
## Offboard servers
|
||||
You can offboard Windows Server (SAC), Windows Server 2019, and Windows Server 2019 Core edition in the same method available for Windows 10 client machines.
|
||||
|
||||
For other server versions, you have two options to offboard servers from the service:
|
||||
- Uninstall the MMA agent
|
||||
@ -206,10 +210,10 @@ For more information, see [To disable an agent](https://docs.microsoft.com/azure
|
||||
### Remove the Microsoft Defender ATP workspace configuration
|
||||
To offboard the server, you can use either of the following methods:
|
||||
|
||||
- Remove the Microsoft Defender ATP workspace configuration from the MMA agent
|
||||
- Remove the Microsoft Defender ATP workspace configuration from the MMA agent
|
||||
- Run a PowerShell command to remove the configuration
|
||||
|
||||
#### Remove the Microsoft Defender ATP workspace configuration from the MMA agent
|
||||
#### Remove the Microsoft Defender ATP workspace configuration from the MMA agent
|
||||
|
||||
1. In the **Microsoft Monitoring Agent Properties**, select the **Azure Log Analytics (OMS)** tab.
|
||||
|
||||
@ -220,11 +224,12 @@ To offboard the server, you can use either of the following methods:
|
||||
#### Run a PowerShell command to remove the configuration
|
||||
|
||||
1. Get your Workspace ID:
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
b. Select **Windows Server 2012 R2 and 2016** as the operating system and get your Workspace ID:
|
||||
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
1. Select **Windows Server 2012 R2 and 2016** as the operating system and get your Workspace ID:
|
||||
|
||||
|
||||
|
||||
2. Open an elevated PowerShell and run the following command. Use the Workspace ID you obtained and replacing `WorkspaceID`:
|
||||
|
||||
|
||||
@ -54,8 +54,10 @@ You'll need to configure Splunk so that it can pull Microsoft Defender ATP detec
|
||||
|
||||
3. Select **Windows Defender ATP alerts** under **Local inputs**.
|
||||
|
||||
NOTE:
|
||||
This input will only appear after you install the [Windows Defender ATP Modular Inputs TA](https://splunkbase.splunk.com/app/4128/).
|
||||
>[!NOTE]
|
||||
> - This input will only appear after you install the [Windows Defender ATP Modular Inputs TA](https://splunkbase.splunk.com/app/4128/).
|
||||
> - For Splunk Cloud, use [Microsoft Defender ATP Add-on for Splunk](https://splunkbase.splunk.com/app/4959/).
|
||||
|
||||
|
||||
4. Click **New**.
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Connected applications in Microsoft Defender ATP
|
||||
ms.reviewer:
|
||||
description: View connected partner applications to Microsoft Defender ATP
|
||||
description: View connected partner applications that use standard OAuth 2.0 protocol to authenticate and provide tokens for use with Microsoft Defender ATP APIs.
|
||||
keywords: partners, applications, third-party, connections, sentinelone, lookout, bitdefender, corrata, morphisec, paloalto, ziften, better mobile
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
|
||||
@ -12,7 +12,7 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: levinec
|
||||
ms.author: ellevin
|
||||
ms.date: 05/13/2019
|
||||
ms.date: 05/20/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -26,11 +26,16 @@ manager: dansimp
|
||||
> [!IMPORTANT]
|
||||
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
Attack surface reduction rules help prevent software behaviors that are often abused to compromise your device or network. For example, an attacker might try to run an unsigned script off of a USB drive, or have a macro in an Office document make calls directly to the Win32 API. Attack surface reduction rules can constrain these kinds of risky behaviors and improve your organization's defensive posture.
|
||||
[Attack surface reduction rules](enable-attack-surface-reduction.md) help prevent software behaviors that are often abused to compromise your device or network. For example, an attacker might try to run an unsigned script off of a USB drive, or have a macro in an Office document make calls directly to the Win32 API. Attack surface reduction rules can constrain these kinds of risky behaviors and improve your organization's defensive posture.
|
||||
|
||||
Learn how to customize attack surface reduction rules by [excluding files and folders](#exclude-files-and-folders) or [adding custom text to the notification](#customize-the-notification) alert that appears on a user's computer.
|
||||
|
||||
Attack surface reduction rules are supported on Windows 10, versions 1709 and 1803 or later, Windows Server, version 1803 (Semi-Annual Channel) or later, and Windows Server 2019. You can use Group Policy, PowerShell, and MDM CSPs to configure these settings.
|
||||
You can set attack surface reduction rules for devices running any of the following editions and versions of Windows:
|
||||
- Windows 10 Pro, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows 10 Enterprise, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows Server, [version 1803 (Semi-Annual Channel)](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) or later
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
You can use Group Policy, PowerShell, and MDM CSPs to configure these settings.
|
||||
|
||||
## Exclude files and folders
|
||||
|
||||
@ -72,7 +77,7 @@ See the [attack surface reduction](attack-surface-reduction.md) topic for detail
|
||||
|
||||
2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
||||
|
||||
3. Expand the tree to **Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack surface reduction**.
|
||||
3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Attack surface reduction**.
|
||||
|
||||
4. Double-click the **Exclude files and paths from Attack surface reduction Rules** setting and set the option to **Enabled**. Click **Show** and enter each file or folder in the **Value name** column. Enter **0** in the **Value** column for each item.
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ ms.collection:
|
||||
When [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response) (EDR) in block mode is enabled, Microsoft Defender ATP leverages behavioral blocking and containment capabilities by blocking malicious artifacts or behaviors that are observed through post-breach protection. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach.
|
||||
|
||||
> [!NOTE]
|
||||
> EDR in block mode is currently in **[limited private preview](#can-i-participate-in-the-preview-of-edr-in-block-mode)**. To get the best protection, make sure to **[deploy Microsoft Defender ATP baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline)**.
|
||||
> EDR in block mode is currently in preview. To get the best protection, make sure to **[deploy Microsoft Defender ATP baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline)**.
|
||||
|
||||
## What happens when something is detected?
|
||||
|
||||
@ -83,10 +83,6 @@ Because Windows Defender Antivirus detects and remediates malicious items, it's
|
||||
|
||||
Cloud protection is needed to turn on the feature on the device. Cloud protection allows [Microsoft Defender ATP](https://docs.microsoft.com/windows/security/threat-protection) to deliver the latest and greatest protection based on our breadth and depth of security intelligence, along with behavioral and machine learning models.
|
||||
|
||||
### Can I participate in the preview of EDR in block mode?
|
||||
|
||||
EDR in block mode is currently in limited private preview. If you would like to participate in this private preview program, send email to `shwjha@microsoft.com`.
|
||||
|
||||
## Related articles
|
||||
|
||||
[Behavioral blocking and containment](behavioral-blocking-containment.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Enable ASR rules individually to protect your organization
|
||||
title: Enable attack surface reduction rules individually to protect your organization
|
||||
description: Enable attack surface reduction (ASR) rules to protect your devices from attacks that use macros, scripts, and common injection techniques.
|
||||
keywords: Attack surface reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, enable, turn on
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -12,22 +12,29 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: levinec
|
||||
ms.author: ellevin
|
||||
ms.date: 05/13/2019
|
||||
ms.date: 05/20/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
|
||||
# Enable attack surface reduction rules
|
||||
|
||||
[Attack surface reduction rules](attack-surface-reduction.md) help prevent actions that malware often abuse to compromise devices and networks. You can set attack surface reduction rules for computers running Windows 10, versions 1709 and 1803 or later, Windows Server, version 1803 (Semi-Annual Channel) or later, and Windows Server 2019.
|
||||
[Attack surface reduction rules](attack-surface-reduction.md) help prevent actions that malware often abuses to compromise devices and networks. You can set attack surface reduction rules for devices running any of the following editions and versions of Windows:
|
||||
- Windows 10 Pro, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows 10 Enterprise, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows Server, [version 1803 (Semi-Annual Channel)](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) or later
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
|
||||
Each ASR rule contains three settings:
|
||||
Each ASR rule contains one of three settings:
|
||||
|
||||
* Not configured: Disable the ASR rule
|
||||
* Block: Enable the ASR rule
|
||||
* Audit: Evaluate how the ASR rule would impact your organization if enabled
|
||||
|
||||
To use ASR rules, you need either a Windows 10 Enterprise E3 or E5 license. We recommend an E5 license so you can take advantage of the advanced monitoring and reporting capabilities available in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP). These advanced capabilities aren't available with an E3 license, but you can develop your own monitoring and reporting tools to use in conjunction with ASR rules.
|
||||
To use ASR rules, you need either a Windows 10 Enterprise E3 or E5 license. We recommend an E5 license so you can take advantage of the advanced monitoring and reporting capabilities available in [Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection) (Microsoft Defender ATP). These advanced capabilities aren't available with an E3 license, but you can develop your own monitoring and reporting tools to use in conjunction with ASR rules.
|
||||
|
||||
> [!TIP]
|
||||
> To learn more about Windows licensing, see [Windows 10 Licensing](https://www.microsoft.com/licensing/product-licensing/windows10?activetab=windows10-pivot:primaryr5) and get the [Volume Licensing guide for Windows 10](https://download.microsoft.com/download/2/D/1/2D14FE17-66C2-4D4C-AF73-E122930B60F6/Windows-10-Volume-Licensing-Guide.pdf).
|
||||
|
||||
You can enable attack surface reduction rules by using any of these methods:
|
||||
|
||||
@ -43,16 +50,10 @@ Enterprise-level management such as Intune or Microsoft Endpoint Configuration M
|
||||
|
||||
You can exclude files and folders from being evaluated by most attack surface reduction rules. This means that even if an ASR rule determines the file or folder contains malicious behavior, it will not block the file from running. This could potentially allow unsafe files to run and infect your devices.
|
||||
|
||||
> [!WARNING]
|
||||
> [!IMPORTANT]
|
||||
> Excluding files or folders can severely reduce the protection provided by ASR rules. Excluded files will be allowed to run, and no report or event will be recorded.
|
||||
>
|
||||
> If ASR rules are detecting files that you believe shouldn't be detected, you should [use audit mode first to test the rule](evaluate-attack-surface-reduction.md).
|
||||
|
||||
> [!IMPORTANT]
|
||||
> File and folder exclusions do not apply to the following ASR rules:
|
||||
>
|
||||
> * Block process creations originating from PSExec and WMI commands
|
||||
> * Block JavaScript or VBScript from launching downloaded executable content
|
||||
|
||||
You can specify individual files or folders (using folder paths or fully qualified resource names), but you can't specify which rules the exclusions apply to. An exclusion is applied only when the excluded application or service starts. For example, if you add an exclusion for an update service that is already running, the update service will continue to trigger events until the service is stopped and restarted.
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: levinec
|
||||
ms.author: ellevin
|
||||
ms.date: 04/02/2019
|
||||
ms.date: 05/20/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -23,7 +23,11 @@ manager: dansimp
|
||||
|
||||
* [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Attack surface reduction rules help prevent actions that are typically used by malware to compromise devices or networks. Attack surface reduction rules are supported on Windows 10, versions 1709 and 1803 or later, Windows Server, version 1803 (Semi-Annual Channel) or later, and Windows Server 2019.
|
||||
Attack surface reduction rules help prevent actions that are typically used by malware to compromise devices or networks. You can set attack surface reduction rules for devices running any of the following editions and versions of Windows:
|
||||
- Windows 10 Pro, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows 10 Enterprise, [version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) or later
|
||||
- Windows Server, [version 1803 (Semi-Annual Channel)](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1803) or later
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
|
||||
Learn how to evaluate attack surface reduction rules, by enabling audit mode to test the feature directly in your organization.
|
||||
|
||||
|
||||
@ -23,36 +23,47 @@ ms.topic: article
|
||||
|
||||
Conducting a comprehensive security product evaluation can be a complex process requiring cumbersome environment and machine configuration before an end-to-end attack simulation can actually be done. Adding to the complexity is the challenge of tracking where the simulation activities, alerts, and results are reflected during the evaluation.
|
||||
|
||||
The Microsoft Defender ATP evaluation lab is designed to eliminate the complexities of machine and environment configuration so that you can focus on evaluating the capabilities of the platform, running simulations, and seeing the prevention, detection, and remediation features in action.
|
||||
The Microsoft Defender ATP evaluation lab is designed to eliminate the complexities of machine and environment configuration so that you can focus on evaluating the capabilities of the platform, running simulations, and seeing the prevention, detection, and remediation features in action.
|
||||
|
||||
When you get started with the lab, you'll be guided through a simple set-up process where you can specify the type of configuration that best suits your needs.
|
||||
|
||||
After the lab setup process is complete, you can add Windows 10 or Windows Server 2019 machines. These test machines come pre-configured to have the latest and greatest OS versions with the right security components in place and Office 2019 Standard installed.
|
||||
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUM]
|
||||
|
||||
With the simplified set-up experience, you can focus on running your own test scenarios and the pre-made simulations to see how Microsoft Defender ATP performs.
|
||||
|
||||
You'll have full access to all the powerful capabilities of the platform such as automated investigations, advanced hunting, and threat analytics, allowing you to test the comprehensive protection stack that Microsoft Defender ATP offers.
|
||||
You'll have full access to the powerful capabilities of the platform such as automated investigations, advanced hunting, and threat analytics, allowing you to test the comprehensive protection stack that Microsoft Defender ATP offers.
|
||||
|
||||
You can add Windows 10 or Windows Server 2019 machines that come pre-configured to have the latest OS versions and the right security components in place as well as Office 2019 Standard installed.
|
||||
|
||||
You can also install threat simulators. Microsoft Defender ATP has partnered with industry leading threat simulation platforms to help you test out the Microsoft Defender ATP capabilities without having to leave the portal.
|
||||
|
||||
Install your preferred simulator, run scenarios within the evaluation lab, and instantly see how the platform performs - all conveniently available at no extra cost to you. You'll also have convenient access to wide array of simulations which you can access and run from the simulations catalog.
|
||||
|
||||
|
||||
## Before you begin
|
||||
You'll need to fulfill the [licensing requirements](minimum-requirements.md#licensing-requirements) or have trial access to Microsoft Defender ATP to access the evaluation lab.
|
||||
|
||||
You must have **Manage security settings** permissions to:
|
||||
- Create the lab
|
||||
- Create machines
|
||||
- Reset password
|
||||
- Create simulations
|
||||
|
||||
For more information, see [Create and manage roles](user-roles.md).
|
||||
|
||||
Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-main-abovefoldlink)
|
||||
|
||||
|
||||
## Get started with the lab
|
||||
You can access the lab from the menu. In the navigation menu, select **Evaluation and tutorials > Evaluation lab**.
|
||||
|
||||
|
||||
|
||||
When you access the evaluation lab for the first time, you'll find an introduction page with a link to the evaluation guide. The guide contains tips and recommendations to keep in mind when evaluating an advanced threat protection product.
|
||||
|
||||
It's a good idea to read the guide before starting the evaluation process so that you can conduct a thorough assessment of the platform.
|
||||
|
||||
>[!NOTE]
|
||||
>- Each environment is provisioned with a limited set of test machines.
|
||||
>- Depending the type of environment structure you select, machines will be available for the specified number of hours from the day of activation.
|
||||
>- When you've used up the provisioned machines, no new machines are provided. A deleted machine does not refresh the available test machine count.
|
||||
>- Given the limited resources, it’s advisable to use the machines carefully.
|
||||
|
||||
Already have a lab? Make sure to enable the new threat simulators and have active machines.
|
||||
|
||||
## Setup the evaluation lab
|
||||
|
||||
@ -60,17 +71,37 @@ It's a good idea to read the guide before starting the evaluation process so tha
|
||||
|
||||
|
||||
|
||||
2. Depending on your evaluation needs, you can choose to setup an environment with fewer machines for a longer period or more machines for a shorter period. Select your preferred lab configuration then select **Create lab**.
|
||||
2. Depending on your evaluation needs, you can choose to setup an environment with fewer machines for a longer period or more machines for a shorter period. Select your preferred lab configuration then select **Next**.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
3. (Optional) You can choose to install threat simulators in the lab.
|
||||
|
||||
|
||||
|
||||
>[!IMPORTANT]
|
||||
>You'll first need to accept and provide consent to the terms and information sharing statements.
|
||||
|
||||
4. Select the threat simulation agent you'd like to use and enter your details. You can also choose to install threat simulators at a later time. If you choose to install threat simulation agents during the lab setup, you'll enjoy the benefit of having them conveniently installed on the machines you add.
|
||||
|
||||
|
||||
|
||||
5. Review the summary and select **Setup lab**.
|
||||
|
||||
After the lab setup process is complete, you can add machines and run simulations.
|
||||
|
||||
When the environment completes the setup process, you're ready to add machines.
|
||||
|
||||
## Add machines
|
||||
When you add a machine to your environment, Microsoft Defender ATP sets up a well-configured machine with connection details. You can add Windows 10 or Windows Server 2019 machines.
|
||||
|
||||
The machine will be configured with the most up-to-date version of the OS and Office 2019 Standard as well as other apps such as Java, Python, and SysIntenals.
|
||||
|
||||
>[!TIP]
|
||||
> Need more machines in your lab? Submit a support ticket to have your request reviewed by the Microsoft Defender ATP team.
|
||||
|
||||
If you chose to add a threat simulator during the lab setup, all machines will have the threat simulator agent installed in the machines that you add.
|
||||
|
||||
The machine will automatically be onboarded to your tenant with the recommended Windows security components turned on and in audit mode - with no effort on your side.
|
||||
|
||||
The following security components are pre-configured in the test machines:
|
||||
@ -94,9 +125,6 @@ Automated investigation settings will be dependent on tenant settings. It will b
|
||||
|
||||
1. From the dashboard, select **Add machine**.
|
||||
|
||||
|
||||
|
||||
|
||||
2. Choose the type of machine to add. You can choose to add Windows 10 or Windows Server 2019.
|
||||
|
||||
|
||||
@ -114,20 +142,31 @@ Automated investigation settings will be dependent on tenant settings. It will b
|
||||
|
||||
4. Machine set up begins. This can take up to approximately 30 minutes.
|
||||
|
||||
The environment will reflect your test machine status through the evaluation - including risk score, exposure score, and alerts created through the simulation.
|
||||
5. See the status of test machines, the risk and exposure levels, and the status of simulator installations by selecting the **Machines** tab.
|
||||
|
||||
|
||||
|
||||
|
||||
>[!TIP]
|
||||
>In the **Simulator status** column, you can hover over the information icon to know the installation status of an agent.
|
||||
|
||||
|
||||
|
||||
|
||||
## Simulate attack scenarios
|
||||
Use the test machines to run attack simulations by connecting to them.
|
||||
Use the test machines to run your own attack simulations by connecting to them.
|
||||
|
||||
If you are looking for a pre-made simulation, you can use our ["Do It Yourself" attack scenarios](https://securitycenter.windows.com/tutorials). These scripts are safe, documented, and easy to use. These scenarios will reflect Microsoft Defender ATP capabilities and walk you through investigation experience.
|
||||
You can simulate attack scenarios using:
|
||||
- The ["Do It Yourself" attack scenarios](https://securitycenter.windows.com/tutorials)
|
||||
- Threat simulators
|
||||
|
||||
You can also use [Advanced hunting](advanced-hunting-query-language.md) to query data and [Threat analytics](threat-analytics.md) to view reports about emerging threats.
|
||||
|
||||
> [!NOTE]
|
||||
> The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections.
|
||||
### Do-it-yourself attack scenarios
|
||||
If you are looking for a pre-made simulation, you can use our ["Do It Yourself" attack scenarios](https://securitycenter.windows.com/tutorials). These scripts are safe, documented, and easy to use. These scenarios will reflect Microsoft Defender ATP capabilities and walk you through investigation experience.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>The connection to the test machines is done using RDP. Make sure that your firewall settings allow RDP connections.
|
||||
|
||||
1. Connect to your machine and run an attack simulation by selecting **Connect**.
|
||||
|
||||
@ -146,20 +185,70 @@ You can also use [Advanced hunting](advanced-hunting-query-language.md) to query
|
||||
|
||||
|
||||
|
||||
4. Run simulations on the machine.
|
||||
4. Run Do-it-yourself attack simulations on the machine.
|
||||
|
||||
|
||||
### Threat simulator scenarios
|
||||
If you chose to install any of the supported threat simulators during the lab setup, you can run the built-in simulations on the evaluation lab machines.
|
||||
|
||||
|
||||
Running threat simulations using third-party platforms is a good way to evaluate Microsoft Defender ATP capabilities within the confines of a lab environment.
|
||||
|
||||
>[!NOTE]
|
||||
>Before you can run simulations, ensure the following requirements are met:
|
||||
>- Machines must be added to the evaluation lab
|
||||
>- Threat simulators must be installed in the evaluation lab
|
||||
|
||||
1. From the portal select **Create simulation**.
|
||||
|
||||
2. Select a threat simulator.
|
||||
|
||||
|
||||
|
||||
3. Choose a simulation or look through the simulation gallery to browse through the available simulations.
|
||||
|
||||
You can get to the simulation gallery from:
|
||||
- The main evaluation dashboard in the **Simulations overview** tile or
|
||||
- By navigating from the navigation pane **Evaluation and tutorials** > **Simulation & tutorials**, then select **Simulations catalog**.
|
||||
|
||||
4. Select the devices where you'd like to run the simulation on.
|
||||
|
||||
5. Select **Create simulation**.
|
||||
|
||||
6. View the progress of a simulation by selecting the **Simulations** tab. View the simulation state, active alerts, and other details.
|
||||
|
||||
|
||||
|
||||
After running your simulations, we encourage you to walk through the lab progress bar and explore Microsoft Defender ATP features. See if the attack simulations you ran triggered an automated investigation and remediation, check out the evidence collected and analyzed by the feature.
|
||||
|
||||
After running your simulations, we encourage you to walk through the lab progress bar and explore Microsoft Defender ATP features. See if your attacks triggered an automated investigation and remediation, check out the evidence collected and analyzed by the feature.
|
||||
|
||||
|
||||
Hunt for attack evidence through advanced hunting by using the rich query language and raw telemetry and check out some world-wide threats documented in Threat analytics.
|
||||
|
||||
|
||||
## Simulation results
|
||||
Get a full overview of the simulation results, all in one place, allowing you to drill down to the relevant pages with every detail you need.
|
||||
## Simulation gallery
|
||||
Microsoft Defender ATP has partnered with various threat simulation platforms to give you convenient access to test the capabilities of the platform right from the within the portal.
|
||||
|
||||
View the machine details page by selecting the machine from the table. You'll be able to drill down on relevant alerts and investigations by exploring the rich context provided on the attack simulation.
|
||||
View all the available simulations by going to **Simulations and tutorials** > **Simulations catalog** from the menu.
|
||||
|
||||
### Evaluation report
|
||||
|
||||
A list of supported third-party threat simulation agents are listed, and specific types of simulations along with detailed descriptions are provided on the catalog.
|
||||
|
||||
You can conveniently run any available simulation right from the catalog.
|
||||
|
||||
|
||||
|
||||
|
||||
Each simulation comes with an in-depth description of the attack scenario and references such as the MITRE attack techniques used and sample Advanced hunting queries you run.
|
||||
|
||||
**Examples:**
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
## Evaluation report
|
||||
The lab reports summarize the results of the simulations conducted on the machines.
|
||||
|
||||
|
||||
@ -172,6 +261,7 @@ At a glance, you'll quickly be able to see:
|
||||
- Detection sources
|
||||
- Automated investigations
|
||||
|
||||
|
||||
## Provide feedback
|
||||
Your feedback helps us get better in protecting your environment from advanced attacks. Share your experience and impressions from product capabilities and evaluation results.
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: OData queries with Microsoft Defender ATP
|
||||
ms.reviewer:
|
||||
description: OData queries with Microsoft Defender ATP
|
||||
description: Use these examples of Open Data Protocol (OData) queries to help with data access protocols in Microsoft Defender ATP
|
||||
keywords: apis, supported apis, odata, query
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -35,7 +35,7 @@ Not all properties are filterable.
|
||||
|
||||
### Example 1
|
||||
|
||||
- Get all the machines with the tag 'ExampleTag'
|
||||
Get all the machines with the tag 'ExampleTag'
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=machineTags/any(tag: tag eq 'ExampleTag')
|
||||
@ -76,7 +76,7 @@ Content-type: application/json
|
||||
|
||||
### Example 2
|
||||
|
||||
- Get all the alerts that created after 2018-10-20 00:00:00
|
||||
Get all the alerts that created after 2018-10-20 00:00:00
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/alerts?$filter=alertCreationTime+gt+2018-11-22T00:00:00Z
|
||||
@ -126,7 +126,7 @@ Content-type: application/json
|
||||
|
||||
### Example 3
|
||||
|
||||
- Get all the machines with 'High' 'RiskScore'
|
||||
Get all the machines with 'High' 'RiskScore'
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=riskScore+eq+'High'
|
||||
@ -167,7 +167,7 @@ Content-type: application/json
|
||||
|
||||
### Example 4
|
||||
|
||||
- Get top 100 machines with 'HealthStatus' not equals to 'Active'
|
||||
Get top 100 machines with 'HealthStatus' not equals to 'Active'
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=healthStatus+ne+'Active'&$top=100
|
||||
@ -208,7 +208,7 @@ Content-type: application/json
|
||||
|
||||
### Example 5
|
||||
|
||||
- Get all the machines that last seen after 2018-10-20
|
||||
Get all the machines that last seen after 2018-10-20
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machines?$filter=lastSeen gt 2018-08-01Z
|
||||
@ -249,7 +249,7 @@ Content-type: application/json
|
||||
|
||||
### Example 6
|
||||
|
||||
- Get all the Anti-Virus scans that the user Analyst@examples.onmicrosoft.com created using Microsoft Defender ATP
|
||||
Get all the Anti-Virus scans that the user Analyst@examples.onmicrosoft.com created using Microsoft Defender ATP
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machineactions?$filter=requestor eq 'Analyst@contoso.com' and type eq 'RunAntiVirusScan'
|
||||
@ -283,7 +283,7 @@ Content-type: application/json
|
||||
|
||||
### Example 7
|
||||
|
||||
- Get the count of open alerts for a specific machine:
|
||||
Get the count of open alerts for a specific machine:
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machines/123321d0c675eaa415b8e5f383c6388bff446c62/alerts/$count?$filter=status ne 'Resolved'
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get alert related domains information
|
||||
description: Retrieves all domains related to a specific alert.
|
||||
description: Retrieve all domains related to a specific alert using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
|
||||
keywords: apis, graph api, supported apis, get alert information, alert information, related domain
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get alert related files information
|
||||
description: Retrieves all files related to a specific alert.
|
||||
description: Retrieve all files related to a specific alert using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
|
||||
keywords: apis, graph api, supported apis, get alert information, alert information, related files
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -97,7 +97,7 @@ Content-type: application/json
|
||||
"fileType": null,
|
||||
"isPeFile": true,
|
||||
"filePublisher": "Microsoft Corporation",
|
||||
"fileProductName": "Microsoft<66> Windows<77> Operating System",
|
||||
"fileProductName": "Microsoft<66> Windows<77> Operating System",
|
||||
"signer": "Microsoft Corporation",
|
||||
"issuer": "Microsoft Code Signing PCA",
|
||||
"signerHash": "9dc17888b5cfad98b3cb35c1994e96227f061675",
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get alert related IPs information
|
||||
description: Retrieves all IPs related to a specific alert.
|
||||
description: Retrieve all IPs related to a specific alert using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
|
||||
keywords: apis, graph api, supported apis, get alert information, alert information, related ip
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get alert related machine information
|
||||
description: Retrieves all machines related to a specific alert.
|
||||
description: Retrieve all machines related to a specific alert using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
|
||||
keywords: apis, graph api, supported apis, get alert information, alert information, related machine
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get IP related alerts API
|
||||
description: Retrieves a collection of alerts related to a given IP address.
|
||||
description: Retrieve a collection of alerts related to a given IP address using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
|
||||
keywords: apis, graph api, supported apis, get, ip, related, alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get IP statistics API
|
||||
description: Retrieves the prevalence for the given IP.
|
||||
description: Get the latest stats for your IP using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
|
||||
keywords: apis, graph api, supported apis, get, ip, statistics, prevalence
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get KB collection API
|
||||
description: Retrieves a collection of KB's.
|
||||
description: Retrieve a collection of knowledge bases (KB's) and KB details with Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
|
||||
keywords: apis, graph api, supported apis, get, kb
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get machine log on users API
|
||||
description: Retrieves a collection of logged on users.
|
||||
description: Retrieve a collection of logged on users on a specific machine using Microsoft Defender ATP APIs.
|
||||
keywords: apis, graph api, supported apis, get, machine, log on, users
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -73,7 +73,7 @@ Here is an example of the request.
|
||||
[!include[Improve request performance](../../includes/improve-request-performance.md)]
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.windows.com/api/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/logonusers
|
||||
GET https://api.securitycenter.windows.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/logonusers
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: List machineActions API
|
||||
description: Use this API to create calls related to get machineactions collection
|
||||
description: Use the Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) API to create calls related to get machineactions collection.
|
||||
keywords: apis, graph api, supported apis, machineaction collection
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get machines security states collection API
|
||||
description: Retrieves a collection of machines security states.
|
||||
description: Retrieve a collection of machine security states using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP.
|
||||
keywords: apis, graph api, supported apis, get, machine, security, state
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get user related alerts API
|
||||
description: Retrieves a collection of alerts related to a given user ID.
|
||||
description: Retrieve a collection of alerts related to a given user ID using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
|
||||
keywords: apis, graph api, supported apis, get, user, related, alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 47 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 43 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 49 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 100 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 138 KiB After Width: | Height: | Size: 100 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 173 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 44 KiB After Width: | Height: | Size: 135 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 70 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 291 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 55 KiB After Width: | Height: | Size: 58 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 56 KiB After Width: | Height: | Size: 54 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 38 KiB After Width: | Height: | Size: 31 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 55 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 47 KiB After Width: | Height: | Size: 113 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 204 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 169 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 105 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 279 KiB |
@ -213,6 +213,8 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
```bash
|
||||
unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
Archive: WindowsDefenderATPOnboardingPackage.zip
|
||||
inflating: MicrosoftDefenderATPOnboardingLinuxServer.py
|
||||
```
|
||||
|
||||
`Archive: WindowsDefenderATPOnboardingPackage.zip`
|
||||
@ -220,7 +222,7 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
## Client configuration
|
||||
|
||||
1. Copy WindowsDefenderATPOnboarding.py to the target machine.
|
||||
1. Copy MicrosoftDefenderATPOnboardingLinuxServer.py to the target machine.
|
||||
|
||||
Initially the client machine is not associated with an organization. Note that the *orgId* attribute is blank:
|
||||
|
||||
@ -228,10 +230,10 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
mdatp --health orgId
|
||||
```
|
||||
|
||||
2. Run WindowsDefenderATPOnboarding.py, and note that, in order to run this command, you must have `python` installed on the device:
|
||||
2. Run MicrosoftDefenderATPOnboardingLinuxServer.py, and note that, in order to run this command, you must have `python` installed on the device:
|
||||
|
||||
```bash
|
||||
sudo python WindowsDefenderATPOnboarding.py
|
||||
python MicrosoftDefenderATPOnboardingLinuxServer.py
|
||||
```
|
||||
|
||||
3. Verify that the machine is now associated with your organization and reports a valid organization identifier:
|
||||
@ -274,6 +276,10 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
See [Log installation issues](linux-resources.md#log-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs.
|
||||
|
||||
## Operating system upgrades
|
||||
|
||||
When upgrading your operating system to a new major version, you must first uninstall Microsoft Defender ATP for Linux, install the upgrade, and finally reconfigure Microsoft Defender ATP for Linux on your device.
|
||||
|
||||
## Uninstallation
|
||||
|
||||
See [Uninstall](linux-resources.md#uninstall) for details on how to remove Microsoft Defender ATP for Linux from client devices.
|
||||
See [Uninstall](linux-resources.md#uninstall) for details on how to remove Microsoft Defender ATP for Linux from client devices.
|
||||
@ -255,6 +255,10 @@ Now run the tasks files under `/etc/ansible/playbooks/`.
|
||||
|
||||
See [Log installation issues](linux-resources.md#log-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs.
|
||||
|
||||
## Operating system upgrades
|
||||
|
||||
When upgrading your operating system to a new major version, you must first uninstall Microsoft Defender ATP for Linux, install the upgrade, and finally reconfigure Microsoft Defender ATP for Linux on your device.
|
||||
|
||||
## References
|
||||
|
||||
- [Add or remove YUM repositories](https://docs.ansible.com/ansible/2.3/yum_repository_module.html)
|
||||
|
||||
@ -207,6 +207,10 @@ If the product is not healthy, the exit code (which can be checked through `echo
|
||||
|
||||
See [Log installation issues](linux-resources.md#log-installation-issues) for more information on how to find the automatically generated log that is created by the installer when an error occurs.
|
||||
|
||||
## Operating system upgrades
|
||||
|
||||
When upgrading your operating system to a new major version, you must first uninstall Microsoft Defender ATP for Linux, install the upgrade, and finally reconfigure Microsoft Defender ATP for Linux on your device.
|
||||
|
||||
## Uninstallation
|
||||
|
||||
Create a module *remove_mdatp* similar to *install_mdatp* with the following contents in *init.pp* file:
|
||||
|
||||
@ -0,0 +1,300 @@
|
||||
---
|
||||
title: Privacy for Microsoft Defender ATP for Linux
|
||||
description: Privacy controls, how to configure policy settings that impact privacy and information about the diagnostic data collected in Microsoft Defender ATP for Linux.
|
||||
keywords: microsoft, defender, atp, linux, privacy, diagnostic
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dansimp
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Privacy for Microsoft Defender ATP for Linux
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md)
|
||||
|
||||
Microsoft is committed to providing you with the information and controls you need to make choices about how your data is collected and used when you’re using Microsoft Defender ATP for Linux.
|
||||
|
||||
This topic describes the privacy controls available within the product, how to manage these controls with policy settings and more details on the data events that are collected.
|
||||
|
||||
## Overview of privacy controls in Microsoft Defender ATP for Linux
|
||||
|
||||
This section describes the privacy controls for the different types of data collected by Microsoft Defender ATP for Linux.
|
||||
|
||||
### Diagnostic data
|
||||
|
||||
Diagnostic data is used to keep Microsoft Defender ATP secure and up-to-date, detect, diagnose and fix problems, and also make product improvements.
|
||||
|
||||
Some diagnostic data is required, while some diagnostic data is optional. We give you the ability to choose whether to send us required or optional diagnostic data through the use of privacy controls, such as policy settings for organizations.
|
||||
|
||||
There are two levels of diagnostic data for Microsoft Defender ATP client software that you can choose from:
|
||||
|
||||
* **Required**: The minimum data necessary to help keep Microsoft Defender ATP secure, up-to-date, and performing as expected on the device it’s installed on.
|
||||
|
||||
* **Optional**: Additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and remediate issues.
|
||||
|
||||
By default, only required diagnostic data is sent to Microsoft.
|
||||
|
||||
### Cloud delivered protection data
|
||||
|
||||
Cloud delivered protection is used to provide increased and faster protection with access to the latest protection data in the cloud.
|
||||
|
||||
Enabling the cloud-delivered protection service is optional, however it is highly recommended because it provides important protection against malware on your endpoints and across your network.
|
||||
|
||||
### Sample data
|
||||
|
||||
Sample data is used to improve the protection capabilities of the product, by sending Microsoft suspicious samples so they can be analyzed. Enabling automatic sample submission is optional.
|
||||
|
||||
There are three levels for controlling sample submission:
|
||||
|
||||
- **None**: no suspicious samples are submitted to Microsoft.
|
||||
- **Safe**: only suspicious samples that do not contain personally identifiable information (PII) are submitted automatically. This is the default value for this setting.
|
||||
- **All**: all suspicious samples are submitted to Microsoft.
|
||||
|
||||
## Manage privacy controls with policy settings
|
||||
|
||||
If you're an IT administrator, you might want to configure these controls at the enterprise level.
|
||||
|
||||
The privacy controls for the various types of data described in the preceding section are described in detail in [Set preferences for Microsoft Defender ATP for Linux](linux-preferences.md).
|
||||
|
||||
As with any new policy settings, you should carefully test them out in a limited, controlled environment to ensure the settings that you configure have the desired effect before you implement the policy settings more widely in your organization.
|
||||
|
||||
## Diagnostic data events
|
||||
|
||||
This section describes what is considered required diagnostic data and what is considered optional diagnostic data, along with a description of the events and fields that are collected.
|
||||
|
||||
### Data fields that are common for all events
|
||||
There is some information about events that is common to all events, regardless of category or data subtype.
|
||||
|
||||
The following fields are considered common for all events:
|
||||
|
||||
| Field | Description |
|
||||
| ----------------------- | ----------- |
|
||||
| platform | The broad classification of the platform on which the app is running. Allows Microsoft to identify on which platforms an issue may be occurring so that it can correctly be prioritized. |
|
||||
| machine_guid | Unique identifier associated with the device. Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. |
|
||||
| sense_guid | Unique identifier associated with the device. Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. |
|
||||
| org_id | Unique identifier associated with the enterprise that the device belongs to. Allows Microsoft to identify whether issues are impacting a select set of enterprises and how many enterprises are impacted. |
|
||||
| hostname | Local machine name (without DNS suffix). Allows Microsoft to identify whether issues are impacting a select set of installs and how many users are impacted. |
|
||||
| product_guid | Unique identifier of the product. Allows Microsoft to differentiate issues impacting different flavors of the product. |
|
||||
| app_version | Version of the Microsoft Defender ATP for Linux application. Allows Microsoft to identify which versions of the product are showing an issue so that it can correctly be prioritized.|
|
||||
| sig_version | Version of security intelligence database. Allows Microsoft to identify which versions of the security intelligence are showing an issue so that it can correctly be prioritized. |
|
||||
| supported_compressions | List of compression algorithms supported by the application, for example `['gzip']`. Allows Microsoft to understand what types of compressions can be used when it communicates with the application. |
|
||||
| release_ring | Ring that the device is associated with (for example Insider Fast, Insider Slow, Production). Allows Microsoft to identify on which release ring an issue may be occurring so that it can correctly be prioritized. |
|
||||
|
||||
### Required diagnostic data
|
||||
|
||||
**Required diagnostic data** is the minimum data necessary to help keep Microsoft Defender ATP secure, up-to-date, and perform as expected on the device it’s installed on.
|
||||
|
||||
Required diagnostic data helps to identify problems with Microsoft Defender ATP that may be related to a device or software configuration. For example, it can help determine if a Microsoft Defender ATP feature crashes more frequently on a particular operating system version, with newly introduced features, or when certain Microsoft Defender ATP features are disabled. Required diagnostic data helps Microsoft detect, diagnose, and fix these problems more quickly so the impact to users or organizations is reduced.
|
||||
|
||||
#### Software setup and inventory data events
|
||||
|
||||
**Microsoft Defender ATP installation / uninstallation**
|
||||
|
||||
The following fields are collected:
|
||||
|
||||
| Field | Description |
|
||||
| ---------------- | ----------- |
|
||||
| correlation_id | Unique identifier associated with the installation. |
|
||||
| version | Version of the package. |
|
||||
| severity | Severity of the message (for example Informational). |
|
||||
| code | Code that describes the operation. |
|
||||
| text | Additional information associated with the product installation. |
|
||||
|
||||
**Microsoft Defender ATP configuration**
|
||||
|
||||
The following fields are collected:
|
||||
|
||||
| Field | Description |
|
||||
| --------------------------------------------------- | ----------- |
|
||||
| antivirus_engine.enable_real_time_protection | Whether real-time protection is enabled on the device or not. |
|
||||
| antivirus_engine.passive_mode | Whether passive mode is enabled on the device or not. |
|
||||
| cloud_service.enabled | Whether cloud delivered protection is enabled on the device or not. |
|
||||
| cloud_service.timeout | Time out when the application communicates with the Microsoft Defender ATP cloud. |
|
||||
| cloud_service.heartbeat_interval | Interval between consecutive heartbeats sent by the product to the cloud. |
|
||||
| cloud_service.service_uri | URI used to communicate with the cloud. |
|
||||
| cloud_service.diagnostic_level | Diagnostic level of the device (required, optional). |
|
||||
| cloud_service.automatic_sample_submission | Automatic sample submission level of the device (none, safe, all). |
|
||||
| edr.early_preview | Whether the machine should run EDR early preview features. |
|
||||
| edr.group_id | Group identifier used by the detection and response component. |
|
||||
| edr.tags | User-defined tags. |
|
||||
| features.\[optional feature name\] | List of preview features, along with whether they are enabled or not. |
|
||||
|
||||
#### Product and service usage data events
|
||||
|
||||
**Security intelligence update report**
|
||||
|
||||
The following fields are collected:
|
||||
|
||||
| Field | Description |
|
||||
| ---------------- | ----------- |
|
||||
| from_version | Original security intelligence version. |
|
||||
| to_version | New security intelligence version. |
|
||||
| status | Status of the update indicating success or failure. |
|
||||
| using_proxy | Whether the update was done over a proxy. |
|
||||
| error | Error code if the update failed. |
|
||||
| reason | Error message if the update failed. |
|
||||
|
||||
#### Product and service performance data events
|
||||
|
||||
**Kernel extension statistics**
|
||||
|
||||
The following fields are collected:
|
||||
|
||||
| Field | Description |
|
||||
| ---------------- | ----------- |
|
||||
| version | Version of Microsoft Defender ATP for Linux. |
|
||||
| instance_id | Unique identifier generated on kernel extension startup. |
|
||||
| trace_level | Trace level of the kernel extension. |
|
||||
| subsystem | The underlying subsystem used for real-time protection. |
|
||||
| ipc.connects | Number of connection requests received by the kernel extension. |
|
||||
| ipc.rejects | Number of connection requests rejected by the kernel extension. |
|
||||
| ipc.connected | Whether there is any active connection to the kernel extension. |
|
||||
|
||||
#### Support data
|
||||
|
||||
**Diagnostic logs**
|
||||
|
||||
Diagnostic logs are collected only with the consent of the user as part of the feedback submission feature. The following files are collected as part of the support logs:
|
||||
|
||||
- All files under */var/log/microsoft/mdatp*
|
||||
- Subset of files under */etc/opt/microsoft/mdatp* that are created and used by Microsoft Defender ATP for Linux
|
||||
- Product installation and uninstallation logs under */var/log/microsoft_mdatp_\*.log*
|
||||
|
||||
### Optional diagnostic data
|
||||
|
||||
**Optional diagnostic data** is additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and fix issues.
|
||||
|
||||
If you choose to send us optional diagnostic data, required diagnostic data is also included.
|
||||
|
||||
Examples of optional diagnostic data include data Microsoft collects about product configuration (for example number of exclusions set on the device) and product performance (aggregate measures about the performance of components of the product).
|
||||
|
||||
#### Software setup and inventory data events
|
||||
|
||||
**Microsoft Defender ATP configuration**
|
||||
|
||||
The following fields are collected:
|
||||
|
||||
| Field | Description |
|
||||
| -------------------------------------------------- | ----------- |
|
||||
| connection_retry_timeout | Connection retry time-out when communication with the cloud. |
|
||||
| file_hash_cache_maximum | Size of the product cache. |
|
||||
| crash_upload_daily_limit | Limit of crash logs uploaded daily. |
|
||||
| antivirus_engine.exclusions[].is_directory | Whether the exclusion from scanning is a directory or not. |
|
||||
| antivirus_engine.exclusions[].path | Path that was excluded from scanning. |
|
||||
| antivirus_engine.exclusions[].extension | Extension excluded from scanning. |
|
||||
| antivirus_engine.exclusions[].name | Name of the file excluded from scanning. |
|
||||
| antivirus_engine.scan_cache_maximum | Size of the product cache. |
|
||||
| antivirus_engine.maximum_scan_threads | Maximum number of threads used for scanning. |
|
||||
| antivirus_engine.threat_restoration_exclusion_time | Time out before a file restored from the quarantine can be detected again. |
|
||||
| filesystem_scanner.full_scan_directory | Full scan directory. |
|
||||
| filesystem_scanner.quick_scan_directories | List of directories used in quick scan. |
|
||||
| edr.latency_mode | Latency mode used by the detection and response component. |
|
||||
| edr.proxy_address | Proxy address used by the detection and response component. |
|
||||
|
||||
**Microsoft Auto-Update configuration**
|
||||
|
||||
The following fields are collected:
|
||||
|
||||
| Field | Description |
|
||||
| --------------------------- | ----------- |
|
||||
| how_to_check | Determines how product updates are checked (for example automatic or manual). |
|
||||
| channel_name | Update channel associated with the device. |
|
||||
| manifest_server | Server used for downloading updates. |
|
||||
| update_cache | Location of the cache used to store updates. |
|
||||
|
||||
### Product and service usage
|
||||
|
||||
#### Diagnostic log upload started report
|
||||
|
||||
The following fields are collected:
|
||||
|
||||
| Field | Description |
|
||||
| ---------------- | ----------- |
|
||||
| sha256 | SHA256 identifier of the support log. |
|
||||
| size | Size of the support log. |
|
||||
| original_path | Path to the support log (always under */var/opt/microsoft/mdatp/wdavdiag/*). |
|
||||
| format | Format of the support log. |
|
||||
|
||||
#### Diagnostic log upload completed report
|
||||
|
||||
The following fields are collected:
|
||||
|
||||
| Field | Description |
|
||||
| ---------------- | ----------- |
|
||||
| request_id | Correlation ID for the support log upload request. |
|
||||
| sha256 | SHA256 identifier of the support log. |
|
||||
| blob_sas_uri | URI used by the application to upload the support log. |
|
||||
|
||||
#### Product and service performance data events
|
||||
|
||||
**Unexpected application exit (crash)**
|
||||
|
||||
Unexpected application exits and the state of the application when that happens.
|
||||
|
||||
**Kernel extension statistics**
|
||||
|
||||
The following fields are collected:
|
||||
|
||||
| Field | Description |
|
||||
| ------------------------------ | ----------- |
|
||||
| pkt_ack_timeout | The following properties are aggregated numerical values, representing count of events that happened since kernel extension startup. |
|
||||
| pkt_ack_conn_timeout | |
|
||||
| ipc.ack_pkts | |
|
||||
| ipc.nack_pkts | |
|
||||
| ipc.send.ack_no_conn | |
|
||||
| ipc.send.nack_no_conn | |
|
||||
| ipc.send.ack_no_qsq | |
|
||||
| ipc.send.nack_no_qsq | |
|
||||
| ipc.ack.no_space | |
|
||||
| ipc.ack.timeout | |
|
||||
| ipc.ack.ackd_fast | |
|
||||
| ipc.ack.ackd | |
|
||||
| ipc.recv.bad_pkt_len | |
|
||||
| ipc.recv.bad_reply_len | |
|
||||
| ipc.recv.no_waiter | |
|
||||
| ipc.recv.copy_failed | |
|
||||
| ipc.kauth.vnode.mask | |
|
||||
| ipc.kauth.vnode.read | |
|
||||
| ipc.kauth.vnode.write | |
|
||||
| ipc.kauth.vnode.exec | |
|
||||
| ipc.kauth.vnode.del | |
|
||||
| ipc.kauth.vnode.read_attr | |
|
||||
| ipc.kauth.vnode.write_attr | |
|
||||
| ipc.kauth.vnode.read_ex_attr | |
|
||||
| ipc.kauth.vnode.write_ex_attr | |
|
||||
| ipc.kauth.vnode.read_sec | |
|
||||
| ipc.kauth.vnode.write_sec | |
|
||||
| ipc.kauth.vnode.take_own | |
|
||||
| ipc.kauth.vnode.link | |
|
||||
| ipc.kauth.vnode.create | |
|
||||
| ipc.kauth.vnode.move | |
|
||||
| ipc.kauth.vnode.mount | |
|
||||
| ipc.kauth.vnode.denied | |
|
||||
| ipc.kauth.vnode.ackd_before_deadline | |
|
||||
| ipc.kauth.vnode.missed_deadline | |
|
||||
| ipc.kauth.file_op.mask | |
|
||||
| ipc.kauth_file_op.open | |
|
||||
| ipc.kauth.file_op.close | |
|
||||
| ipc.kauth.file_op.close_modified | |
|
||||
| ipc.kauth.file_op.move | |
|
||||
| ipc.kauth.file_op.link | |
|
||||
| ipc.kauth.file_op.exec | |
|
||||
| ipc.kauth.file_op.remove | |
|
||||
| ipc.kauth.file_op.unmount | |
|
||||
| ipc.kauth.file_op.fork | |
|
||||
| ipc.kauth.file_op.create | |
|
||||
|
||||
## Resources
|
||||
|
||||
- [Privacy at Microsoft](https://privacy.microsoft.com/)
|
||||
@ -0,0 +1,65 @@
|
||||
---
|
||||
title: Detect and block potentially unwanted applications with Microsoft Defender ATP for Linux
|
||||
description: Detect and block Potentially Unwanted Applications (PUA) using Microsoft Defender ATP for Linux.
|
||||
keywords: microsoft, defender, atp, linux, pua, pus
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dansimp
|
||||
author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Detect and block potentially unwanted applications with Microsoft Defender ATP for Linux
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Linux](microsoft-defender-atp-linux.md)
|
||||
|
||||
The potentially unwanted application (PUA) protection feature in Microsoft Defender ATP for Linux can detect and block PUA files on endpoints in your network.
|
||||
|
||||
These applications are not considered viruses, malware, or other types of threats, but might perform actions on endpoints that adversely affect their performance or use. PUA can also refer to applications that are considered to have poor reputation.
|
||||
|
||||
These applications can increase the risk of your network being infected with malware, cause malware infections to be harder to identify, and can waste IT resources in cleaning up the applications.
|
||||
|
||||
## How it works
|
||||
|
||||
Microsoft Defender ATP for Linux can detect and report PUA files. When configured in blocking mode, PUA files are moved to the quarantine.
|
||||
|
||||
When a PUA is detected on an endpoint, Microsoft Defender ATP for Linux keeps a record of the infection in the threat history. The history can be visualized from the Microsoft Defender Security Center portal or through the `mdatp` command-line tool. The threat name will contain the word "Application".
|
||||
|
||||
## Configure PUA protection
|
||||
|
||||
PUA protection in Microsoft Defender ATP for Linux can be configured in one of the following ways:
|
||||
|
||||
- **Off**: PUA protection is disabled.
|
||||
- **Audit**: PUA files are reported in the product logs, but not in Microsoft Defender Security Center. No record of the infection is stored in the threat history and no action is taken by the product.
|
||||
- **Block**: PUA files are reported in the product logs and in Microsoft Defender Security Center. A record of the infection is stored in the threat history and action is taken by the product.
|
||||
|
||||
>[!WARNING]
|
||||
>By default, PUA protection is configured in **Audit** mode.
|
||||
|
||||
You can configure how PUA files are handled from the command line or from the management console.
|
||||
|
||||
### Use the command-line tool to configure PUA protection:
|
||||
|
||||
In Terminal, execute the following command to configure PUA protection:
|
||||
|
||||
```bash
|
||||
$ mdatp --threat --type-handling potentially_unwanted_application [off|audit|block]
|
||||
```
|
||||
|
||||
### Use the management console to configure PUA protection:
|
||||
|
||||
In your enterprise, you can configure PUA protection from a management console, such as Puppet or Ansible, similarly to how other product settings are configured. For more information, see the [Threat type settings](linux-preferences.md#threat-type-settings) section of the [Set preferences for Microsoft Defender ATP for Linux](linux-preferences.md) topic.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Set preferences for Microsoft Defender ATP for Linux](linux-preferences.md)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Live response command examples
|
||||
description: Learn about common commands and see examples on how it's used
|
||||
description: Learn to run basic or advanced live response commands for Microsoft Defender Advanced Threat Protection (ATP) and see examples on how it's used
|
||||
keywords: example, command, cli, remote, shell, connection, live, response, real-time, command, script, remediate, hunt, export, log, drop, download, file
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Manual deployment for Microsoft Defender ATP for Mac
|
||||
description: Install Microsoft Defender ATP for Mac manually, from the command line.
|
||||
title: Manual deployment for Microsoft Defender ATP for macOS
|
||||
description: Install Microsoft Defender ATP for macOS manually, from the command line.
|
||||
keywords: microsoft, defender, atp, mac, installation, deploy, uninstallation, intune, jamf, macos, catalina, mojave, high sierra
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -17,45 +17,34 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Manual deployment for Microsoft Defender ATP for Mac
|
||||
# Manual deployment for Microsoft Defender ATP for macOS
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for macOS](microsoft-defender-atp-mac.md)
|
||||
|
||||
This topic describes how to deploy Microsoft Defender ATP for Mac manually. A successful deployment requires the completion of all of the following steps:
|
||||
This topic describes how to deploy Microsoft Defender ATP for macOS manually. A successful deployment requires the completion of all of the following steps:
|
||||
- [Download installation and onboarding packages](#download-installation-and-onboarding-packages)
|
||||
- [Application installation](#application-installation)
|
||||
- [Client configuration](#client-configuration)
|
||||
|
||||
## Prerequisites and system requirements
|
||||
|
||||
Before you get started, see [the main Microsoft Defender ATP for Mac page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version.
|
||||
Before you get started, see [the main Microsoft Defender ATP for macOS page](microsoft-defender-atp-mac.md) for a description of prerequisites and system requirements for the current software version.
|
||||
|
||||
## Download installation and onboarding packages
|
||||
|
||||
Download the installation and onboarding packages from Microsoft Defender Security Center:
|
||||
|
||||
1. In Microsoft Defender Security Center, go to **Settings > Machine Management > Onboarding**.
|
||||
2. In Section 1 of the page, set operating system to **Linux, macOS, iOS, and Android** and Deployment method to **Local script**.
|
||||
2. In Section 1 of the page, set operating system to **macOS** and Deployment method to **Local script**.
|
||||
3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory.
|
||||
4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory.
|
||||
|
||||
|
||||
|
||||
5. From a command prompt, verify that you have the two files.
|
||||
Extract the contents of the .zip files:
|
||||
|
||||
```bash
|
||||
$ ls -l
|
||||
total 721152
|
||||
-rw-r--r-- 1 test staff 6185 Mar 15 10:45 WindowsDefenderATPOnboardingPackage.zip
|
||||
-rw-r--r-- 1 test staff 354531845 Mar 13 08:57 wdav.pkg
|
||||
$ unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
Archive: WindowsDefenderATPOnboardingPackage.zip
|
||||
inflating: WindowsDefenderATPOnboarding.py
|
||||
```
|
||||
|
||||
|
||||
## Application installation
|
||||
|
||||
To complete this process, you must have admin privileges on the machine.
|
||||
@ -87,7 +76,7 @@ The installation proceeds.
|
||||
|
||||
## Client configuration
|
||||
|
||||
1. Copy wdav.pkg and WindowsDefenderATPOnboarding.py to the machine where you deploy Microsoft Defender ATP for Mac.
|
||||
1. Copy wdav.pkg and MicrosoftDefenderATPOnboardingMacOs.py to the machine where you deploy Microsoft Defender ATP for macOS.
|
||||
|
||||
The client machine is not associated with orgId. Note that the *orgId* attribute is blank.
|
||||
|
||||
@ -98,7 +87,7 @@ The installation proceeds.
|
||||
2. Run the Python script to install the configuration file:
|
||||
|
||||
```bash
|
||||
$ /usr/bin/python WindowsDefenderATPOnboarding.py
|
||||
$ /usr/bin/python MicrosoftDefenderATPOnboardingMacOs.py
|
||||
Generating /Library/Application Support/Microsoft/Defender/com.microsoft.wdav.atp.plist ... (You may be required to enter sudos password)
|
||||
```
|
||||
|
||||
@ -127,4 +116,4 @@ See [Logging installation issues](mac-resources.md#logging-installation-issues)
|
||||
|
||||
## Uninstallation
|
||||
|
||||
See [Uninstalling](mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices.
|
||||
See [Uninstalling](mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for macOS from client devices.
|
||||
|
||||
@ -43,7 +43,7 @@ There are two levels of diagnostic data for Microsoft Defender ATP client softwa
|
||||
|
||||
* **Optional**: Additional data that helps Microsoft make product improvements and provides enhanced information to help detect, diagnose, and remediate issues.
|
||||
|
||||
By default, both optional and required diagnostic data are sent to Microsoft.
|
||||
By default, only required diagnostic data is sent to Microsoft.
|
||||
|
||||
### Cloud delivered protection data
|
||||
|
||||
@ -127,6 +127,21 @@ The following fields are collected:
|
||||
| edr.tags | User-defined tags. |
|
||||
| features.\[optional feature name\] | List of preview features, along with whether they are enabled or not. |
|
||||
|
||||
#### Product and service usage data events
|
||||
|
||||
**Security intelligence update report**
|
||||
|
||||
The following fields are collected:
|
||||
|
||||
| Field | Description |
|
||||
| ---------------- | ----------- |
|
||||
| from_version | Original security intelligence version. |
|
||||
| to_version | New security intelligence version. |
|
||||
| status | Status of the update indicating success or failure. |
|
||||
| using_proxy | Whether the update was done over a proxy. |
|
||||
| error | Error code if the update failed. |
|
||||
| reason | Error message if the updated filed. |
|
||||
|
||||
#### Product and service performance data events
|
||||
|
||||
**Kernel extension statistics**
|
||||
@ -138,6 +153,7 @@ The following fields are collected:
|
||||
| version | Version of Microsoft Defender ATP for Mac. |
|
||||
| instance_id | Unique identifier generated on kernel extension startup. |
|
||||
| trace_level | Trace level of the kernel extension. |
|
||||
| subsystem | The underlying subsystem used for real-time protection. |
|
||||
| ipc.connects | Number of connection requests received by the kernel extension. |
|
||||
| ipc.rejects | Number of connection requests rejected by the kernel extension. |
|
||||
| ipc.connected | Whether there is any active connection to the kernel extension. |
|
||||
@ -259,7 +275,13 @@ The following fields are collected:
|
||||
| ipc.kauth.vnode.read_sec | |
|
||||
| ipc.kauth.vnode.write_sec | |
|
||||
| ipc.kauth.vnode.take_own | |
|
||||
| ipc.kauth.vnode.link | |
|
||||
| ipc.kauth.vnode.create | |
|
||||
| ipc.kauth.vnode.move | |
|
||||
| ipc.kauth.vnode.mount | |
|
||||
| ipc.kauth.vnode.denied | |
|
||||
| ipc.kauth.vnode.ackd_before_deadline | |
|
||||
| ipc.kauth.vnode.missed_deadline | |
|
||||
| ipc.kauth.file_op.mask | |
|
||||
| ipc.kauth_file_op.open | |
|
||||
| ipc.kauth.file_op.close | |
|
||||
@ -268,6 +290,7 @@ The following fields are collected:
|
||||
| ipc.kauth.file_op.link | |
|
||||
| ipc.kauth.file_op.exec | |
|
||||
| ipc.kauth.file_op.remove | |
|
||||
| ipc.kauth.file_op.unmount | |
|
||||
| ipc.kauth.file_op.fork | |
|
||||
| ipc.kauth.file_op.create | |
|
||||
|
||||
|
||||
@ -41,6 +41,6 @@ You deployed and/or installed the MDATP for macOS package ("Download installatio
|
||||
|
||||
**Solution:**
|
||||
|
||||
Follow the WindowsDefenderATPOnboarding.py instructions documented here:
|
||||
Follow the MicrosoftDefenderATPOnboardingMacOs.py instructions documented here:
|
||||
[Client configuration](mac-install-manually.md#client-configuration)
|
||||
|
||||
|
||||
@ -26,8 +26,8 @@ You can add tags on machines using the following ways:
|
||||
- Using the portal
|
||||
- Setting a registry key value
|
||||
|
||||
>[!NOTE]
|
||||
>There may be some latency between the time a tag is added to a machine and its availability in the machines list and machine page.
|
||||
> [!NOTE]
|
||||
> There may be some latency between the time a tag is added to a machine and its availability in the machines list and machine page.
|
||||
|
||||
To add machine tags using API, see [Add or remove machine tags API](add-or-remove-machine-tags.md).
|
||||
|
||||
@ -71,6 +71,9 @@ You can also delete tags from this view.
|
||||
>- Windows 8.1
|
||||
>- Windows 7 SP1
|
||||
|
||||
> [!NOTE]
|
||||
> The maximum number of characters that can be set in a tag is 200.
|
||||
|
||||
Machines with similar tags can be handy when you need to apply contextual action on a specific list of machines.
|
||||
|
||||
Use the following registry key entry to add a tag on a machine:
|
||||
@ -81,4 +84,5 @@ Use the following registry key entry to add a tag on a machine:
|
||||
|
||||
>[!NOTE]
|
||||
>The device tag is part of the machine information report that's generated once a day. As an alternative, you may choose to restart the endpoint that would transfer a new machine information report.
|
||||
|
||||
>
|
||||
> If you need to remove a tag that was added using the above Registry key, clear the contents of the Registry key data instead of removing the 'Group' key.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: machineAction resource type
|
||||
description: Retrieves top recent machineActions.
|
||||
description: Quickly respond to detected attacks by isolating machines or collecting an investigation package.
|
||||
keywords: apis, supported apis, get, machineaction, recent
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
|
||||
@ -79,7 +79,8 @@ Create custom rules to control when alerts are suppressed, or resolved. You can
|
||||
3. Select the **Trigerring IOC**.
|
||||
|
||||
4. Specify the action and scope on the alert. <br>
|
||||
You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue. Alerts that are marked as hidden will be suppressed from the entire system, both on the machine's associated alerts and from the dashboard. You can also specify to suppress the alert on a specific machine group.
|
||||
You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue, alert page, and machine timeline and will appear as resolved across Microsoft Defender ATP APIs. <br><br> Alerts that are marked as hidden will be suppressed from the entire system, both on the machine's associated alerts and from the dashboard and will not be streamed across Microsoft Defender ATP APIs.
|
||||
|
||||
|
||||
5. Enter a rule name and a comment.
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user