This commit is contained in:
Tudor Dobrila 2019-10-31 17:51:56 -07:00
parent e717b6fb82
commit 4e7d56ded2
2 changed files with 10 additions and 8 deletions

View File

@ -51,27 +51,29 @@ Process | A specific process (specified either by the full path or file name) an
### From the management console ### From the management console
See [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md) for more details on how to configure exclusions from JAMF, Intune, or another management console. For more information on how to configure exclusions from JAMF, Intune, or another management console, see [Set preferences for Microsoft Defender ATP for Mac](microsoft-defender-atp-mac-preferences.md).
### From the user interface ### From the user interface
Open the Microsoft Defender ATP application and navigate to **Manage settings** > **Add or Remove Exclusion...**, as shown in the following screenshot. Select the type of exclusion that you wish to add and follow the prompts. Open the Microsoft Defender ATP application and navigate to **Manage settings** > **Add or Remove Exclusion...**, as shown in the following screenshot:
![Manage exclusions screenshot](images/MDATP_37_Exclusions.png) ![Manage exclusions screenshot](images/MDATP_37_Exclusions.png)
Select the type of exclusion that you wish to add and follow the prompts.
## Validate exclusions lists with the EICAR test file ## Validate exclusions lists with the EICAR test file
You can validate that your exclusion lists are working by using `curl` to download a test file. You can validate that your exclusion lists are working by using `curl` to download a test file.
In the following Bash snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the .testing extension, replace *test.txt* with *test.testing*. If you are testing a path, ensure you run the command within that path. In the following Bash snippet, replace *test.txt* with a file that conforms to your exclusion rules. For example, if you have excluded the *.testing extension*, replace *test.txt* with *test.testing*. If you are testing a path, ensure that you run the command within that path.
```bash ```bash
$ curl -o test.txt http://www.eicar.org/download/eicar.com.txt $ curl -o test.txt http://www.eicar.org/download/eicar.com.txt
``` ```
If Microsoft Defender ATP for Mac reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm the contents are the same as what is described on the [EICAR testfile website](http://www.eicar.org/86-0-Intended-use.html). If Microsoft Defender ATP for Mac reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](http://www.eicar.org/86-0-Intended-use.html).
If you do not have Internet access, you can create your own EICAR test file by writing the EICAR string to a new text file with the following Bash command: If you do not have internet access, you can create your own EICAR test file. Write the EICAR string to a new text file with the following Bash command:
```bash ```bash
echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > test.txt echo 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > test.txt

View File

@ -28,11 +28,11 @@ This topic provides some general steps that can be used to narrow down performan
Real-time protection (RTP) is a feature of Microsoft Defender ATP for Mac that continuously monitors and protects your device against threats. It consists of file and process monitoring and other heuristics. Real-time protection (RTP) is a feature of Microsoft Defender ATP for Mac that continuously monitors and protects your device against threats. It consists of file and process monitoring and other heuristics.
Depending on the applications that you are running and your device characteristics, you may experience suboptimal performance when running Microsoft Defender ATP for Mac. In particular, applications or system processes that access a large number of resources over a short timespan can lead to performance issues in Microsoft Defender ATP for Mac. Depending on the applications that you are running and your device characteristics, you may experience suboptimal performance when running Microsoft Defender ATP for Mac. In particular, applications or system processes that access many resources over a short timespan can lead to performance issues in Microsoft Defender ATP for Mac.
The following steps can be used to troubleshoot and mitigate these issues: The following steps can be used to troubleshoot and mitigate these issues:
1. Disable real-time protection using one of the following methods and observe whether the performance improves. This helps narrow down whether Microsoft Defender ATP for Mac is contributing to the performance issues. 1. Disable real-time protection using one of the following methods and observe whether the performance improves. This approach helps narrow down whether Microsoft Defender ATP for Mac is contributing to the performance issues.
If your device is not managed by your organization, real-time protection can be disabled using one of the following options: If your device is not managed by your organization, real-time protection can be disabled using one of the following options:
@ -40,7 +40,7 @@ The following steps can be used to troubleshoot and mitigate these issues:
![Manage real-time protection screenshot](images/MDATP_36_RTP.png) ![Manage real-time protection screenshot](images/MDATP_36_RTP.png)
- From the Terminal using the following command. Note that, for security purposes, this operation requires elevation. - From the Terminal. For security purposes, this operation requires elevation.
```bash ```bash
$ mdatp --config realTimeProtectionEnabled false $ mdatp --config realTimeProtectionEnabled false