mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-15 23:07:23 +00:00
update from remote
This commit is contained in:
jcaparas
commit
5ac21cc823
@ -70,21 +70,6 @@
|
||||
#### [Python code examples](windows-defender-atp\python-example-code-windows-defender-advanced-threat-protection.md)
|
||||
#### [Experiment with custom threat intelligence alerts](windows-defender-atp\experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
#### [Troubleshoot custom threat intelligence issues](windows-defender-atp\troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
### [Use the Windows Defender ATP exposed APIs](windows-defender-atp\exposed-apis-windows-defender-advanced-threat-protection.md)
|
||||
#### [Supported Windows Defender ATP APIs](windows-defender-atp\supported-apis-windows-defender-advanced-threat-protection.md)
|
||||
##### [Collect investigation package](windows-defender-atp\collect-investigation-package-windows-defender-advanced-threat-protection.md)
|
||||
##### [Isolate machine](windows-defender-atp\isolate-machine-windows-defender-advanced-threat-protection.md)
|
||||
##### [Unisolate machine](windows-defender-atp\unisolate-machine-windows-defender-advanced-threat-protection.md)
|
||||
##### [Restrict code execution](windows-defender-atp\restrict-code-execution-windows-defender-advanced-threat-protection.md)
|
||||
##### [Unrestrict code execution](windows-defender-atp\unrestrict-code-execution-windows-defender-advanced-threat-protection.md)
|
||||
##### [Run antivirus scan](windows-defender-atp\run-av-scan-windows-defender-advanced-threat-protection.md)
|
||||
##### [Stop and quarantine files](windows-defender-atp\stop-quarantine-file-windows-defender-advanced-threat-protection.md)
|
||||
##### [Request sample](windows-defender-atp\request-sample-windows-defender-advanced-threat-protection.md)
|
||||
##### [Block file](windows-defender-atp\block-file-windows-defender-advanced-threat-protection.md)
|
||||
##### [Unblock file](windows-defender-atp\unblock-file-windows-defender-advanced-threat-protection.md)
|
||||
##### [Get package SAS URI](windows-defender-atp\get-package-sas-uri-windows-defender-advanced-threat-protection.md)
|
||||
##### [Get MachineAction object](windows-defender-atp\get-machineaction-object-windows-defender-advanced-threat-protection.md)
|
||||
##### [Get FileMachineAction object](windows-defender-atp\get-filemachineaction-object-windows-defender-advanced-threat-protection.md)
|
||||
### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md)
|
||||
#### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Windows Defender ATP with.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The **Alerts queue** shows a list of alerts that were flagged from endpoints in your network. Alerts are displayed in queues according to their current status. In each queue, you'll see details such as the severity of alerts and the number of machines the alerts were raised on.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Understand what data fields are exposed as part of the alerts API and how they map to the Windows Defender ATP portal.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 09/01/2017
|
||||
- Office 365
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender ATP users and access permissions are managed in Azure Active Directory (AAD). Use the following methods to assign security roles.
|
||||
|
||||
|
||||
@ -0,0 +1,68 @@
|
||||
---
|
||||
title: Block file API
|
||||
description: Use this API to create calls related to blocking files from being executed in the organization.
|
||||
keywords: apis, graph api, supported apis, block file
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Block file
|
||||
Prevent a file from being executed in the organization using Windows Defender Antivirus.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/files/{sha1}/block
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200, Ok response code with empty body, which indicates that block message was sent to Windows Defender deployed in the organization.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/7327b54fd718525cbca07dacde913b5ac3c85673/block
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Block file due to alert 32123"
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
```
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The sensor health tile provides information on the individual endpoint’s ability to provide sensor data and communicate with the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues.
|
||||
|
||||
|
||||
@ -0,0 +1,77 @@
|
||||
---
|
||||
title: Collect investigation package API
|
||||
description: Use this API to create calls related to the collecting an investigation package from a machine.
|
||||
keywords: apis, graph api, supported apis, collect investigation package
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Collect investigation package
|
||||
Collect investigation package from a machine.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/collectInvestigationPackage
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. Required.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | Text | Comment to associate with the action. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/collectInvestigationPackage
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Collect forensics due to alert 1234"
|
||||
}
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "CollectInvestigationPackage",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
|
||||
```
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Windows Defender ATP alerts.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can configure Windows Defender ATP to send email notifications to specified recipients for new alerts. This feature enables you to identify a group of individuals who will immediately be informed and can act on alerts based on their severity.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.date: 09/01/2017
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
> [!NOTE]
|
||||
> To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can use mobile device management (MDM) solutions to configure endpoints. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage endpoints.
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 09/01/2017
|
||||
- Linux
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender Security Center provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Windows Defender Security Center and better protect your organization's network. This experience leverages on a third-party security products’ sensor data.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 09/01/2017
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- System Center 2012 Configuration Manager or later versions
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
<span id="sccm1606"/>
|
||||
## Configure endpoints using System Center Configuration Manager (current branch) version 1606
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network.
|
||||
|
||||
|
||||
@ -18,7 +18,7 @@ ms.date: 09/01/2017
|
||||
**Applies to:**
|
||||
- Virtual desktop infrastructure (VDI) machines
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
|
||||
@ -60,12 +60,13 @@ You can onboard VDI machines using a single entry or multiple entries for each m
|
||||
Select the **Scripts** tab, then click **Add** (Windows Explorer will open directly in the path where you copied the onboarding script earlier). Navigate to the onboarding bash script `WindowsDefenderATPOnboardingScript.cmd`.
|
||||
|
||||
6. Test your solution:
|
||||
a. Create a pool with one machine.
|
||||
b. Logon to machine.
|
||||
c. Logoff from machine.
|
||||
d. Logon to machine with another user.
|
||||
e. **For single entry for each machine**: Check only one entry in the Windows Defender ATP portal.<br>
|
||||
**For multiple entries for each machine**: Check multiple entries in the Windows Defender ATP portal.
|
||||
|
||||
a. Create a pool with one machine.
|
||||
b. Logon to machine.
|
||||
c. Logoff from machine.
|
||||
d. Logon to machine with another user.
|
||||
e. **For single entry for each machine**: Check only one entry in the Windows Defender ATP portal.<br>
|
||||
**For multiple entries for each machine**: Check multiple entries in the Windows Defender ATP portal.
|
||||
|
||||
7. Click **Machines list** on the Navigation pane.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Endpoints in your organization must be configured so that the Windows Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Windows Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 09/01/2017
|
||||
- Windows Server 2016
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Pull alerts using supported security information and events management (SIEM) tools
|
||||
Windows Defender ATP supports (SIEM) tools to pull alerts. Windows Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You'll need to configure Splunk so that it can pull Windows Defender ATP alerts.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can define custom alert definitions and indicators of compromise (IOC) using the threat intelligence API. Creating custom threat intelligence alerts allows you to generate specific alerts that are applicable to your organization.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The **Security operations dashboard** displays a snapshot of:
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
This section covers some of the most frequently asked questions regarding privacy and data handling for Windows Defender ATP.
|
||||
> [!NOTE]
|
||||
|
||||
@ -24,7 +24,7 @@ ms.date: 09/01/2017
|
||||
- Windows Defender
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Windows Defender Advanced Threat Protection agent depends on Windows Defender Antivirus for some capabilities such as file scanning.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Before you can create custom threat intelligence (TI) using REST API, you'll need to set up the custom threat intelligence application through the Windows Defender ATP portal.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Enable security information and event management (SIEM) integration so you can pull alerts from the Windows Defender ATP portal using your SIEM solution or by connecting directly to the alerts REST API.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/library/aa745633(v=bts.10).aspx) on individual endpoints.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
With the Windows Defender ATP threat intelligence API, you can create custom threat intelligence alerts that can help you keep track of possible attack activities in your organization.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Machines that are categorized as misconfigured or inactive can be flagged due to varying causes. This section provides some explanations as to what might have caused a machine to be categorized as inactive or misconfigured.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
During the onboarding process, a wizard takes you through the general settings of Windows Defender ATP. After onboarding, you might want to update some settings which you'll be able to do through the **Preferences setup** menu.
|
||||
|
||||
|
||||
@ -0,0 +1,74 @@
|
||||
---
|
||||
title: Get FileMachineAction object API
|
||||
description: Use this API to create calls related to get machineaction object
|
||||
keywords: apis, graph api, supported apis, filemachineaction object
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get FileMachineAction object
|
||||
Get MachineAction object.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/filemachineactions/{id}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200, Ok response code with the *FileMachineAction* object.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/filemachineactions/7327b54fd718525cbca07dacde913b5ac3c85673
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions/$entity",
|
||||
"id": " 7327b54fd718525cbca07dacde913b5ac3c85673",
|
||||
"sha1": "1163788484e3258ab9fcf692f7db7938f72ddfc2",
|
||||
"type": "StopAndQuarantineFile",
|
||||
"status": "Succeeded",
|
||||
"machineId": "970a58d5f61786bb7799dfdb5395ec364ffceace",
|
||||
"fileInstances": [
|
||||
{
|
||||
"filePath": "C:\\Users\\alex\\AppData\\Local\\AppFetch\\Temp\\3324bcb\\AppDownloader\\AnApp.appfetch.zip",
|
||||
"status": "Succeeded"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,67 @@
|
||||
---
|
||||
title: Get MachineAction object API
|
||||
description: Use this API to create calls related to get machineaction object
|
||||
keywords: apis, graph api, supported apis, machineaction object
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get MachineAction object
|
||||
Get MachineAction object
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/machineactions/{id}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200, Ok response code with the *MachineAction* object.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/machineactions/7327b54fd718525cbca07dacde913b5ac3c85673
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "UnrestrictExecution",
|
||||
"status": "Success",
|
||||
"error": "Unknown"
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,67 @@
|
||||
---
|
||||
title: Get package SAS URI API
|
||||
description: Use this API to get a URI that allows downloading an investigation package.
|
||||
keywords: apis, graph api, supported apis, get package, sas, uri
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Get package SAS URI
|
||||
Get a URI that allows downloading an investigation package.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machineactions/{id}/getPackageUri
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200, Ok response code with object that holds the link to the package in the “value” parameter. This link is valid for a very short time and should be used immediately for downloading the package to a local storage.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/machineactions/7327b54fd718525cbca07dacde913b5ac3c85673/GetPackageUri
|
||||
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
Content-type: application/json
|
||||
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testrespver1/$metadata#Edm.String",
|
||||
"value": "\"https://userrequests-us.securitycenter.windows.com:443/safedownload/WDATP_Investigation_Package.zip?token=gbDyj7y%2fbWGAZjn2sFiZXlliBTXOCVG7yiJ6mXNaQ9pLByC2Wxeno9mENsPFP3xMk5l%2bZiJXjLvqAyNEzUNROxoM2I1er9dxzfVeBsxSmclJjPsAx%2btiNyxSz1Ax%2b5jaT5cL5bZg%2b8wgbwY9urXbTpGjAKh6FB1e%2b0ypcWkPm8UkfOwsmtC%2biZJ2%2bPqnkkeQk7SKMNoAvmh9%2fcqDIPKXGIBjMa0D9auzypOqd8bQXp7p2BnLSH136BxST8n9IHR4PILvRjAYW9kvtHkBpBitfydAsUW4g2oDZSPN3kCLBOoo1C4w4Lkc9Bc3GNU2IW6dfB7SHcp7G9p4BDkeJl3VuDs6esCaeBorpn9FKJ%2fXo7o9pdcI0hUPZ6Ds9hiPpwPUtz5J29CBE3QAopCK%2fsWlf6OW2WyXsrNRSnF1tVE5H3wXpREzuhD7S4AIA3OIEZKzC4jIPLeMu%2bazZU9xGwuc3gICOaokbwMJiZTqcUuK%2fV9YdBdjdg8wJ16NDU96Pl6%2fgew2KYuk6Wo7ZuHotgHI1abcsvdlpe4AvixDbqcRJthsg2PpLRaFLm5av44UGkeK6TJpFvxUn%2f9fg6Zk5yM1KUTHb8XGmutoCM8U9er6AzXZlY0gGc3D3bQOg41EJZkEZLyUEbk1hXJB36ku2%2bW01cG71t7MxMBYz7%2bdXobxpdo%3d%3bRWS%2bCeoDfTyDcfH5pkCg6hYDmCOPr%2fHYQuaUWUBNVnXURYkdyOzVHqp%2fe%2f1BNyPdVoVkpQHpz1pPS3b5g9h7IMmNKCk5gFq5m2nPx6kk9EYtzx8Ndoa2m9Yj%2bSaf8zIFke86YnfQL4AYewsnQNJJh4wc%2bXxGlBq7axDcoiOdX91rKzVicH3GSBkFoLFAKoegWWsF%2fEDZcVpF%2fXUA1K8HvB6dwyfy4y0sAqnNPxYTQ97mG7yHhxPt4Pe9YF2UPPAJVuEf8LNlQ%2bWHC9%2f7msF6UUI4%2fca%2ftpjFs%2fSNeRE8%2fyQj21TI8YTF1SowvaJuDc1ivEoeopNNGG%2bGI%2fX0SckaVxU9Hdkh0zbydSlT5SZwbSwescs0IpzECitBbaLUz4aT8KTs8T0lvx8D7Te3wVsKAJ1r3iFMQZrlk%2bS1WW8rvac7oHRx2HKURn1v7fDIQWgJr9aNsNlFz4fLJ50T2qSHuuepkLVbe93Va072aMGhvr09WVKoTpAf1j2bcFZZU6Za5PxI32mr0k90FgiYFJ1F%2f1vRDrGwvWVWUkR3Z33m4g0gHa52W1FMxQY0TJIwbovD6FaSNDx7xhKZSd5IJ7r6P91Gez49PaZRcAZPjd%2bfbul3JNm1VqQPTLohT7wa0ymRiXpSST74xtFzuEBzNSNATdbngj3%2fwV4JesTjZjIj5Dc%3d%3blumqauVlFuuO8MQffZgs0tLJ4Fq6fpeozPTdDf8Ll6XLegi079%2b4mSPFjTK0y6eohstxdoOdom2wAHiZwk0u4KLKmRkfYOdT1wHY79qKoBQ3ZDHFTys9V%2fcwKGl%2bl8IenWDutHygn5IcA1y7GTZj4g%3d%3d\""
|
||||
}
|
||||
|
||||
```
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 44 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 45 KiB After Width: | Height: | Size: 81 KiB |
@ -19,7 +19,7 @@ ms.date: 09/01/2017
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Investigate alerts that are affecting your network, what they mean, and how to resolve them. Use the alert details view to see various tiles that provide information about alerts. You can also manage an alert and see alert metadata along with other information that can help you make better decisions on how to approach them.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Examine possible communication between your machines and external internet protocol (IP) addresses.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 09/01/2017
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Investigate machines
|
||||
Investigate the details of an alert raised on a specific machine to identify other behaviors or events that might be related to the alert or the potential scope of breach.
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Investigate user account entities
|
||||
Identify user accounts with the most active alerts (displayed on dashboard as "Users at risk") and investigate cases of potential compromised credentials, or pivot on the associated user account when investigating an alert or machine to identify possible lateral movement between machines with that user account.
|
||||
|
||||
@ -0,0 +1,83 @@
|
||||
---
|
||||
title: Isolate machine API
|
||||
description: Use this API to create calls related isolating a machine.
|
||||
keywords: apis, graph api, supported apis, isolate machine
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Isolate machine
|
||||
Isolates a machine from accessing external network.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/isolate
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
IsolationType | IsolationType | Full or selective isolation
|
||||
|
||||
**IsolationType** controls the type of isolation to perform and can be one of the following:
|
||||
- Full – Full isolation
|
||||
- Selective – Restrict only limited set of applications from accessing the network
|
||||
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/isolate
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Isolate machine due to alert 1234",
|
||||
“IsolationType”: “Full”
|
||||
}
|
||||
|
||||
```
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "Isolate",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
```
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The **Machines list** shows a list of the machines in your network, the domain of each machine, when it last reported and the local IP Address it reported on, its **Health state**, the number of active alerts on each machine categorized by alert severity level, and the number of active malware detections. This view allows viewing machines ranked by risk or sensor health state, and keeping track of all machines that are reporting sensor data in your network.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender ATP notifies you of possible malicious events, attributes, and contextual information through alerts. A summary of new alerts is displayed in the **Security operations dashboard**, and you can access all alerts in the **Alerts queue** menu.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
There are some minimum requirements for onboarding your network and endpoints.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You need to onboard to Windows Defender ATP before you can use the service.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Antivirus optimization tile provides a list of recommendations to affected machines. Taking action on the recommendations will help improve your overall organizational security:
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Enterprise security teams can use the Windows Defender ATP portal to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches.
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Understand the security status of your organization, including the status of machines, alerts, and investigations using the Windows Defender ATP reporting feature that integrates with Power BI.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
This article provides PowerShell code examples for using the custom threat intelligence API.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Use the **Preferences setup** menu to modify general settings, advanced features, enable the preview experience, email notifications, and the custom threat intelligence feature.
|
||||
|
||||
|
||||
@ -0,0 +1,3 @@
|
||||
>[!IMPORTANT]
|
||||
|
||||
>Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Turn on the preview experience setting to be among the first to try upcoming features.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Windows Defender ATP service is constantly being updated to include new feature enhancements and capabilities.
|
||||
|
||||
@ -65,9 +65,6 @@ Machine group and tags support proper mapping of the network, enabling you to at
|
||||
- [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)<br>
|
||||
Windows Defender ATP supports the use of Power BI data connectors to enable you to connect and access Windows Defender ATP data using Microsoft Graph.
|
||||
|
||||
- [Use the Windows Defender ATP exposed APIs](configure-server-endpoints-windows-defender-advanced-threat-protection.md)<br>
|
||||
Windows Defender ATP exposes much of the available data and actions using a set of programmatic APIs that are part of the Microsoft Intelligence Security Graph. Those APIs will enable you, to automate workflows and innovate based on Windows Defender ATP capabilities.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender ATP supports the OAuth 2.0 protocol to pull alerts from the portal.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Before you begin
|
||||
You must [install](http://docs.python-requests.org/en/master/user/install/#install) the "[requests](http://docs.python-requests.org/en/master/)" python library.
|
||||
|
||||
@ -0,0 +1,77 @@
|
||||
---
|
||||
title: Request sample API
|
||||
description: Use this API to create calls related to requesting a sample from a machine.
|
||||
keywords: apis, graph api, supported apis, request sample
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Request sample
|
||||
Request sample of a file from a specific machine. File will be collected from the machine and uploaded to a secure storage.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/requestSample
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
Sha1 | String | Sha1 of the file to upload to the secure storage. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and *FileMachineAction* object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/requestSample
|
||||
Content-type: application/json
|
||||
{
|
||||
“Sha1”: “7327b54fd718525cbca07dacde913b5ac3c85673”
|
||||
}
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "RequestSample",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
```
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Quickly respond to detected attacks by stopping and quarantining files or blocking a file. After taking action on files, you can check activity details on the Action center.
|
||||
|
||||
@ -111,6 +111,7 @@ This feature is designed to prevent suspected malware (or potentially malicious
|
||||
|
||||
|
||||
The Action center shows the submission information:
|
||||
|
||||
|
||||
|
||||
- **Submission time** - Shows when the action was submitted. <br>
|
||||
@ -233,4 +234,4 @@ HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
|
||||
> If the value *AllowSampleCollection* is not available, the client will allow sample collection by default.
|
||||
|
||||
## Related topics
|
||||
– [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Quickly respond to detected attacks by isolating machines or collecting an investigation package. After taking action on machines, you can check activity details on the Action center.
|
||||
|
||||
@ -117,6 +117,11 @@ The action to restrict an application from running applies a code integrity poli
|
||||
When the application execution restriction configuration is applied, a new event is reflected in the machine timeline.
|
||||
|
||||
|
||||
**Notification on machine user**:</br>
|
||||
When an app is restricted, the following notification is displayed to inform the user that an app is being restricted from running:
|
||||
|
||||
|
||||
|
||||
## Remove app restriction
|
||||
Depending on the severity of the attack and the state of the machine, you can choose to reverse the restriction of applications policy after you have verified that the compromised machine has been remediated.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
|
||||
You can take response actions on machines and files to quickly respond to detected attacks so that you can contain or reduce and prevent further damage caused by malicious attackers in your organization.
|
||||
|
||||
@ -0,0 +1,76 @@
|
||||
---
|
||||
title: Restrict app execution API
|
||||
description: Use this API to create calls related to restricting an application from executing.
|
||||
keywords: apis, graph api, supported apis, collect investigation package
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Restrict app execution
|
||||
Restrict execution of set of predefined applications.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/restrictCodeExecution
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/restrictCodeExecution
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Restrict code execution due to alert 1234"
|
||||
}
|
||||
|
||||
```
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "RestrictExecution",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
```
|
||||
@ -0,0 +1,85 @@
|
||||
---
|
||||
title: Run antivirus scan API
|
||||
description: Use this API to create calls related to running an antivirus scan on a machine.
|
||||
keywords: apis, graph api, supported apis, remove machine from isolation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Run antivirus scan
|
||||
Initiate Windows Defender Antivirus scan on the machine.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/runAntiVirusScan
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
ScanType| ScanType | Defines the type of the Scan. **Required**.
|
||||
|
||||
**ScanType** controls the type of isolation to perform and can be one of the following:
|
||||
|
||||
- **Quick** – Perform quick scan on the machine
|
||||
- **Full** – Perform full scan on the machine
|
||||
|
||||
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/runAntiVirusScan
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Check machine for viruses due to alert 3212",
|
||||
“ScanType”: “Full”
|
||||
}
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "RunAntiVirusScan",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
```
|
||||
@ -22,7 +22,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Security Analytics dashboard expands your visibility into the overall security posture of your organization. From this dashboard, you'll be able to quickly assess the security posture of your organization, see machines that require attention, as well as recommendations for actions to further reduce the attack surface in your organization - all in one place. From there you can take action based on the recommended configuration baselines.
|
||||
|
||||
@ -52,9 +52,9 @@ The security coverage tile shows a bar graph where each bar represents a Windows
|
||||
|
||||
|
||||
## Improvement opportunities
|
||||
Improve your organizational security score by taking the recommended improvement actions listed on this tile.
|
||||
Improve your organizational security score by taking the recommended improvement actions listed on this tile. The goal is to reduce the gap between the perfect score and the current score for each control.
|
||||
|
||||
Click on each segment to see the recommended optimizations.
|
||||
Click on each control to see the recommended optimizations.
|
||||
|
||||
|
||||
|
||||
@ -87,7 +87,7 @@ You can take the following actions to increase the overall security score of you
|
||||
> For the Windows Defender Antivirus properties to show, you'll need to ensure that the Windows Defender Antivirus Cloud-based protection is properly configured on the endpoint.
|
||||
|
||||
- Fix antivirus reporting
|
||||
- This recommendation is displayed when the Windows Defender Antivirus configuration on a machines is not properly configured. For more information on fixing the reporting, see [Configure and validate network connections](../windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md).
|
||||
- This recommendation is displayed when the Windows Defender Antivirus is not properly configured to report its health state. For more information on fixing the reporting, see [Configure and validate network connections](../windows-defender-antivirus/configure-network-connections-windows-defender-antivirus.md).
|
||||
- Turn on antivirus
|
||||
- Update antivirus definitions
|
||||
- Turn on cloud-based protection
|
||||
@ -98,7 +98,7 @@ For more information, see [Configure Windows Defender Antivirus](../windows-defe
|
||||
|
||||
|
||||
### OS security updates optimization
|
||||
This tile shows you the exact number of machines that require the latest security updates and ones that can use the latest Windows Insider preview builds.
|
||||
This tile shows you the exact number of machines that require the latest security updates. It also shows machines that are running on the latest Windows Insider preview build and serves as a reminder to ensure that users should run the latest builds.
|
||||
|
||||
You can take the following actions to increase the overall security score of your organization:
|
||||
- Install the latest security updates
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The **Service health** provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues. If there are issues, you'll see details related to the issue such as when the issue was detected, what the preliminary root cause is, and the expected resolution time.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Use the **Settings** menu  to configure the time zone, suppression rules, and view license information.
|
||||
|
||||
|
||||
@ -0,0 +1,85 @@
|
||||
---
|
||||
title: Stop and quarantine file API
|
||||
description: Use this API to create calls related to stopping and quarantining a file.
|
||||
keywords: apis, graph api, supported apis, stop, quarantine, file
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Stop and quarantine file
|
||||
Stop execution of a file on a machine and ensure it’s not executed again on that machine.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/stopAndQuarantineFile
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
Sha1 | String | Sha1 of the file to stop and quarantine on the machine. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _FileMachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/unrestrictCodeExecution
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Stop and quarantine file on machine due to alert 32123",
|
||||
“Sha1”: “7327b54fd718525cbca07dacde913b5ac3c85673”
|
||||
}
|
||||
```
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#FileMachineActions/$entity",
|
||||
"id": "5841901d-6d04-4278-b0b3-8dd6a2acc8a5",
|
||||
"sha1": “1163788484e3258ab9fcf692f7db7938f72ddfc2”,
|
||||
"type": "StopAndQuarantineFile",
|
||||
"status": "Succeeded",
|
||||
"machineId": "970a58d5f61786bb7799dfdb5395ec364ffceace",
|
||||
"fileInstances": [
|
||||
{
|
||||
"filePath": "C:\\Users\\alex\\AppData\\Local\\AppFetch\\Temp\\3324bcb\\AppDownloader\\AnApp.appfetch.zip",
|
||||
"status": "Succeeded"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
```
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Advanced cybersecurity attacks comprise of multiple complex malicious events, attributes, and contextual information. Identifying and deciding which of these activities qualify as suspicious can be a challenging task. Your knowledge of known attributes and abnormal activities specific to your industry is fundamental in knowing when to call an observed behavior as suspicious.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You might need to troubleshoot issues while using the custom threat intelligence feature.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You might need to troubleshoot the Windows Defender ATP onboarding process if you encounter issues.
|
||||
This page provides detailed steps to troubleshoot onboarding issues that might occur when deploying with one of the deployment tools and common errors that might occur on the endpoints.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
|
||||
You might need to troubleshoot issues while pulling alerts in your SIEM tools.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
This section addresses issues that might arise as you use the Windows Defender Advanced Threat service.
|
||||
|
||||
|
||||
@ -0,0 +1,67 @@
|
||||
---
|
||||
title: Unblock file API
|
||||
description: Use this API to create calls related to allowing a file to be executed in the organization
|
||||
keywords: apis, graph api, supported apis, unblock file
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Unblock file
|
||||
Allow a file to be executed in the organization, using Windows Defender.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/files/{sha1}/unblock
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
|
||||
|
||||
## Response
|
||||
If successful, this method returns 200, Ok response code with empty body, which indicates that block message was sent to Windows Defender deployed in the organization.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/files/7327b54fd718525cbca07dacde913b5ac3c85673/unblock
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Unblock file since alert 1234 was investigated and discovered to be false alarm",
|
||||
}
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
```
|
||||
@ -0,0 +1,77 @@
|
||||
---
|
||||
title: Unisolate machine API
|
||||
description: Use this API to create calls related to removing a machine from isolation.
|
||||
keywords: apis, graph api, supported apis, remove machine from isolation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Unisolate machine
|
||||
Undo isolation of a machine.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/unisolate
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/unisolate
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Unisolate machine since it was clean and validated"
|
||||
}
|
||||
|
||||
```
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "Unisolate",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
|
||||
```
|
||||
@ -0,0 +1,78 @@
|
||||
---
|
||||
title: Unrestrict code execution API
|
||||
description: Use this API to create calls related to removing a restriction from applications from executing.
|
||||
keywords: apis, graph api, supported apis, remove machine from isolation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Unrestrict code execution
|
||||
Unrestrict execution of set of predefined applications.
|
||||
|
||||
## Permissions
|
||||
Users need to have Security administrator or Global admin directory roles.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST /testwdatppreview/machines/{id}/unrestrictCodeExecution
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. Required.
|
||||
Content-Type | application/json
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Comment | String | Comment to associate with the action. **Required**.
|
||||
|
||||
## Response
|
||||
If successful, this method returns 201, Created response code and _MachineAction_ object in the response body.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
POST https://graph.microsoft.com/testwdatppreview/machines/fb9ab6be3965095a09c057be7c90f0a2/unrestrictCodeExecution
|
||||
Content-type: application/json
|
||||
{
|
||||
"Comment": "Unrestrict code execution since machine was cleaned and validated"
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
>[!NOTE]
|
||||
>The response object shown here may be truncated for brevity. All of the properties will be returned from an actual call.
|
||||
|
||||
```
|
||||
HTTP/1.1 201 Created
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#MachineActions/$entity",
|
||||
"id": "ac19aae7-4146-4a13-a786-eb43d8557f7c",
|
||||
"type": "UnrestrictExecution",
|
||||
"status": "InProgress",
|
||||
"error": "Unknown"
|
||||
}
|
||||
|
||||
```
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Understand threat intelligence concepts, then enable the custom threat intelligence application so that you can proceed to create custom threat intelligence alerts that are specific to your organization.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
A typical security breach investigation requires a member of a security operations team to:
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 09/01/2017
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=technet-wd-atp-abovefoldlink1)
|
||||
>
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user