mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 07:17:24 +00:00
Merge branch 'master' into mde-updates
This commit is contained in:
jcaparas
GitHub
commit
60b740980f
@ -2728,6 +2728,7 @@ The following list shows the CSPs supported in HoloLens devices:
|
||||
| [DiagnosticLog CSP](diagnosticlog-csp.md) |  |  |  |
|
||||
| [DMAcc CSP](dmacc-csp.md) |  |  |  |
|
||||
| [DMClient CSP](dmclient-csp.md) |  |  |  |
|
||||
| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) |  |  |  <sup>10</sup> |
|
||||
| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) |  |  |  |
|
||||
| [NetworkProxy CSP](networkproxy-csp.md) |  |  |  |
|
||||
| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) |  |  |  <sup>8</sup>|
|
||||
@ -2737,6 +2738,7 @@ The following list shows the CSPs supported in HoloLens devices:
|
||||
| [RemoteFind CSP](remotefind-csp.md) |  |  <sup>4</sup> |  |
|
||||
| [RemoteWipe CSP](remotewipe-csp.md) |  |  <sup>4</sup> |  |
|
||||
| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) |  |  |  |
|
||||
| [TenantLockdown CSP](tenantlockdown-csp.md) |  |  |  <sup>10</sup> |
|
||||
| [Update CSP](update-csp.md) |  |  |  |
|
||||
| [VPNv2 CSP](vpnv2-csp.md) |  |  |  |
|
||||
| [WiFi CSP](wifi-csp.md) |  |  |  |
|
||||
@ -2745,7 +2747,9 @@ The following list shows the CSPs supported in HoloLens devices:
|
||||
|
||||
## <a href="" id="surfacehubcspsupport"></a>CSPs supported in Microsoft Surface Hub
|
||||
|
||||
- [Accounts CSP](accounts-csp.md)<sup>9</sup> **Note:** Support in Surface Hub is limited to **Domain\ComputerName**.
|
||||
- [Accounts CSP](accounts-csp.md)<sup>9</sup>
|
||||
> [!NOTE]
|
||||
> Support in Surface Hub is limited to **Domain\ComputerName**.
|
||||
- [AccountManagement CSP](accountmanagement-csp.md)
|
||||
- [APPLICATION CSP](application-csp.md)
|
||||
- [CertificateStore CSP](certificatestore-csp.md)
|
||||
@ -2813,3 +2817,4 @@ The following list shows the CSPs supported in HoloLens devices:
|
||||
- 7 - Added in Windows 10, version 1909.
|
||||
- 8 - Added in Windows 10, version 2004.
|
||||
- 9 - Added in Windows 10 Team 2020 Update
|
||||
- 10 - Added in [Windows Holographic, version 20H2](https://docs.microsoft.com/hololens/hololens-release-notes#windows-holographic-version-20h2)
|
||||
|
||||
@ -31,19 +31,26 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
## Before you begin:
|
||||
|
||||
1. Create an [event hub](https://docs.microsoft.com/azure/event-hubs/) in your tenant.
|
||||
2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to **Microsoft.insights****.
|
||||
|
||||
2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to **Microsoft.insights**.
|
||||
|
||||
## Enable raw data streaming:
|
||||
|
||||
1. Log in to [Microsoft Defender Security Center](https://securitycenter.windows.com) with a Global Admin user.
|
||||
2. Go to [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center.
|
||||
3. Click on **Add data export settings**.
|
||||
4. Choose a name for your new settings.
|
||||
5. Choose **Forward events to Azure Event Hubs**.
|
||||
6. Type your **Event Hubs name** and your **Event Hubs resource ID**.
|
||||
In order to get your **Event Hubs resource ID**, go to your Azure Event Hubs namespace page on [Azure](https://ms.portal.azure.com/) > properties tab > copy the text under **Resource ID**:
|
||||
|
||||
|
||||
2. Go to [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center.
|
||||
|
||||
3. Click on **Add data export settings**.
|
||||
|
||||
4. Choose a name for your new settings.
|
||||
|
||||
5. Choose **Forward events to Azure Event Hubs**.
|
||||
|
||||
6. Type your **Event Hubs name** and your **Event Hubs resource ID**.
|
||||
|
||||
In order to get your **Event Hubs resource ID**, go to your Azure Event Hubs namespace page on [Azure](https://ms.portal.azure.com/) > properties tab > copy the text under **Resource ID**:
|
||||
|
||||
|
||||
|
||||
7. Choose the events you want to stream and click **Save**.
|
||||
|
||||
@ -64,8 +71,11 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
```
|
||||
|
||||
- Each event hub message in Azure Event Hubs contains list of records.
|
||||
|
||||
- Each record contains the event name, the time Microsoft Defender ATP received the event, the tenant it belongs (you will only get events from your tenant), and the event in JSON format in a property called "**properties**".
|
||||
|
||||
- For more information about the schema of Microsoft Defender for Endpoint events, see [Advanced Hunting overview](advanced-hunting-overview.md).
|
||||
|
||||
- In Advanced Hunting, the **DeviceInfo** table has a column named **MachineGroup** which contains the group of the device. Here every event will be decorated with this column as well. See [Device Groups](machine-groups.md) for more information.
|
||||
|
||||
## Data types mapping:
|
||||
@ -73,21 +83,22 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
To get the data types for event properties do the following:
|
||||
|
||||
1. Log in to [Microsoft Defender Security Center](https://securitycenter.windows.com) and go to [Advanced Hunting page](https://securitycenter.windows.com/hunting-package).
|
||||
|
||||
2. Run the following query to get the data types mapping for each event:
|
||||
|
||||
```
|
||||
{EventType}
|
||||
| getschema
|
||||
| project ColumnName, ColumnType
|
||||
|
||||
```
|
||||
```
|
||||
{EventType}
|
||||
| getschema
|
||||
| project ColumnName, ColumnType
|
||||
```
|
||||
|
||||
- Here is an example for Device Info event:
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Overview of Advanced Hunting](advanced-hunting-overview.md)
|
||||
- [Microsoft Defender for Endpoint streaming API](raw-data-export.md)
|
||||
- [Stream Microsoft Defender for Endpoint events to your Azure storage account](raw-data-export-storage.md)
|
||||
- [Azure Event Hubs documentation](https://docs.microsoft.com/azure/event-hubs/)
|
||||
- [Troubleshoot connectivity issues - Azure Event Hubs](https://docs.microsoft.com/azure/event-hubs/troubleshooting-guide)
|
||||
|
||||
@ -31,19 +31,24 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
## Before you begin:
|
||||
|
||||
1. Create a [Storage account](https://docs.microsoft.com/azure/storage/common/storage-account-overview) in your tenant.
|
||||
|
||||
2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to Microsoft.insights**.
|
||||
3. Go to **Settings > Advanced Features > Preview features** and turn Preview features **On**.
|
||||
|
||||
## Enable raw data streaming:
|
||||
|
||||
1. Log in to [Microsoft Defender for Endpoint portal](https://securitycenter.windows.com) with Global Admin user.
|
||||
2. Go to [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center.
|
||||
3. Click on **Add data export settings**.
|
||||
4. Choose a name for your new settings.
|
||||
5. Choose **Forward events to Azure Storage**.
|
||||
6. Type your **Storage Account Resource Id**. In order to get your **Storage Account Resource Id**, go to your Storage account page on [Azure portal](https://ms.portal.azure.com/) > properties tab > copy the text under **Storage account resource ID**:
|
||||
|
||||
|
||||
2. Go to [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center.
|
||||
|
||||
3. Click on **Add data export settings**.
|
||||
|
||||
4. Choose a name for your new settings.
|
||||
|
||||
5. Choose **Forward events to Azure Storage**.
|
||||
|
||||
6. Type your **Storage Account Resource ID**. In order to get your **Storage Account Resource ID**, go to your Storage account page on [Azure portal](https://ms.portal.azure.com/) > properties tab > copy the text under **Storage account resource ID**:
|
||||
|
||||
|
||||
|
||||
7. Choose the events you want to stream and click **Save**.
|
||||
|
||||
@ -51,22 +56,25 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
|
||||
- A blob container will be created for each event type:
|
||||
|
||||
|
||||
|
||||
|
||||
- The schema of each row in a blob is the following JSON:
|
||||
|
||||
```
|
||||
{
|
||||
"time": "<The time WDATP received the event>"
|
||||
"tenantId": "<Your tenant ID>"
|
||||
"category": "<The Advanced Hunting table name with 'AdvancedHunting-' prefix>"
|
||||
"properties": { <WDATP Advanced Hunting event as Json> }
|
||||
}
|
||||
```
|
||||
```
|
||||
{
|
||||
"time": "<The time WDATP received the event>"
|
||||
"tenantId": "<Your tenant ID>"
|
||||
"category": "<The Advanced Hunting table name with 'AdvancedHunting-' prefix>"
|
||||
"properties": { <WDATP Advanced Hunting event as Json> }
|
||||
}
|
||||
```
|
||||
|
||||
- Each blob contains multiple rows.
|
||||
|
||||
- Each row contains the event name, the time Defender for Endpoint received the event, the tenant it belongs (you will only get events from your tenant), and the event in JSON format in a property called "properties".
|
||||
|
||||
- For more information about the schema of Microsoft Defender for Endpoint events, see [Advanced Hunting overview](advanced-hunting-overview.md).
|
||||
|
||||
- In Advanced Hunting, the **DeviceInfo** table has a column named **MachineGroup** which contains the group of the device. Here every event will be decorated with this column as well. See [Device Groups](machine-groups.md) for more information.
|
||||
|
||||
## Data types mapping:
|
||||
@ -74,18 +82,18 @@ Want to experience Defender for Endpoint? [Sign up for a free trial.](https://ww
|
||||
In order to get the data types for our events properties do the following:
|
||||
|
||||
1. Log in to [Microsoft Defender Security Center](https://securitycenter.windows.com) and go to [Advanced Hunting page](https://securitycenter.windows.com/hunting-package).
|
||||
|
||||
2. Run the following query to get the data types mapping for each event:
|
||||
|
||||
```
|
||||
{EventType}
|
||||
| getschema
|
||||
| project ColumnName, ColumnType
|
||||
|
||||
```
|
||||
```
|
||||
{EventType}
|
||||
| getschema
|
||||
| project ColumnName, ColumnType
|
||||
```
|
||||
|
||||
- Here is an example for Device Info event:
|
||||
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Overview of Advanced Hunting](advanced-hunting-overview.md)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user