From e22d5d6235b9ab2bdb4b89dfa64b0c705b77bcd8 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 22 Feb 2018 20:29:07 -0800 Subject: [PATCH 1/3] update get client secret --- ...stom-ti-windows-defender-advanced-threat-protection.md | 4 ++-- ...ot-siem-windows-defender-advanced-threat-protection.md | 8 ++++---- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md index 1e32ef16a7..85245a50ee 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md @@ -39,9 +39,9 @@ If your client secret expires or if you've misplaced the copy provided when you 3. Select your tenant. -4. Click **Application**, then select your custom threat intelligence application. The application name is **WindowsDefenderATPThreatIntelAPI** (formerly known as **WindowsDefenderATPCustomerTiConnector**). +4. Click **App registrations** > **All apps**. Then select the application name **WindowsDefenderATPThreatIntelAPI** (formerly known as **WindowsDefenderATPCustomerTiConnector**). -5. Select **Keys** section, then provide a key description and specify the key validity duration. +5. Under **Settings**, select **Keys**, then provide a key description and specify the key validity duration. 6. Click **Save**. The key value is displayed. diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md index c384aeaa9e..f093a717e3 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md @@ -32,17 +32,17 @@ This page provides detailed steps to troubleshoot issues you might encounter. ## Learn how to get a new client secret -If your client secret expires or if you've misplaced the copy provided when you were enabling the SIEM tool application, you'll need to get a new secret. +If your client secret expires or if you've misplaced the copy provided when you were enabling the custom threat intelligence application, you'll need to get a new secret. 1. Login to the [Azure management portal](https://ms.portal.azure.com). -2. Select **Azure Active Directory**. +2. Select **Active Directory**. 3. Select your tenant. -4. Click **Application**, then select your SIEM tool application. The application name is `https://windowsdefenderatpsiemconnector`. +4. Click **App registrations** > **All apps**. Then select the application name **WindowsDefenderATPThreatIntelAPI** (formerly known as **WindowsDefenderATPCustomerTiConnector**). -5. Select **Keys** section, then provide a key description and specify the key validity duration. +5. Under **Settings**, select **Keys**, then provide a key description and specify the key validity duration. 6. Click **Save**. The key value is displayed. From 59cc347566df8911e125d34dd8e5f3e43a773905 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 23 Feb 2018 10:28:04 -0800 Subject: [PATCH 2/3] revert siem. keep custom ti --- ...t-siem-windows-defender-advanced-threat-protection.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md index f093a717e3..22c3aaa87e 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md @@ -32,22 +32,23 @@ This page provides detailed steps to troubleshoot issues you might encounter. ## Learn how to get a new client secret -If your client secret expires or if you've misplaced the copy provided when you were enabling the custom threat intelligence application, you'll need to get a new secret. +If your client secret expires or if you've misplaced the copy provided when you were enabling the SIEM tool application, you'll need to get a new secret. 1. Login to the [Azure management portal](https://ms.portal.azure.com). -2. Select **Active Directory**. +2. Select **Azure Active Directory**. 3. Select your tenant. -4. Click **App registrations** > **All apps**. Then select the application name **WindowsDefenderATPThreatIntelAPI** (formerly known as **WindowsDefenderATPCustomerTiConnector**). +4. Click **App registrations** > **All apps**, then select your SIEM tool application. The application name is `https://windowsdefenderatpsiemconnector`. -5. Under **Settings**, select **Keys**, then provide a key description and specify the key validity duration. +5. Select **Keys** section, then provide a key description and specify the key validity duration. 6. Click **Save**. The key value is displayed. 7. Copy the value and save it in a safe place. + ## Error when getting a refresh access token If you encounter an error when trying to get a refresh token when using the threat intelligence API or SIEM tools, you'll need to add reply URL for relevant application in Azure Active Directory. From 46cfabfdaeb30e9aef12de6fee7dfed5b9ebb87e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 26 Feb 2018 11:02:26 -0800 Subject: [PATCH 3/3] udpate urls --- ...t-custom-ti-windows-defender-advanced-threat-protection.md | 4 ++-- ...eshoot-siem-windows-defender-advanced-threat-protection.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md index 85245a50ee..d6dbef14e6 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md @@ -10,7 +10,7 @@ ms.pagetype: security ms.author: macapara author: mjcaparas ms.localizationpriority: high -ms.date: 10/16/2017 +ms.date: 02/26/2018 --- # Troubleshoot custom threat intelligence issues @@ -33,7 +33,7 @@ This page provides detailed steps to troubleshoot issues you might encounter whi ## Learn how to get a new client secret If your client secret expires or if you've misplaced the copy provided when you were enabling the custom threat intelligence application, you'll need to get a new secret. -1. Login to the [Azure management portal](https://ms.portal.azure.com). +1. Login to the [Azure management portal](https://portal.azure.com). 2. Select **Active Directory**. diff --git a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md index 22c3aaa87e..4d77042ae0 100644 --- a/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/troubleshoot-siem-windows-defender-advanced-threat-protection.md @@ -34,7 +34,7 @@ This page provides detailed steps to troubleshoot issues you might encounter. ## Learn how to get a new client secret If your client secret expires or if you've misplaced the copy provided when you were enabling the SIEM tool application, you'll need to get a new secret. -1. Login to the [Azure management portal](https://ms.portal.azure.com). +1. Login to the [Azure management portal](https://portal.azure.com). 2. Select **Azure Active Directory**.