From 229416906688bcb1b1865951417aadd99bea5e3c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 18 Mar 2020 17:13:28 -0700 Subject: [PATCH 01/26] rearrange topics --- windows/security/threat-protection/TOC.md | 362 +++++++++--------- .../microsoft-defender-atp/onboarding.md | 2 +- .../overview-endpoint-detection-response.md | 14 +- .../prepare-deployment.md | 4 +- .../production-deployment.md | 12 +- 5 files changed, 195 insertions(+), 199 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index eab2a21708..68a41de76a 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -18,7 +18,7 @@ ### [Phase 1: Prepare](microsoft-defender-atp/prepare-deployment.md) -### [Phase 2: Setup](microsoft-defender-atp/production-deployment.md) +### [Phase 2: Set up](microsoft-defender-atp/production-deployment.md) ### [Phase 3: Onboard](microsoft-defender-atp/onboarding.md) @@ -96,12 +96,16 @@ #### [View details and results of automated investigations](microsoft-defender-atp/auto-investigation-action-center.md) + ### [Investigate entities using Live response]() #### [Investigate entities on machines](microsoft-defender-atp/live-response.md) #### [Live response command examples](microsoft-defender-atp/live-response-command-examples.md) ### [Threat analytics](microsoft-defender-atp/threat-analytics.md) +### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md) + + ### [Advanced hunting]() #### [Advanced hunting overview](microsoft-defender-atp/advanced-hunting-overview.md) #### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md) @@ -140,6 +144,170 @@ #### [Create and manage detection rules](microsoft-defender-atp/custom-detection-rules.md) +## [Service operations]() + +### [Configure attack surface reduction]() +#### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md) + +### [Hardware-based isolation]() +#### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) + +#### [Application isolation]() +##### [Install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) +##### [Application control](windows-defender-application-control/windows-defender-application-control.md) + +#### [Device control]() +##### [Control USB devices](device-control/control-usb-devices-using-intune.md) + +##### [Device Guard]() +###### [Code integrity](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) + +###### [Memory integrity]() +####### [Understand memory integrity](device-guard/memory-integrity.md) +####### [Hardware qualifications](device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) +####### [Enable HVCI](device-guard/enable-virtualization-based-protection-of-code-integrity.md) + +#### [Exploit protection]() +##### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md) +##### [Import/export configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md) + +#### [Network protection](microsoft-defender-atp/enable-network-protection.md) +#### [Controlled folder access](microsoft-defender-atp/enable-controlled-folders.md) + +#### [Attack surface reduction controls]() +##### [Enable attack surface reduction rules](microsoft-defender-atp/enable-attack-surface-reduction.md) +##### [Customize attack surface reduction](microsoft-defender-atp/customize-attack-surface-reduction.md) + +#### [Network firewall](windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md) + +### [Configure next-generation protection]() +#### [Configure Windows Defender Antivirus features](windows-defender-antivirus/configure-windows-defender-antivirus-features.md) + +#### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +##### [Enable cloud-delivered protection](windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) +##### [Specify the cloud-delivered protection level](windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md) +##### [Configure and validate network connections](windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md) +##### [Prevent security settings changes with tamper protection](windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md) +##### [Enable Block at first sight](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md) +##### [Configure the cloud block timeout period](windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md) + +#### [Configure behavioral, heuristic, and real-time protection]() +##### [Configuration overview](windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md) +##### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) +##### [Enable and configure always-on protection and monitoring](windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) + +#### [Antivirus on Windows Server 2016](windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md) + +#### [Antivirus compatibility]() +##### [Compatibility charts](windows-defender-antivirus/windows-defender-antivirus-compatibility.md) +##### [Use limited periodic antivirus scanning](windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md) + +#### [Deploy, manage updates, and report on antivirus]() +##### [Preparing to deploy](windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md) +##### [Deploy and enable antivirus](windows-defender-antivirus/deploy-windows-defender-antivirus.md) +###### [Deployment guide for VDI environments](windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md) + +##### [Report on antivirus protection]() +###### [Review protection status and alerts](windows-defender-antivirus/report-monitor-windows-defender-antivirus.md) +###### [Troubleshoot antivirus reporting in Update Compliance](windows-defender-antivirus/troubleshoot-reporting.md) + +##### [Manage updates and apply baselines]() +###### [Learn about the different kinds of updates](windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md) +###### [Manage protection and security intelligence updates](windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md) +###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md) +###### [Manage updates for endpoints that are out of date](windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md) +###### [Manage event-based forced updates](windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md) +###### [Manage updates for mobile devices and VMs](windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md) + +#### [Customize, initiate, and review the results of scans and remediation]() +##### [Configuration overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) + +##### [Configure and validate exclusions in antivirus scans]() +###### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) +###### [Configure antivirus exclusions Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) + +##### [Configure scanning antivirus options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) +##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) +##### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) +##### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) +##### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) +##### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) + +#### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) + +#### [Manage antivirus in your business]() +##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) +##### [Use Group Policy settings to configure and manage antivirus](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) +##### [Use Microsoft Endpoint Configuration Manager and Microsoft Intune to configure and manage antivirus](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) +##### [Use PowerShell cmdlets to configure and manage antivirus](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) +##### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) +##### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) + +#### [Manage scans and remediation]() +##### [Management overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) + +##### [Configure and validate exclusions in antivirus scans]() +###### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) +###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) +###### [Configure antivirus exclusions on Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) + +##### [Configure scanning options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) + +#### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) +##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) +##### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) +##### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) +##### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) +##### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) +##### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) + +#### [Manage next-generation protection in your business]() +##### [Handle false positives/negatives in Windows Defender Antivirus](windows-defender-antivirus/antivirus-false-positives-negatives.md) +##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) +##### [Use Microsoft Intune and Microsoft Endpoint Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) +##### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) +##### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) +##### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) +##### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) + +### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) +#### [What's New](microsoft-defender-atp/mac-whatsnew.md) +#### [Deploy]() +##### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md) +##### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md) +##### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md) +##### [Manual deployment](microsoft-defender-atp/mac-install-manually.md) +#### [Update](microsoft-defender-atp/mac-updates.md) +#### [Configure]() +##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md) +##### [Set preferences](microsoft-defender-atp/mac-preferences.md) +##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md) +#### [Troubleshoot]() +##### [Troubleshoot installation issues](microsoft-defender-atp/mac-support-install.md) +##### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md) +##### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md) +##### [Troubleshoot license issues](microsoft-defender-atp/mac-support-license.md) +#### [Privacy](microsoft-defender-atp/mac-privacy.md) +#### [Resources](microsoft-defender-atp/mac-resources.md) + + +### [Microsoft Defender Advanced Threat Protection for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md) +#### [Deploy]() +##### [Manual deployment](microsoft-defender-atp/linux-install-manually.md) +##### [Puppet based deployment](microsoft-defender-atp/linux-install-with-puppet.md) +##### [Ansible based deployment](microsoft-defender-atp/linux-install-with-ansible.md) +#### [Update](microsoft-defender-atp/linux-updates.md) +#### [Configure]() +##### [Static proxy configuration](microsoft-defender-atp/linux-static-proxy-configuration.md) +##### [Set preferences](microsoft-defender-atp/linux-preferences.md) +#### [Resources](microsoft-defender-atp/linux-resources.md) + +### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md) + + @@ -173,170 +341,6 @@ #### [Increase compliance to the security baseline](microsoft-defender-atp/configure-machines-security-baseline.md) #### [Optimize ASR rule deployment and detections](microsoft-defender-atp/configure-machines-asr.md) -### [Manage capabilities]() - -#### [Configure attack surface reduction]() -##### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md) - -#### [Hardware-based isolation]() -##### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) - -##### [Application isolation]() -###### [Install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -###### [Application control](windows-defender-application-control/windows-defender-application-control.md) - -##### [Device control]() -###### [Control USB devices](device-control/control-usb-devices-using-intune.md) - -###### [Device Guard]() -####### [Code integrity](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) - -####### [Memory integrity]() -######## [Understand memory integrity](device-guard/memory-integrity.md) -######## [Hardware qualifications](device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) -######## [Enable HVCI](device-guard/enable-virtualization-based-protection-of-code-integrity.md) - -##### [Exploit protection]() -###### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md) -###### [Import/export configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md) - -##### [Network protection](microsoft-defender-atp/enable-network-protection.md) -##### [Controlled folder access](microsoft-defender-atp/enable-controlled-folders.md) - -##### [Attack surface reduction controls]() -###### [Enable attack surface reduction rules](microsoft-defender-atp/enable-attack-surface-reduction.md) -###### [Customize attack surface reduction](microsoft-defender-atp/customize-attack-surface-reduction.md) - -##### [Network firewall](windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md) - -#### [Configure next-generation protection]() -##### [Configure Windows Defender Antivirus features](windows-defender-antivirus/configure-windows-defender-antivirus-features.md) - -##### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -###### [Enable cloud-delivered protection](windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) -###### [Specify the cloud-delivered protection level](windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md) -###### [Configure and validate network connections](windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md) -###### [Prevent security settings changes with tamper protection](windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md) -###### [Enable Block at first sight](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md) -###### [Configure the cloud block timeout period](windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md) - -##### [Configure behavioral, heuristic, and real-time protection]() -###### [Configuration overview](windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md) -###### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) -###### [Enable and configure always-on protection and monitoring](windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) - -##### [Antivirus on Windows Server 2016](windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md) - -##### [Antivirus compatibility]() -###### [Compatibility charts](windows-defender-antivirus/windows-defender-antivirus-compatibility.md) -###### [Use limited periodic antivirus scanning](windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md) - -##### [Deploy, manage updates, and report on antivirus]() -###### [Preparing to deploy](windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md) -###### [Deploy and enable antivirus](windows-defender-antivirus/deploy-windows-defender-antivirus.md) -####### [Deployment guide for VDI environments](windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md) - -###### [Report on antivirus protection]() -####### [Review protection status and alerts](windows-defender-antivirus/report-monitor-windows-defender-antivirus.md) -####### [Troubleshoot antivirus reporting in Update Compliance](windows-defender-antivirus/troubleshoot-reporting.md) - -###### [Manage updates and apply baselines]() -####### [Learn about the different kinds of updates](windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md) -####### [Manage protection and security intelligence updates](windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md) -####### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md) -####### [Manage updates for endpoints that are out of date](windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md) -####### [Manage event-based forced updates](windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md) -####### [Manage updates for mobile devices and VMs](windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md) - -##### [Customize, initiate, and review the results of scans and remediation]() -###### [Configuration overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) - -###### [Configure and validate exclusions in antivirus scans]() -####### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) -####### [Configure antivirus exclusions Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) - -###### [Configure scanning antivirus options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) -###### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -###### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) -###### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) -###### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) -###### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) - -##### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) - -##### [Manage antivirus in your business]() -###### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -###### [Use Group Policy settings to configure and manage antivirus](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -###### [Use Microsoft Endpoint Configuration Manager and Microsoft Intune to configure and manage antivirus](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -###### [Use PowerShell cmdlets to configure and manage antivirus](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -###### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -###### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) - -##### [Manage scans and remediation]() -###### [Management overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) - -###### [Configure and validate exclusions in antivirus scans]() -####### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) -####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) -####### [Configure antivirus exclusions on Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) - -###### [Configure scanning options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) - -##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -###### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -###### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) -###### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) -###### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) -###### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) -###### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) - -##### [Manage next-generation protection in your business]() -###### [Handle false positives/negatives in Windows Defender Antivirus](windows-defender-antivirus/antivirus-false-positives-negatives.md) -###### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -###### [Use Microsoft Intune and Microsoft Endpoint Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -###### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -###### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -###### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -###### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) - -#### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) -##### [What's New](microsoft-defender-atp/mac-whatsnew.md) -##### [Deploy]() -###### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md) -###### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md) -###### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md) -###### [Manual deployment](microsoft-defender-atp/mac-install-manually.md) -##### [Update](microsoft-defender-atp/mac-updates.md) -##### [Configure]() -###### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md) -###### [Set preferences](microsoft-defender-atp/mac-preferences.md) -###### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md) -##### [Troubleshoot]() -###### [Troubleshoot installation issues](microsoft-defender-atp/mac-support-install.md) -###### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md) -###### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md) -###### [Troubleshoot license issues](microsoft-defender-atp/mac-support-license.md) -##### [Privacy](microsoft-defender-atp/mac-privacy.md) -##### [Resources](microsoft-defender-atp/mac-resources.md) - - -#### [Microsoft Defender Advanced Threat Protection for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md) -##### [Deploy]() -###### [Manual deployment](microsoft-defender-atp/linux-install-manually.md) -###### [Puppet based deployment](microsoft-defender-atp/linux-install-with-puppet.md) -###### [Ansible based deployment](microsoft-defender-atp/linux-install-with-ansible.md) -##### [Update](microsoft-defender-atp/linux-updates.md) -##### [Configure]() -###### [Static proxy configuration](microsoft-defender-atp/linux-static-proxy-configuration.md) -###### [Set preferences](microsoft-defender-atp/linux-preferences.md) -##### [Resources](microsoft-defender-atp/linux-resources.md) - - -#### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md) - ### [Configure portal settings]() #### [Set up preferences](microsoft-defender-atp/preferences-setup.md) #### [General]() @@ -374,8 +378,6 @@ #### [Configure information protection in Windows](microsoft-defender-atp/information-protection-in-windows-config.md) - - ## Reference ### [Capabilities]() #### [Threat & Vulnerability Management]() @@ -590,28 +592,24 @@ ### [Information protection in Windows overview]() #### [Windows integration](microsoft-defender-atp/information-protection-in-windows-overview.md) -#### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md) -### [Evaluate Microsoft Defender ATP]() -#### [Attack surface reduction and next-generation capability evaluation]() -##### [Attack surface reduction and nex-generation evaluation overview](microsoft-defender-atp/evaluate-atp.md) -##### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) -##### [Application control](windows-defender-application-control/audit-windows-defender-application-control-policies.md) -##### [Exploit protection](microsoft-defender-atp/evaluate-exploit-protection.md) -##### [Network Protection](microsoft-defender-atp/evaluate-network-protection.md) -##### [Controlled folder access](microsoft-defender-atp/evaluate-controlled-folder-access.md) -##### [Attack surface reduction](microsoft-defender-atp/evaluate-attack-surface-reduction.md) -##### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) -##### [Evaluate next-generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md) + +### [Attack surface reduction and next-generation capability evaluation]() +#### [Attack surface reduction and nex-generation evaluation overview](microsoft-defender-atp/evaluate-atp.md) +#### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) +#### [Application control](windows-defender-application-control/audit-windows-defender-application-control-policies.md) +#### [Exploit protection](microsoft-defender-atp/evaluate-exploit-protection.md) +#### [Network Protection](microsoft-defender-atp/evaluate-network-protection.md) +#### [Controlled folder access](microsoft-defender-atp/evaluate-controlled-folder-access.md) +#### [Attack surface reduction](microsoft-defender-atp/evaluate-attack-surface-reduction.md) +#### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) +#### [Evaluate next-generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md) ### [Access the Microsoft Defender ATP Community Center](microsoft-defender-atp/community.md) - - - ### [Helpful resources](microsoft-defender-atp/helpful-resources.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md index 2e8bae4127..60580d961a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md @@ -34,7 +34,7 @@ Deploying Microsoft Defender ATP is a three-phase process: Setup the Microsoft Defender ATP service -
Phase 2: Setup
+
Phase 2: Set up
diff --git a/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md b/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md index 4c4cf5edcf..261734d68b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md +++ b/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md @@ -32,12 +32,10 @@ Inspired by the "assume breach" mindset, Microsoft Defender ATP continuously col The response capabilities give you the power to promptly remediate threats by acting on the affected entities. -## In this section -Topic | Description -:---|:--- -[Security operations dashboard](security-operations-dashboard.md) | Explore a high level overview of detections, highlighting where response actions are needed. -[Incidents queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) | View and organize the incidents queue, and manage and investigate alerts. -[Alerts queue](alerts-queue.md) | View and organize the machine alerts queue, and manage and investigate alerts. -[Machines list](machines-view-overview.md) | Investigate machines with generated alerts and search for specific events over time. -[Take response actions](response-actions.md) | Learn about the available response actions and apply them to machines and files. +## Related topics +- [Security operations dashboard](security-operations-dashboard.md) +- [Incidents queue](view-incidents-queue.md) +- [Alerts queue](alerts-queue.md) +- [Machines list](machines-view-overview.md) + diff --git a/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment.md b/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment.md index bf5f352335..2436a0642e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment.md +++ b/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment.md @@ -38,7 +38,7 @@ Deploying Microsoft Defender ATP is a three-phase process: Onboard to the Microsoft Defender ATP service -
Phase 2: Setup
+
Phase 2: Set up
@@ -180,5 +180,5 @@ how the endpoint security suite should be enabled. ## Next step ||| |:-------|:-----| -|![Phase 2: Setup](images/setup.png)
[Phase 2: Setup](production-deployment.md) | Setup Microsoft Defender ATP deployment +|![Phase 2: Setup](images/setup.png)
[Phase 2: Setup](production-deployment.md) | Set up Microsoft Defender ATP deployment diff --git a/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md b/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md index 5ee99f304a..4592526b13 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md +++ b/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md @@ -1,5 +1,5 @@ --- -title: Setup Microsoft Defender ATP deployment +title: Set up Microsoft Defender ATP deployment description: keywords: search.product: eADQiWindows 10XVcnh @@ -17,7 +17,7 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Setup Microsoft Defender ATP deployment +# Set up Microsoft Defender ATP deployment **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) @@ -36,7 +36,7 @@ Deploying Microsoft Defender ATP is a three-phase process: Onboard to the Microsoft Defender ATP service -
Phase 2: Setup
+
Phase 2: Set up
@@ -48,7 +48,7 @@ Deploying Microsoft Defender ATP is a three-phase process: -You are currently in the setup phase. +You are currently in the set up phase. In this deployment scenario, you'll be guided through the steps on: - Licensing validation @@ -88,7 +88,7 @@ To gain access into which licenses are provisioned to your company, and to check ## Tenant Configuration -When accessing [Microsoft Defender Security Center](https://securitycenter.windows.com/) for the first time there will be a setup wizard that will guide you through some initial steps. At the end of the setup wizard there will be a dedicated cloud instance of Microsoft Defender ATP created. The easiest method is to perform these steps from a Windows 10 client machine. +When accessing [Microsoft Defender Security Center](https://securitycenter.windows.com/) for the first time there will be a set up wizard that will guide you through some initial steps. At the end of the setup wizard there will be a dedicated cloud instance of Microsoft Defender ATP created. The easiest method is to perform these steps from a Windows 10 client machine. 1. From a web browser, navigate to . @@ -103,7 +103,7 @@ When accessing [Microsoft Defender Security Center](https://securitycenter.windo 4. Set up preferences. - **Data storage location** - It's important to set this up correctly. Determine where the customer wants to be primarily hosted: US, EU or UK. You cannot change the location after this setup and Microsoft will not transfer the data from the specified geolocation. + **Data storage location** - It's important to set this up correctly. Determine where the customer wants to be primarily hosted: US, EU or UK. You cannot change the location after this set up and Microsoft will not transfer the data from the specified geolocation. **Data retention** - The default is 6 months. From 91ebfbbe766890cb35bff75ba0923a67518b5d44 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 26 Mar 2020 14:05:35 -0700 Subject: [PATCH 02/26] tvm in sec admin --- windows/security/threat-protection/TOC.md | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 17feb1b4a3..6c7924f97c 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -15,27 +15,24 @@ ## [Deployment guide]() ### [Deployment phases](microsoft-defender-atp/deployment-phases.md) - ### [Phase 1: Prepare](microsoft-defender-atp/prepare-deployment.md) - ### [Phase 2: Set up](microsoft-defender-atp/production-deployment.md) - ### [Phase 3: Onboard](microsoft-defender-atp/onboarding.md) ## [Security administration]() -### [Threat & Vulnerability Management overview](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) -### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md) -### [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md) -### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) -### [Configuration score](microsoft-defender-atp/configuration-score.md) -### [Security recommendations](microsoft-defender-atp/tvm-security-recommendation.md) -### [Remediation and exception](microsoft-defender-atp/tvm-remediation.md) -### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) -### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md) -### [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md) +### [Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) +#### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md) +#### [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md) +#### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) +#### [Configuration score](microsoft-defender-atp/configuration-score.md) +#### [Security recommendations](microsoft-defender-atp/tvm-security-recommendation.md) +#### [Remediation and exception](microsoft-defender-atp/tvm-remediation.md) +#### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md) +#### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md) +#### [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md) From a1456002c3f279757bda7cdf2c89e5412a8de51d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 26 Mar 2020 14:06:44 -0700 Subject: [PATCH 03/26] remove tvm from capabilities --- windows/security/threat-protection/TOC.md | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 6c7924f97c..6f3ba775e0 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -379,9 +379,7 @@ ## Reference ### [Capabilities]() -#### [Threat & Vulnerability Management]() -##### [Next-generation capabilities](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) -##### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md) + #### [Attack surface reduction]() ##### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md) From 630e9ec0a28e87f6e67697f8a9821d57af94575a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 26 Mar 2020 14:21:39 -0700 Subject: [PATCH 04/26] asr ngp --- windows/security/threat-protection/TOC.md | 76 ++++++++++++++--------- 1 file changed, 46 insertions(+), 30 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 6f3ba775e0..2ffa79551e 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -23,7 +23,8 @@ ## [Security administration]() -### [Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) +### [Threat & Vulnerability Management]() +#### [Overview of Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md) #### [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md) #### [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md) #### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md) @@ -34,6 +35,49 @@ #### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md) #### [Scenarios](microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md) +### [Attack surface reduction]() +#### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md) +#### [Attack surface reduction FAQ](microsoft-defender-atp/attack-surface-reduction-faq.md) +#### [Hardware-based isolation]() +##### [Hardware-based isolation in Windows 10](microsoft-defender-atp/overview-hardware-based-isolation.md) +##### [Application isolation]() +###### [Application guard overview](windows-defender-application-guard/wd-app-guard-overview.md) +###### [System requirements](windows-defender-application-guard/reqs-wd-app-guard.md) + +##### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) + +#### [Application control](windows-defender-application-control/windows-defender-application-control.md) +#### [Exploit protection](microsoft-defender-atp/exploit-protection.md) +#### [Network protection](microsoft-defender-atp/network-protection.md) + +#### [Web protection]() +##### [Web protection overview](microsoft-defender-atp/web-protection-overview.md) +##### [Web threat protection]() +###### [Web threat protection overview](microsoft-defender-atp/web-threat-protection.md) +###### [Monitor web security](microsoft-defender-atp/web-protection-monitoring.md) +###### [Respond to web threats](microsoft-defender-atp/web-protection-response.md) +##### [Web content filtering](microsoft-defender-atp/web-content-filtering.md) + +#### [Controlled folder access](microsoft-defender-atp/controlled-folders.md) +#### [Attack surface reduction](microsoft-defender-atp/attack-surface-reduction.md) +#### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) + + +### [Next-generation protection]() +#### [Next-generation protection overview](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) +#### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoft-antivirus.md) +#### [Better together: Windows Defender Antivirus and Office 365](windows-defender-antivirus/office-365-windows-defender-antivirus.md) + + + + + + + + + + + @@ -381,36 +425,8 @@ ### [Capabilities]() -#### [Attack surface reduction]() -##### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md) -##### [Attack surface reduction FAQ](microsoft-defender-atp/attack-surface-reduction-faq.md) -##### [Hardware-based isolation]() -###### [Hardware-based isolation in Windows 10](microsoft-defender-atp/overview-hardware-based-isolation.md) -###### [Application isolation]() -####### [Application guard overview](windows-defender-application-guard/wd-app-guard-overview.md) -####### [System requirements](windows-defender-application-guard/reqs-wd-app-guard.md) - -###### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) - -##### [Application control](windows-defender-application-control/windows-defender-application-control.md) -##### [Exploit protection](microsoft-defender-atp/exploit-protection.md) -##### [Network protection](microsoft-defender-atp/network-protection.md) - -##### [Web protection]() -###### [Web protection overview](microsoft-defender-atp/web-protection-overview.md) -###### [Web threat protection]() -####### [Web threat protection overview](microsoft-defender-atp/web-threat-protection.md) -####### [Monitor web security](microsoft-defender-atp/web-protection-monitoring.md) -####### [Respond to web threats](microsoft-defender-atp/web-protection-response.md) -###### [Web content filtering](microsoft-defender-atp/web-content-filtering.md) - -##### [Controlled folder access](microsoft-defender-atp/controlled-folders.md) -##### [Attack surface reduction](microsoft-defender-atp/attack-surface-reduction.md) -##### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) -#### [Next-generation protection](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) -##### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoft-antivirus.md) -##### [Better together: Windows Defender Antivirus and Office 365](windows-defender-antivirus/office-365-windows-defender-antivirus.md) + #### [Endpoint detection and response](microsoft-defender-atp/overview-endpoint-detection-response.md) From d57ef79f3f3195e6d9716c5bbb5ca7bf5446f3cf Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 27 Mar 2020 09:26:11 -0700 Subject: [PATCH 05/26] update toc --- windows/security/threat-protection/TOC.md | 211 ++++------------------ 1 file changed, 35 insertions(+), 176 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 2ffa79551e..4313c921c2 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -6,6 +6,7 @@ ### [What's new in Microsoft Defender ATP](microsoft-defender-atp/whats-new-in-microsoft-defender-atp.md) ### [Preview features](microsoft-defender-atp/preview.md) ### [Data storage and privacy](microsoft-defender-atp/data-storage-privacy.md) +### [Portal overview](microsoft-defender-atp/portal-overview.md) ### [Microsoft Defender ATP for US Government Community Cloud High customers](microsoft-defender-atp/commercial-gov.md) ## [Evaluate capabilities](microsoft-defender-atp/evaluation-lab.md) @@ -37,18 +38,43 @@ ### [Attack surface reduction]() #### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md) +#### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md) #### [Attack surface reduction FAQ](microsoft-defender-atp/attack-surface-reduction-faq.md) + + +#### [Attack surface reduction controls]() +##### [Enable attack surface reduction rules](microsoft-defender-atp/enable-attack-surface-reduction.md) +##### [Customize attack surface reduction](microsoft-defender-atp/customize-attack-surface-reduction.md) + #### [Hardware-based isolation]() ##### [Hardware-based isolation in Windows 10](microsoft-defender-atp/overview-hardware-based-isolation.md) +##### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) + + + ##### [Application isolation]() ###### [Application guard overview](windows-defender-application-guard/wd-app-guard-overview.md) ###### [System requirements](windows-defender-application-guard/reqs-wd-app-guard.md) - +###### [Install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) + +##### [Application control](windows-defender-application-control/windows-defender-application-control.md) + ##### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) -#### [Application control](windows-defender-application-control/windows-defender-application-control.md) + +#### [Device control]() +##### [Control USB devices](device-control/control-usb-devices-using-intune.md) + +##### [Device Guard]() +###### [Code integrity](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) + + + #### [Exploit protection](microsoft-defender-atp/exploit-protection.md) + #### [Network protection](microsoft-defender-atp/network-protection.md) + + #### [Web protection]() ##### [Web protection overview](microsoft-defender-atp/web-protection-overview.md) @@ -75,17 +101,16 @@ - - - - - - - ## [Security operations]() -### [Portal overview](microsoft-defender-atp/portal-overview.md) + ### [Security operations dashboard](microsoft-defender-atp/security-operations-dashboard.md) +### [Endpoint detection and response]() + + + + + ### [Incidents queue]() #### [View and organize the Incidents queue](microsoft-defender-atp/view-incidents-queue.md) @@ -186,172 +211,6 @@ #### [Create and manage detection rules](microsoft-defender-atp/custom-detection-rules.md) -## [Service operations]() - -### [Configure attack surface reduction]() -#### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md) - -### [Hardware-based isolation]() -#### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) - -#### [Application isolation]() -##### [Install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -##### [Application control](windows-defender-application-control/windows-defender-application-control.md) - -#### [Device control]() -##### [Control USB devices](device-control/control-usb-devices-using-intune.md) - -##### [Device Guard]() -###### [Code integrity](device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md) - -###### [Memory integrity]() -####### [Understand memory integrity](device-guard/memory-integrity.md) -####### [Hardware qualifications](device-guard/requirements-and-deployment-planning-guidelines-for-virtualization-based-protection-of-code-integrity.md) -####### [Enable HVCI](device-guard/enable-virtualization-based-protection-of-code-integrity.md) - -#### [Exploit protection]() -##### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md) -##### [Customize exploit protection](microsoft-defender-atp/customize-exploit-protection.md) -##### [Import/export configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md) - -#### [Network protection](microsoft-defender-atp/enable-network-protection.md) -#### [Controlled folder access](microsoft-defender-atp/enable-controlled-folders.md) - -#### [Attack surface reduction controls]() -##### [Enable attack surface reduction rules](microsoft-defender-atp/enable-attack-surface-reduction.md) -##### [Customize attack surface reduction](microsoft-defender-atp/customize-attack-surface-reduction.md) - -#### [Network firewall](windows-firewall/windows-firewall-with-advanced-security-deployment-guide.md) - -### [Configure next-generation protection]() -#### [Configure Windows Defender Antivirus features](windows-defender-antivirus/configure-windows-defender-antivirus-features.md) - -#### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) -##### [Enable cloud-delivered protection](windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) -##### [Specify the cloud-delivered protection level](windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md) -##### [Configure and validate network connections](windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md) -##### [Prevent security settings changes with tamper protection](windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md) -##### [Enable Block at first sight](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md) -##### [Configure the cloud block timeout period](windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md) - -#### [Configure behavioral, heuristic, and real-time protection]() -##### [Configuration overview](windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md) -##### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) -##### [Enable and configure always-on protection and monitoring](windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) - -#### [Antivirus on Windows Server 2016](windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md) - -#### [Antivirus compatibility]() -##### [Compatibility charts](windows-defender-antivirus/windows-defender-antivirus-compatibility.md) -##### [Use limited periodic antivirus scanning](windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md) - -#### [Deploy, manage updates, and report on antivirus]() -##### [Preparing to deploy](windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md) -##### [Deploy and enable antivirus](windows-defender-antivirus/deploy-windows-defender-antivirus.md) -###### [Deployment guide for VDI environments](windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md) - -##### [Report on antivirus protection]() -###### [Review protection status and alerts](windows-defender-antivirus/report-monitor-windows-defender-antivirus.md) -###### [Troubleshoot antivirus reporting in Update Compliance](windows-defender-antivirus/troubleshoot-reporting.md) - -##### [Manage updates and apply baselines]() -###### [Learn about the different kinds of updates](windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md) -###### [Manage protection and security intelligence updates](windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md) -###### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md) -###### [Manage updates for endpoints that are out of date](windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md) -###### [Manage event-based forced updates](windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md) -###### [Manage updates for mobile devices and VMs](windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md) - -#### [Customize, initiate, and review the results of scans and remediation]() -##### [Configuration overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) - -##### [Configure and validate exclusions in antivirus scans]() -###### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) -###### [Configure antivirus exclusions Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) - -##### [Configure scanning antivirus options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) -##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -##### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) -##### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) -##### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) -##### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) - -#### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) - -#### [Manage antivirus in your business]() -##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -##### [Use Group Policy settings to configure and manage antivirus](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -##### [Use Microsoft Endpoint Configuration Manager and Microsoft Intune to configure and manage antivirus](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -##### [Use PowerShell cmdlets to configure and manage antivirus](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -##### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -##### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) - -#### [Manage scans and remediation]() -##### [Management overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) - -##### [Configure and validate exclusions in antivirus scans]() -###### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) -###### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) -###### [Configure antivirus exclusions on Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) - -##### [Configure scanning options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) - -#### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) -##### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) -##### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) -##### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) -##### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) -##### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) - -#### [Manage next-generation protection in your business]() -##### [Handle false positives/negatives in Windows Defender Antivirus](windows-defender-antivirus/antivirus-false-positives-negatives.md) -##### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) -##### [Use Microsoft Intune and Microsoft Endpoint Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) -##### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) -##### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) -##### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) -##### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) - -### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) -#### [What's New](microsoft-defender-atp/mac-whatsnew.md) -#### [Deploy]() -##### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md) -##### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md) -##### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md) -##### [Manual deployment](microsoft-defender-atp/mac-install-manually.md) -#### [Update](microsoft-defender-atp/mac-updates.md) -#### [Configure]() -##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md) -##### [Set preferences](microsoft-defender-atp/mac-preferences.md) -##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md) -#### [Troubleshoot]() -##### [Troubleshoot installation issues](microsoft-defender-atp/mac-support-install.md) -##### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md) -##### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md) -##### [Troubleshoot license issues](microsoft-defender-atp/mac-support-license.md) -#### [Privacy](microsoft-defender-atp/mac-privacy.md) -#### [Resources](microsoft-defender-atp/mac-resources.md) - - -### [Microsoft Defender Advanced Threat Protection for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md) -#### [Deploy]() -##### [Manual deployment](microsoft-defender-atp/linux-install-manually.md) -##### [Puppet based deployment](microsoft-defender-atp/linux-install-with-puppet.md) -##### [Ansible based deployment](microsoft-defender-atp/linux-install-with-ansible.md) -#### [Update](microsoft-defender-atp/linux-updates.md) -#### [Configure]() -##### [Static proxy configuration](microsoft-defender-atp/linux-static-proxy-configuration.md) -##### [Set preferences](microsoft-defender-atp/linux-preferences.md) -#### [Resources](microsoft-defender-atp/linux-resources.md) - -### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md) - - - ## [How-to]() From 364220c5a4b1b9cc2e0f1b592b0b327b3d51bafd Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 27 Mar 2020 10:09:16 -0700 Subject: [PATCH 06/26] update toc --- windows/security/threat-protection/TOC.md | 325 ++++++++++++++++------ 1 file changed, 237 insertions(+), 88 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 4313c921c2..46ad33286e 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -38,16 +38,20 @@ ### [Attack surface reduction]() #### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md) +#### [Attack surface reduction and nex-generation evaluation overview](microsoft-defender-atp/evaluate-atp.md) +#### [Attack surface reduction evaluation](microsoft-defender-atp/evaluate-attack-surface-reduction.md) #### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md) #### [Attack surface reduction FAQ](microsoft-defender-atp/attack-surface-reduction-faq.md) #### [Attack surface reduction controls]() +##### [Attack surface reduction rules](microsoft-defender-atp/attack-surface-reduction.md) ##### [Enable attack surface reduction rules](microsoft-defender-atp/enable-attack-surface-reduction.md) ##### [Customize attack surface reduction](microsoft-defender-atp/customize-attack-surface-reduction.md) #### [Hardware-based isolation]() ##### [Hardware-based isolation in Windows 10](microsoft-defender-atp/overview-hardware-based-isolation.md) +##### [Hardware-based isolation evaluation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) ##### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) @@ -58,6 +62,7 @@ ###### [Install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) ##### [Application control](windows-defender-application-control/windows-defender-application-control.md) +#### [Audit Application control policies](windows-defender-application-control/audit-windows-defender-application-control-policies.md) ##### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) @@ -71,9 +76,11 @@ #### [Exploit protection](microsoft-defender-atp/exploit-protection.md) +##### [Exploit protection evaluation](microsoft-defender-atp/evaluate-exploit-protection.md) + #### [Network protection](microsoft-defender-atp/network-protection.md) - +##### [Network Protection evaluation](microsoft-defender-atp/evaluate-network-protection.md) #### [Web protection]() @@ -85,93 +92,256 @@ ##### [Web content filtering](microsoft-defender-atp/web-content-filtering.md) #### [Controlled folder access](microsoft-defender-atp/controlled-folders.md) -#### [Attack surface reduction](microsoft-defender-atp/attack-surface-reduction.md) +##### [Controlled folder access evaluation](microsoft-defender-atp/evaluate-controlled-folder-access.md) + + + #### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) +##### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) ### [Next-generation protection]() #### [Next-generation protection overview](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) +#### [Evaluate next-generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md) + + + + +#### [Configure next-generation protection]() +##### [Configure Windows Defender Antivirus features](windows-defender-antivirus/configure-windows-defender-antivirus-features.md) + +##### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus.md) +###### [Enable cloud-delivered protection](windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus.md) +###### [Specify the cloud-delivered protection level](windows-defender-antivirus/specify-cloud-protection-level-windows-defender-antivirus.md) +###### [Configure and validate network connections](windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md) +###### [Prevent security settings changes with tamper protection](windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md) +###### [Enable Block at first sight](windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus.md) +###### [Configure the cloud block timeout period](windows-defender-antivirus/configure-cloud-block-timeout-period-windows-defender-antivirus.md) + +##### [Configure behavioral, heuristic, and real-time protection]() +###### [Configuration overview](windows-defender-antivirus/configure-protection-features-windows-defender-antivirus.md) +###### [Detect and block Potentially Unwanted Applications](windows-defender-antivirus/detect-block-potentially-unwanted-apps-windows-defender-antivirus.md) +###### [Enable and configure always-on protection and monitoring](windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md) + +##### [Antivirus on Windows Server 2016](windows-defender-antivirus/windows-defender-antivirus-on-windows-server-2016.md) + +##### [Antivirus compatibility]() +###### [Compatibility charts](windows-defender-antivirus/windows-defender-antivirus-compatibility.md) +###### [Use limited periodic antivirus scanning](windows-defender-antivirus/limited-periodic-scanning-windows-defender-antivirus.md) + +##### [Deploy, manage updates, and report on antivirus]() +###### [Preparing to deploy](windows-defender-antivirus/deploy-manage-report-windows-defender-antivirus.md) +###### [Deploy and enable antivirus](windows-defender-antivirus/deploy-windows-defender-antivirus.md) +####### [Deployment guide for VDI environments](windows-defender-antivirus/deployment-vdi-windows-defender-antivirus.md) + +###### [Report on antivirus protection]() +####### [Review protection status and alerts](windows-defender-antivirus/report-monitor-windows-defender-antivirus.md) +####### [Troubleshoot antivirus reporting in Update Compliance](windows-defender-antivirus/troubleshoot-reporting.md) + +###### [Manage updates and apply baselines]() +####### [Learn about the different kinds of updates](windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md) +####### [Manage protection and security intelligence updates](windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md) +####### [Manage when protection updates should be downloaded and applied](windows-defender-antivirus/manage-protection-update-schedule-windows-defender-antivirus.md) +####### [Manage updates for endpoints that are out of date](windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md) +####### [Manage event-based forced updates](windows-defender-antivirus/manage-event-based-updates-windows-defender-antivirus.md) +####### [Manage updates for mobile devices and VMs](windows-defender-antivirus/manage-updates-mobile-devices-vms-windows-defender-antivirus.md) + +##### [Customize, initiate, and review the results of scans and remediation]() +###### [Configuration overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) + +###### [Configure and validate exclusions in antivirus scans]() +####### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) +####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) +####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) +####### [Configure antivirus exclusions Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) + +###### [Configure scanning antivirus options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) +###### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) +###### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) +###### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) +###### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) +###### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) + +##### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) + +##### [Manage antivirus in your business]() +###### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) +###### [Use Group Policy settings to configure and manage antivirus](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) +###### [Use Microsoft Endpoint Configuration Manager and Microsoft Intune to configure and manage antivirus](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) +###### [Use PowerShell cmdlets to configure and manage antivirus](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) +###### [Use Windows Management Instrumentation (WMI) to configure and manage antivirus](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) +###### [Use the mpcmdrun.exe commandline tool to configure and manage antivirus](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) + +##### [Manage scans and remediation]() +###### [Management overview](windows-defender-antivirus/customize-run-review-remediate-scans-windows-defender-antivirus.md) + +###### [Configure and validate exclusions in antivirus scans]() +####### [Exclusions overview](windows-defender-antivirus/configure-exclusions-windows-defender-antivirus.md) +####### [Configure and validate exclusions based on file name, extension, and folder location](windows-defender-antivirus/configure-extension-file-exclusions-windows-defender-antivirus.md) +####### [Configure and validate exclusions for files opened by processes](windows-defender-antivirus/configure-process-opened-file-exclusions-windows-defender-antivirus.md) +####### [Configure antivirus exclusions on Windows Server 2016](windows-defender-antivirus/configure-server-exclusions-windows-defender-antivirus.md) + +###### [Configure scanning options](windows-defender-antivirus/configure-advanced-scan-types-windows-defender-antivirus.md) + +##### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) +###### [Configure remediation for scans](windows-defender-antivirus/configure-remediation-windows-defender-antivirus.md) +###### [Configure scheduled scans](windows-defender-antivirus/scheduled-catch-up-scans-windows-defender-antivirus.md) +###### [Configure and run scans](windows-defender-antivirus/run-scan-windows-defender-antivirus.md) +###### [Review scan results](windows-defender-antivirus/review-scan-results-windows-defender-antivirus.md) +###### [Run and review the results of an offline scan](windows-defender-antivirus/windows-defender-offline.md) +###### [Restore quarantined files](windows-defender-antivirus/restore-quarantined-files-windows-defender-antivirus.md) + +##### [Manage next-generation protection in your business]() +###### [Handle false positives/negatives in Windows Defender Antivirus](windows-defender-antivirus/antivirus-false-positives-negatives.md) +###### [Management overview](windows-defender-antivirus/configuration-management-reference-windows-defender-antivirus.md) +###### [Use Microsoft Intune and Microsoft Endpoint Configuration Manager to manage next generation protection](windows-defender-antivirus/use-intune-config-manager-windows-defender-antivirus.md) +###### [Use Group Policy settings to manage next generation protection](windows-defender-antivirus/use-group-policy-windows-defender-antivirus.md) +###### [Use PowerShell cmdlets to manage next generation protection](windows-defender-antivirus/use-powershell-cmdlets-windows-defender-antivirus.md) +###### [Use Windows Management Instrumentation (WMI) to manage next generation protection](windows-defender-antivirus/use-wmi-windows-defender-antivirus.md) +###### [Use the mpcmdrun.exe command line tool to manage next generation protection](windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md) + + + #### [Better together: Windows Defender Antivirus and Microsoft Defender ATP](windows-defender-antivirus/why-use-microsoft-antivirus.md) #### [Better together: Windows Defender Antivirus and Office 365](windows-defender-antivirus/office-365-windows-defender-antivirus.md) +### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) +#### [What's New](microsoft-defender-atp/mac-whatsnew.md) +#### [Deploy]() +##### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md) +##### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md) +##### [Deployment with a different Mobile Device Management (MDM) system](microsoft-defender-atp/mac-install-with-other-mdm.md) +##### [Manual deployment](microsoft-defender-atp/mac-install-manually.md) +#### [Update](microsoft-defender-atp/mac-updates.md) +#### [Configure]() +##### [Configure and validate exclusions](microsoft-defender-atp/mac-exclusions.md) +##### [Set preferences](microsoft-defender-atp/mac-preferences.md) +##### [Detect and block Potentially Unwanted Applications](microsoft-defender-atp/mac-pua.md) +#### [Troubleshoot]() +##### [Troubleshoot installation issues](microsoft-defender-atp/mac-support-install.md) +##### [Troubleshoot performance issues](microsoft-defender-atp/mac-support-perf.md) +##### [Troubleshoot kernel extension issues](microsoft-defender-atp/mac-support-kext.md) +##### [Troubleshoot license issues](microsoft-defender-atp/mac-support-license.md) +#### [Privacy](microsoft-defender-atp/mac-privacy.md) +#### [Resources](microsoft-defender-atp/mac-resources.md) +### [Microsoft Defender Advanced Threat Protection for Linux](microsoft-defender-atp/microsoft-defender-atp-linux.md) +#### [Deploy]() +##### [Manual deployment](microsoft-defender-atp/linux-install-manually.md) +##### [Puppet based deployment](microsoft-defender-atp/linux-install-with-puppet.md) +##### [Ansible based deployment](microsoft-defender-atp/linux-install-with-ansible.md) +#### [Update](microsoft-defender-atp/linux-updates.md) +#### [Configure]() +##### [Static proxy configuration](microsoft-defender-atp/linux-static-proxy-configuration.md) +##### [Set preferences](microsoft-defender-atp/linux-preferences.md) +#### [Resources](microsoft-defender-atp/linux-resources.md) - - - +### [Configure and manage Microsoft Threat Experts capabilities](microsoft-defender-atp/configure-microsoft-threat-experts.md) ## [Security operations]() ### [Security operations dashboard](microsoft-defender-atp/security-operations-dashboard.md) ### [Endpoint detection and response]() +#### [Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md) + +#### [Incidents queue]() +##### [View and organize the Incidents queue](microsoft-defender-atp/view-incidents-queue.md) +##### [Manage incidents](microsoft-defender-atp/manage-incidents.md) +##### [Investigate incidents](microsoft-defender-atp/investigate-incidents.md) + +#### [Alerts queue]() +##### [View and organize the Alerts queue](microsoft-defender-atp/alerts-queue.md) +##### [Manage alerts](microsoft-defender-atp/manage-alerts.md) +##### [Investigate alerts](microsoft-defender-atp/investigate-alerts.md) +##### [Investigate files](microsoft-defender-atp/investigate-files.md) +##### [Investigate machines](microsoft-defender-atp/investigate-machines.md) +##### [Investigate an IP address](microsoft-defender-atp/investigate-ip.md) +##### [Investigate a domain](microsoft-defender-atp/investigate-domain.md) +###### [Investigate connection events that occur behind forward proxies](microsoft-defender-atp/investigate-behind-proxy.md) +##### [Investigate a user account](microsoft-defender-atp/investigate-user.md) + +#### [Machines list]() +##### [View and organize the Machines list](microsoft-defender-atp/machines-view-overview.md) +##### [Manage machine group and tags](microsoft-defender-atp/machine-tags.md) + +#### [Take response actions]() +##### [Take response actions on a machine]() +###### [Response actions on machines](microsoft-defender-atp/respond-machine-alerts.md) +###### [Manage tags](microsoft-defender-atp/respond-machine-alerts.md#manage-tags) +###### [Initiate an automated investigation](microsoft-defender-atp/respond-machine-alerts.md#initiate-automated-investigation) +###### [Initiate Live Response session](microsoft-defender-atp/respond-machine-alerts.md#initiate-live-response-session) +###### [Collect investigation package](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-machines) +###### [Run antivirus scan](microsoft-defender-atp/respond-machine-alerts.md#run-windows-defender-antivirus-scan-on-machines) +###### [Restrict app execution](microsoft-defender-atp/respond-machine-alerts.md#restrict-app-execution) +###### [Isolate machines from the network](microsoft-defender-atp/respond-machine-alerts.md#isolate-machines-from-the-network) +###### [Consult a threat expert](microsoft-defender-atp/respond-machine-alerts.md#consult-a-threat-expert) +###### [Check activity details in Action center](microsoft-defender-atp/respond-machine-alerts.md#check-activity-details-in-action-center) + +##### [Take response actions on a file]() +###### [Response actions on files](microsoft-defender-atp/respond-file-alerts.md) +###### [Stop and quarantine files in your network](microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network) +###### [Restore file from quarantine](microsoft-defender-atp/respond-file-alerts.md#restore-file-from-quarantine) +###### [Add indicators to block or allow a file](microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) +###### [Consult a threat expert](microsoft-defender-atp/respond-file-alerts.md#consult-a-threat-expert) +###### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center) +###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file) +###### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis) +###### [Submit files for analysis](microsoft-defender-atp/respond-file-alerts.md#submit-files-for-analysis) +###### [View deep analysis reports](microsoft-defender-atp/respond-file-alerts.md#view-deep-analysis-reports) +###### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis) + +#### [View and approve remediation actions](microsoft-defender-atp/manage-auto-investigation.md) +##### [View details and results of automated investigations](microsoft-defender-atp/auto-investigation-action-center.md) + +#### [Investigate entities using Live response]() +##### [Investigate entities on machines](microsoft-defender-atp/live-response.md) +##### [Live response command examples](microsoft-defender-atp/live-response-command-examples.md) -### [Incidents queue]() -#### [View and organize the Incidents queue](microsoft-defender-atp/view-incidents-queue.md) -#### [Manage incidents](microsoft-defender-atp/manage-incidents.md) -#### [Investigate incidents](microsoft-defender-atp/investigate-incidents.md) - -### [Alerts queue]() -#### [View and organize the Alerts queue](microsoft-defender-atp/alerts-queue.md) -#### [Manage alerts](microsoft-defender-atp/manage-alerts.md) -#### [Investigate alerts](microsoft-defender-atp/investigate-alerts.md) -#### [Investigate files](microsoft-defender-atp/investigate-files.md) -#### [Investigate machines](microsoft-defender-atp/investigate-machines.md) -#### [Investigate an IP address](microsoft-defender-atp/investigate-ip.md) -#### [Investigate a domain](microsoft-defender-atp/investigate-domain.md) -##### [Investigate connection events that occur behind forward proxies](microsoft-defender-atp/investigate-behind-proxy.md) -#### [Investigate a user account](microsoft-defender-atp/investigate-user.md) - -### [Machines list]() -#### [View and organize the Machines list](microsoft-defender-atp/machines-view-overview.md) -#### [Manage machine group and tags](microsoft-defender-atp/machine-tags.md) - -### [Take response actions]() -#### [Take response actions on a machine]() -##### [Response actions on machines](microsoft-defender-atp/respond-machine-alerts.md) -##### [Manage tags](microsoft-defender-atp/respond-machine-alerts.md#manage-tags) -##### [Initiate an automated investigation](microsoft-defender-atp/respond-machine-alerts.md#initiate-automated-investigation) -##### [Initiate Live Response session](microsoft-defender-atp/respond-machine-alerts.md#initiate-live-response-session) -##### [Collect investigation package](microsoft-defender-atp/respond-machine-alerts.md#collect-investigation-package-from-machines) -##### [Run antivirus scan](microsoft-defender-atp/respond-machine-alerts.md#run-windows-defender-antivirus-scan-on-machines) -##### [Restrict app execution](microsoft-defender-atp/respond-machine-alerts.md#restrict-app-execution) -##### [Isolate machines from the network](microsoft-defender-atp/respond-machine-alerts.md#isolate-machines-from-the-network) -##### [Consult a threat expert](microsoft-defender-atp/respond-machine-alerts.md#consult-a-threat-expert) -##### [Check activity details in Action center](microsoft-defender-atp/respond-machine-alerts.md#check-activity-details-in-action-center) - -#### [Take response actions on a file]() -##### [Response actions on files](microsoft-defender-atp/respond-file-alerts.md) -##### [Stop and quarantine files in your network](microsoft-defender-atp/respond-file-alerts.md#stop-and-quarantine-files-in-your-network) -##### [Restore file from quarantine](microsoft-defender-atp/respond-file-alerts.md#restore-file-from-quarantine) -##### [Add indicators to block or allow a file](microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) -##### [Consult a threat expert](microsoft-defender-atp/respond-file-alerts.md#consult-a-threat-expert) -##### [Check activity details in Action center](microsoft-defender-atp/respond-file-alerts.md#check-activity-details-in-action-center) -##### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file) -##### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis) -##### [Submit files for analysis](microsoft-defender-atp/respond-file-alerts.md#submit-files-for-analysis) -##### [View deep analysis reports](microsoft-defender-atp/respond-file-alerts.md#view-deep-analysis-reports) -##### [Troubleshoot deep analysis](microsoft-defender-atp/respond-file-alerts.md#troubleshoot-deep-analysis) - -### [View and approve remediation actions](microsoft-defender-atp/manage-auto-investigation.md) -#### [View details and results of automated investigations](microsoft-defender-atp/auto-investigation-action-center.md) -### [Investigate entities using Live response]() -#### [Investigate entities on machines](microsoft-defender-atp/live-response.md) -#### [Live response command examples](microsoft-defender-atp/live-response-command-examples.md) -### [Threat analytics](microsoft-defender-atp/threat-analytics.md) -### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md) + + + + + + + + +##### [Shadow protection?](windows-defender-antivirus/shadow-protection.md) + +#### [Use sensitivity labels to prioritize incident response](microsoft-defender-atp/information-protection-investigation.md) + +#### [Reporting]() +##### [Power BI - How to use API - Samples](microsoft-defender-atp/api-power-bi.md) +##### [Create and build Power BI reports using Microsoft Defender ATP data connectors (deprecated)](microsoft-defender-atp/powerbi-reports.md) +##### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md) +#### [Machine health and compliance reports](microsoft-defender-atp/machine-reports.md) + + +#### [Custom detections]() +##### [Understand custom detections](microsoft-defender-atp/overview-custom-detections.md) +##### [Create and manage detection rules](microsoft-defender-atp/custom-detection-rules.md) + + + + + + +### [Automated investigation and response]() +#### [Overview of AIR](microsoft-defender-atp/automated-investigations.md) + ### [Advanced hunting]() #### [Advanced hunting overview](microsoft-defender-atp/advanced-hunting-overview.md) #### [Learn the query language](microsoft-defender-atp/advanced-hunting-query-language.md) @@ -198,17 +368,14 @@ ### [Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md) -### [Reporting]() -#### [Power BI - How to use API - Samples](microsoft-defender-atp/api-power-bi.md) -#### [Create and build Power BI reports using Microsoft Defender ATP data connectors (deprecated)](microsoft-defender-atp/powerbi-reports.md) -#### [Threat protection reports](microsoft-defender-atp/threat-protection-reports.md) -#### [Machine health and compliance reports](microsoft-defender-atp/machine-reports.md) +### [Threat analytics](microsoft-defender-atp/threat-analytics.md) + + + + -### [Custom detections]() -#### [Understand custom detections](microsoft-defender-atp/overview-custom-detections.md) -#### [Create and manage detection rules](microsoft-defender-atp/custom-detection-rules.md) @@ -281,18 +448,6 @@ ## Reference -### [Capabilities]() - - - - - - -#### [Endpoint detection and response](microsoft-defender-atp/overview-endpoint-detection-response.md) -##### [Shadow protection](windows-defender-antivirus/shadow-protection.md) - -#### [Overview of AIR](microsoft-defender-atp/automated-investigations.md) - ### [Management and APIs]() #### [Overview of management and APIs](microsoft-defender-atp/management-apis.md) @@ -466,16 +621,10 @@ -### [Attack surface reduction and next-generation capability evaluation]() -#### [Attack surface reduction and nex-generation evaluation overview](microsoft-defender-atp/evaluate-atp.md) -#### [Hardware-based isolation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) -#### [Application control](windows-defender-application-control/audit-windows-defender-application-control-policies.md) -#### [Exploit protection](microsoft-defender-atp/evaluate-exploit-protection.md) -#### [Network Protection](microsoft-defender-atp/evaluate-network-protection.md) -#### [Controlled folder access](microsoft-defender-atp/evaluate-controlled-folder-access.md) -#### [Attack surface reduction](microsoft-defender-atp/evaluate-attack-surface-reduction.md) -#### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) -#### [Evaluate next-generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md) + + + + From 5261fbf452eef8581612d6f7559e9ec0a22f4819 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 27 Mar 2020 11:13:02 -0700 Subject: [PATCH 07/26] update asr capabilities titles --- windows/security/threat-protection/TOC.md | 35 +++++++++-------------- 1 file changed, 14 insertions(+), 21 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index 46ad33286e..c9377ba00c 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -38,7 +38,6 @@ ### [Attack surface reduction]() #### [Overview of attack surface reduction](microsoft-defender-atp/overview-attack-surface-reduction.md) -#### [Attack surface reduction and nex-generation evaluation overview](microsoft-defender-atp/evaluate-atp.md) #### [Attack surface reduction evaluation](microsoft-defender-atp/evaluate-attack-surface-reduction.md) #### [Attack surface reduction configuration settings](microsoft-defender-atp/configure-attack-surface-reduction.md) #### [Attack surface reduction FAQ](microsoft-defender-atp/attack-surface-reduction-faq.md) @@ -47,14 +46,11 @@ #### [Attack surface reduction controls]() ##### [Attack surface reduction rules](microsoft-defender-atp/attack-surface-reduction.md) ##### [Enable attack surface reduction rules](microsoft-defender-atp/enable-attack-surface-reduction.md) -##### [Customize attack surface reduction](microsoft-defender-atp/customize-attack-surface-reduction.md) +##### [Customize attack surface reduction rules](microsoft-defender-atp/customize-attack-surface-reduction.md) #### [Hardware-based isolation]() ##### [Hardware-based isolation in Windows 10](microsoft-defender-atp/overview-hardware-based-isolation.md) ##### [Hardware-based isolation evaluation](windows-defender-application-guard/test-scenarios-wd-app-guard.md) -##### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) - - ##### [Application isolation]() ###### [Application guard overview](windows-defender-application-guard/wd-app-guard-overview.md) @@ -62,7 +58,9 @@ ###### [Install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) ##### [Application control](windows-defender-application-control/windows-defender-application-control.md) -#### [Audit Application control policies](windows-defender-application-control/audit-windows-defender-application-control-policies.md) +###### [Audit Application control policies](windows-defender-application-control/audit-windows-defender-application-control-policies.md) + +##### [System isolation](windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) ##### [System integrity](windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) @@ -75,12 +73,14 @@ -#### [Exploit protection](microsoft-defender-atp/exploit-protection.md) +#### [Exploit protection]() +##### [Protect devices from exploits](microsoft-defender-atp/exploit-protection.md) ##### [Exploit protection evaluation](microsoft-defender-atp/evaluate-exploit-protection.md) -#### [Network protection](microsoft-defender-atp/network-protection.md) -##### [Network Protection evaluation](microsoft-defender-atp/evaluate-network-protection.md) +#### [Network protection]() +##### [Protect your network](microsoft-defender-atp/network-protection.md) +##### [Network protection evaluation](microsoft-defender-atp/evaluate-network-protection.md) #### [Web protection]() @@ -91,13 +91,15 @@ ###### [Respond to web threats](microsoft-defender-atp/web-protection-response.md) ##### [Web content filtering](microsoft-defender-atp/web-content-filtering.md) -#### [Controlled folder access](microsoft-defender-atp/controlled-folders.md) +#### [Controlled folder access]() +##### [Protect folders](microsoft-defender-atp/controlled-folders.md) ##### [Controlled folder access evaluation](microsoft-defender-atp/evaluate-controlled-folder-access.md) -#### [Network firewall](windows-firewall/windows-firewall-with-advanced-security.md) -##### [Network firewall](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) +#### [Network firewall] +##### [Network firewall overview](windows-firewall/windows-firewall-with-advanced-security.md) +##### [Network firewall evaluation](windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md) ### [Next-generation protection]() @@ -619,15 +621,6 @@ ### [Information protection in Windows overview]() #### [Windows integration](microsoft-defender-atp/information-protection-in-windows-overview.md) - - - - - - - - - ### [Access the Microsoft Defender ATP Community Center](microsoft-defender-atp/community.md) ### [Helpful resources](microsoft-defender-atp/helpful-resources.md) From a3116773f9b20e91f287202c70942d8453542d6e Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 27 Mar 2020 11:16:45 -0700 Subject: [PATCH 08/26] edr section updates --- windows/security/threat-protection/TOC.md | 23 ++--------------------- 1 file changed, 2 insertions(+), 21 deletions(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index c9377ba00c..631d0c90f2 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -106,9 +106,6 @@ #### [Next-generation protection overview](windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md) #### [Evaluate next-generation protection](windows-defender-antivirus/evaluate-windows-defender-antivirus.md) - - - #### [Configure next-generation protection]() ##### [Configure Windows Defender Antivirus features](windows-defender-antivirus/configure-windows-defender-antivirus-features.md) @@ -243,11 +240,11 @@ ## [Security operations]() -### [Security operations dashboard](microsoft-defender-atp/security-operations-dashboard.md) + ### [Endpoint detection and response]() #### [Endpoint detection and response overview](microsoft-defender-atp/overview-endpoint-detection-response.md) - +#### [Security operations dashboard](microsoft-defender-atp/security-operations-dashboard.md) #### [Incidents queue]() ##### [View and organize the Incidents queue](microsoft-defender-atp/view-incidents-queue.md) ##### [Manage incidents](microsoft-defender-atp/manage-incidents.md) @@ -304,22 +301,6 @@ - - - - - - - - - - - - - - - - ##### [Shadow protection?](windows-defender-antivirus/shadow-protection.md) From 913a0f4348b2548826571426d0ad0ce82c2566fd Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Mar 2020 15:05:15 -0700 Subject: [PATCH 09/26] add log analytics proxy info --- .../microsoft-defender-atp/configure-proxy-internet.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index f810639c75..c6e9501477 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -120,6 +120,16 @@ United States | ```us.vortex-win.data.microsoft.com```
```ussus1eastprod.bl If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs. +### Log analytics agent requirements + +The information below list the proxy and firewall configuration information required to communicate with log analytics. + +|Agent Resource|Ports |Direction |Bypass HTTPS inspection| +|------|---------|--------|--------| +|*.ods.opinsights.azure.com |Port 443 |Outbound|Yes | +|*.oms.opinsights.azure.com |Port 443 |Outbound|Yes | +|*.blob.core.windows.net |Port 443 |Outbound|Yes | + ## Microsoft Defender ATP service backend IP range If your network devices don't support the URLs added to an "allow" list in the prior section, you can use the following information. From dd38b1b8e1f1a541fb11d6e96207edf274f10fbf Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 30 Mar 2020 15:39:16 -0700 Subject: [PATCH 10/26] update --- .../microsoft-defender-atp/configure-proxy-internet.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index c6e9501477..289aefb10c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -122,7 +122,7 @@ If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP ### Log analytics agent requirements -The information below list the proxy and firewall configuration information required to communicate with log analytics. +The information below list the proxy and firewall configuration information required to communicate with log analytics agent (previously known as Microsoft Monitoring Agent) for the downlevel versions of Windows such as Windows 7 SP1, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, and Windows Server 2016. |Agent Resource|Ports |Direction |Bypass HTTPS inspection| |------|---------|--------|--------| From 3d6a0798086a715753948a27ca6e5944ddd5ea52 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 1 Apr 2020 10:45:22 -0700 Subject: [PATCH 11/26] update to plan deployment --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index fa410458f2..ba28444e6d 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -11,7 +11,7 @@ ## [Evaluate capabilities](microsoft-defender-atp/evaluation-lab.md) -## [Deployment strategy](microsoft-defender-atp/deployment-strategy.md) +## [Plan deployment](microsoft-defender-atp/deployment-strategy.md) ## [Deployment guide]() From d1a3b471f985382b624eee9566bfe9a7a5231da9 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 1 Apr 2020 11:05:32 -0700 Subject: [PATCH 12/26] update link --- .../microsoft-defender-atp/configure-server-endpoints.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index 75e7f8f006..e1b6576f62 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -113,7 +113,7 @@ The following steps are required to enable this integration: On the **Agent Setup Options** page, choose **Connect the agent to Azure Log Analytics (OMS)**. - [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script). -3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#configure-proxy-settings). +3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](configure-proxy-internet.md). Once completed, you should see onboarded servers in the portal within an hour. From ef2f8e295ad772fff982f89a0a1989a8181dfd91 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 1 Apr 2020 11:33:47 -0700 Subject: [PATCH 13/26] tweak --- .../microsoft-defender-atp/configure-proxy-internet.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index 289aefb10c..78013f4a20 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -122,7 +122,7 @@ If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP ### Log analytics agent requirements -The information below list the proxy and firewall configuration information required to communicate with log analytics agent (previously known as Microsoft Monitoring Agent) for the downlevel versions of Windows such as Windows 7 SP1, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, and Windows Server 2016. +The information below list the proxy and firewall configuration information required to communicate with Log Analytics agent (often referred to as Microsoft Monitoring Agent) for the previous versions of Windows such as Windows 7 SP1, Windows 8.1, Windows Server 2008 R2, Windows Server 2012 R2, and Windows Server 2016. |Agent Resource|Ports |Direction |Bypass HTTPS inspection| |------|---------|--------|--------| From a0a3e8ebebc6c1b5ee9517c76f11ebedb0db6833 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 1 Apr 2020 11:37:09 -0700 Subject: [PATCH 14/26] fix skip level --- windows/security/threat-protection/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index c17f1a7e6f..79657f9ac7 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -205,7 +205,7 @@ ### [Microsoft Defender Advanced Threat Protection for Mac](microsoft-defender-atp/microsoft-defender-atp-mac.md) -##### [What's New](microsoft-defender-atp/mac-whatsnew.md) +#### [What's New](microsoft-defender-atp/mac-whatsnew.md) ##### [Deploy]() ###### [Microsoft Intune-based deployment](microsoft-defender-atp/mac-install-with-intune.md) ###### [JAMF-based deployment](microsoft-defender-atp/mac-install-with-jamf.md) From 72b1791ef133d85c306b82d695d13a24542b914c Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Wed, 1 Apr 2020 12:48:11 -0700 Subject: [PATCH 15/26] Update app-v-51-supported-configurations.md --- mdop/appv-v5/app-v-51-supported-configurations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/appv-v5/app-v-51-supported-configurations.md b/mdop/appv-v5/app-v-51-supported-configurations.md index a6aa8d9fd8..0b559966b6 100644 --- a/mdop/appv-v5/app-v-51-supported-configurations.md +++ b/mdop/appv-v5/app-v-51-supported-configurations.md @@ -151,7 +151,7 @@ The following table lists the SQL Server versions that are supported for the App - +For more information on user configuration files with SQL server 2016 or later, see the support article. ### Publishing server operating system requirements From ab062c9150dfb9e3580b3987178599a5964ae8ed Mon Sep 17 00:00:00 2001 From: Jreeds001 Date: Wed, 1 Apr 2020 13:09:40 -0700 Subject: [PATCH 16/26] Update app-v-51-supported-configurations.md --- mdop/appv-v5/app-v-51-supported-configurations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mdop/appv-v5/app-v-51-supported-configurations.md b/mdop/appv-v5/app-v-51-supported-configurations.md index 0b559966b6..09c8b0842f 100644 --- a/mdop/appv-v5/app-v-51-supported-configurations.md +++ b/mdop/appv-v5/app-v-51-supported-configurations.md @@ -151,7 +151,7 @@ The following table lists the SQL Server versions that are supported for the App -For more information on user configuration files with SQL server 2016 or later, see the support article. +For more information on user configuration files with SQL server 2016 or later, see the [support article](https://support.microsoft.com/help/4548751/app-v-server-publishing-might-fail-when-you-apply-user-configuration-f). ### Publishing server operating system requirements From 8d5af0618d9e2ce7d29db7a922569795dd6bd6b4 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 1 Apr 2020 14:00:03 -0700 Subject: [PATCH 17/26] Acrolinx: fixed "Micrsoft" in title and H1 --- .../threat-protection/microsoft-defender-atp/onboarding.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md index 60580d961a..ef66ee021f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md @@ -1,5 +1,5 @@ --- -title: Onboard to the Micrsoft Defender ATP service +title: Onboard to the Microsoft Defender ATP service description: keywords: search.product: eADQiWindows 10XVcnh @@ -16,7 +16,7 @@ ms.collection: M365-security-compliance ms.topic: article --- -# Onboard to the Micrsoft Defender ATP service +# Onboard to the Microsoft Defender ATP service **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) From 1c295eeba9e715db5b3e8be8485abd0b961b8f21 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 1 Apr 2020 14:17:24 -0700 Subject: [PATCH 18/26] Indented some items --- .../threat-protection/microsoft-defender-atp/onboarding.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md index ef66ee021f..b77f5bd4f4 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md @@ -184,11 +184,11 @@ Before the systems can be onboarded into the workspace, the deployment scripts n Edit the InstallMMA.cmd with a text editor, such as notepad and update the following lines and save the file: - ![Image of onboarding](images/a22081b675da83e8f62a046ae6922b0d.png) + ![Image of onboarding](images/a22081b675da83e8f62a046ae6922b0d.png) Edit the ConfiguerOMSAgent.vbs with a text editor, such as notepad, and update the following lines and save the file: - ![Image of onboarding](images/09833d16df7f37eda97ea1d5009b651a.png) + ![Image of onboarding](images/09833d16df7f37eda97ea1d5009b651a.png) Microsoft Monitoring Agent (MMA) is currently (as of January 2019) supported on the following Windows Operating Systems: @@ -265,7 +265,7 @@ MMA for enrollment into the workspace. 13. Click **Next**. - ![Image of Microsoft Endpoint Configuration Manager console](images/262a41839704d6da2bbd72ed6b4a826a.png) + ![Image of Microsoft Endpoint Configuration Manager console](images/262a41839704d6da2bbd72ed6b4a826a.png) 14. Verify the configuration, then click **Next**. From e1170c3c7963774f2311faddf3721ca33e18da5f Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 1 Apr 2020 14:22:16 -0700 Subject: [PATCH 19/26] Adjusted indentation --- .../microsoft-defender-atp/production-deployment.md | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md b/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md index 4592526b13..4fabe73b03 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md +++ b/windows/security/threat-protection/microsoft-defender-atp/production-deployment.md @@ -69,9 +69,9 @@ Checking for the license state and whether it got properly provisioned, can be d 1. Alternately, in the admin center, navigate to **Billing** > **Subscriptions**. - - On the screen you will see all the provisioned licenses and their current **Status**. + On the screen you will see all the provisioned licenses and their current **Status**. - ![Image of billing licenses](images/atp-billing-subscriptions.png) + ![Image of billing licenses](images/atp-billing-subscriptions.png) ## Cloud Service Provider validation @@ -160,11 +160,8 @@ services if a computer is not permitted to connect to the Internet. The static proxy is configurable through Group Policy (GP). The group policy can be found under: -- Administrative Templates \> Windows Components \> Data Collection and - Preview Builds \> Configure Authenticated Proxy usage for the Connected User - Experience and Telemetry Service - - - Set it to **Enabled** and select **Disable Authenticated Proxy usage** + - Administrative Templates \> Windows Components \> Data Collection and Preview Builds \> Configure Authenticated Proxy usage for the Connected User Experience and Telemetry Service + - Set it to **Enabled** and select **Disable Authenticated Proxy usage** 1. Open the Group Policy Management Console. 2. Create a policy or edit an existing policy based off the organizational practices. @@ -261,4 +258,4 @@ You can find the Azure IP range on [Microsoft Azure Datacenter IP Ranges](https: ## Next step ||| |:-------|:-----| -|![Phase 3: Onboard](images/onboard.png)
[Phase 3: Onboard](onboarding.md) | Onboard devices to the service so the Microsoft Defender ATP service can get sensor data from them \ No newline at end of file +|![Phase 3: Onboard](images/onboard.png)
[Phase 3: Onboard](onboarding.md) | Onboard devices to the service so the Microsoft Defender ATP service can get sensor data from them From b9256ffa753030d1f21562b0f5240bcfecfb7036 Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 1 Apr 2020 14:29:59 -0700 Subject: [PATCH 20/26] Release notes for 100.90.27 --- .../microsoft-defender-atp/mac-whatsnew.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md index d23525631d..1a65d559a5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md @@ -26,6 +26,12 @@ ms.topic: conceptual > > If you have previously whitelisted the kernel extension as part of your remote deployment, that warning should not be presented to the end user. If you have not previously deployed a policy to whitelist the kernel extension, your users will be presented with the warning. To proactively silence the warning, you can still deploy a configuration to whitelist the kernel extension. Refer to the instructions in the [JAMF-based deployment](mac-install-with-jamf.md#approved-kernel-extension) and [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) topics. +## 100.90.27 + +- New product icon +- Other user experience improvements +- Bug fixes + ## 100.86.92 - Improvements around compatibility with Time Machine From c0528c4694265c93cae6982a5d9a0adb30001c76 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 1 Apr 2020 14:38:09 -0700 Subject: [PATCH 21/26] Indented a note in a list item --- .../microsoft-defender-atp/configure-proxy-internet.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md index 78013f4a20..4654624800 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet.md @@ -38,8 +38,8 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe - Transparent proxy - Web Proxy Auto-discovery Protocol (WPAD) -> [!NOTE] -> If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Microsoft Defender ATP URL exclusions in the proxy, see [Enable access to Microsoft Defender ATP service URLs in the proxy server](#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). + > [!NOTE] + > If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Microsoft Defender ATP URL exclusions in the proxy, see [Enable access to Microsoft Defender ATP service URLs in the proxy server](#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server). - Manual static proxy configuration: - Registry based configuration From f73ee20d2182da1e8da0274efc101b991a30470a Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 1 Apr 2020 14:52:47 -0700 Subject: [PATCH 22/26] More adjustments to indentation in source... ...that I hope will fix the indentation in the rendered view. --- .../microsoft-defender-atp/onboarding.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md index b77f5bd4f4..3b7f738894 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboarding.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboarding.md @@ -257,13 +257,13 @@ MMA for enrollment into the workspace. 9. Set Run to **Hidden**. -10. Set **Program can run** to **Whether or not a user is logged on**. +10. Set **Program can run** to **Whether or not a user is logged on**. -11. Click **Next**. +11. Click **Next**. -12. Set the **Maximum allowed run time** to 720. +12. Set the **Maximum allowed run time** to 720. -13. Click **Next**. +13. Click **Next**. ![Image of Microsoft Endpoint Configuration Manager console](images/262a41839704d6da2bbd72ed6b4a826a.png) @@ -275,12 +275,12 @@ MMA for enrollment into the workspace. 16. Click **Close**. -17. In the Microsoft Endpoint Configuration Manager console, right-click the Microsoft Defender ATP +17. In the Microsoft Endpoint Configuration Manager console, right-click the Microsoft Defender ATP Onboarding Package just created and select **Deploy**. 18. On the right panel select the appropriate collection. -19. Click **OK**. +19. Click **OK**. ## Next generation protection Microsoft Defender Antivirus is a built-in antimalware solution that provides next generation protection for desktops, portable computers, and servers. @@ -318,7 +318,7 @@ needs on how Antivirus is configured. ![Image of next generation protection pane](images/3876ca687391bfc0ce215d221c683970.png) -3. Right-click on the newly created antimalware policy and select **Deploy** . +3. Right-click on the newly created antimalware policy and select **Deploy**. ![Image of next generation protection pane](images/f5508317cd8c7870627cb4726acd5f3d.png) From b354b6ed9009bf010f54a2e2a64a001b42c37ca8 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 1 Apr 2020 14:59:26 -0700 Subject: [PATCH 23/26] Corrected code block that wasn't rendered --- .../microsoft-defender-atp/configure-server-endpoints.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index e1b6576f62..6e70b912af 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -153,11 +153,13 @@ Support for Windows Server, version 1803 and Windows 2019 provides deeper insigh b. Run the following PowerShell command to verify that the passive mode was configured: - ```Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-Sense" ;ID=84}``` + ```PowerShell + Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-Sense" ;ID=84} + ``` c. Confirm that a recent event containing the passive mode event is found: - ![Image of passive mode verification result](images/atp-verify-passive-mode.png) + ![Image of passive mode verification result](images/atp-verify-passive-mode.png) 3. Run the following command to check if Windows Defender AV is installed: From 37b683b9b9bfdb5593799beaf0cfd39d24c2f5dc Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 1 Apr 2020 15:16:53 -0700 Subject: [PATCH 24/26] Fixing indented content... ... I don't see why this is failing, but here's another attempt at fixing. --- .../microsoft-defender-atp/configure-server-endpoints.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index 6e70b912af..6aaf3ab272 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -153,13 +153,13 @@ Support for Windows Server, version 1803 and Windows 2019 provides deeper insigh b. Run the following PowerShell command to verify that the passive mode was configured: - ```PowerShell - Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-Sense" ;ID=84} - ``` + ```PowerShell + Get-WinEvent -FilterHashtable @{ProviderName="Microsoft-Windows-Sense" ;ID=84} + ``` c. Confirm that a recent event containing the passive mode event is found: - ![Image of passive mode verification result](images/atp-verify-passive-mode.png) + ![Image of passive mode verification result](images/atp-verify-passive-mode.png) 3. Run the following command to check if Windows Defender AV is installed: From 349b533d5af3ac3c4af8dc07c318350a6c5b07cc Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Wed, 1 Apr 2020 15:36:31 -0700 Subject: [PATCH 25/26] Indented a note in a list item --- .../microsoft-defender-atp/configure-server-endpoints.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md index 6aaf3ab272..60c1eea5f2 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints.md @@ -174,8 +174,8 @@ Microsoft Defender ATP integrates with Azure Security Center to provide a compre The following capabilities are included in this integration: - Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding). -> [!NOTE] -> Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016. + > [!NOTE] + > Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016. - Servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console. - Server investigation - Azure Security Center customers can access Microsoft Defender Security Center to perform detailed investigation to uncover the scope of a potential breach From 5f4aaca65b9fda62b4c9924c4be548012657e8ce Mon Sep 17 00:00:00 2001 From: Tudor Dobrila Date: Wed, 1 Apr 2020 16:32:50 -0700 Subject: [PATCH 26/26] Add note on update channel --- .../threat-protection/microsoft-defender-atp/mac-whatsnew.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md index 1a65d559a5..57fde3cc75 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-whatsnew.md @@ -28,6 +28,7 @@ ms.topic: conceptual ## 100.90.27 +- You can now [set an update channel](mac-updates.md#set-the-channel-name) for Microsoft Defender ATP for Mac that is different from the system-wide update channel - New product icon - Other user experience improvements - Bug fixes