mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-23 06:13:41 +00:00
Merge branch 'master' into tvm-event-insights
This commit is contained in:
Beth Levin
@ -20,7 +20,7 @@ ms.topic: article
|
||||
> [!IMPORTANT]
|
||||
> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal; however, please note the following updates:
|
||||
>
|
||||
> * On March 31, 2020, the Windows Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://docs.microsoft.com/configmgr/), which allows finer control over security features and updates.
|
||||
> * On March 31, 2020, the Windows Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager), which allows finer control over security features and updates.
|
||||
> * The Perspectives feature of Update Compliance will also be removed on March 31, 2020 in favor of a better experience. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance.
|
||||
|
||||
|
||||
|
||||
@ -18,7 +18,7 @@ ms.topic: article
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> On March 31, 2020, the Windows Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://docs.microsoft.com/configmgr/), which allows finer control over security features and updates.
|
||||
> On March 31, 2020, the Windows Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager), which allows finer control over security features and updates.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -89,7 +89,7 @@ For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 E
|
||||
|
||||
If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://blogs.windows.com/business/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/)
|
||||
|
||||
#### Muti-factor authentication
|
||||
#### Multi-factor authentication
|
||||
|
||||
An issue has been identified with Hybrid Azure AD joined devices that have enabled [multi-factor authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription.
|
||||
|
||||
|
||||
@ -26,6 +26,9 @@ ms.topic: article
|
||||
<table>
|
||||
<th>Issue<th>More information
|
||||
|
||||
<tr><td>Windows Autopilot user-driven Hybrid Azure AD deployments do not grant users Administrator rights even when specified in the Windows Autopilot profile.</td>
|
||||
<td>This will occur when there is another user on the device that already has Administrator rights. For example, a PowerShell script or policy could create an additional local account that is a member of the Administrators group. To ensure this works properly, do not create an additional account until after the Windows Autopilot process has completed.</tr>
|
||||
|
||||
<tr><td>Windows Autopilot device provisioning can fail with TPM attestation errors or ESP timeouts on devices where the real-time clock is off by a significant amount of time (e.g. several minutes or more).</td>
|
||||
<td>To fix this issue: <ol><li>Boot the device to the start of the out-of-box experience (OOBE).
|
||||
<li>Establish a network connection (wired or wireless).
|
||||
|
||||
@ -23,6 +23,10 @@ ms.date: 9/10/2019
|
||||
|
||||
This article describes the network connections that Windows 10 components make to Microsoft and the Mobile Device Management/Configuration Service Provider (MDM/CSP) and custom Open Mobile Alliance Uniform Resource Identifier ([OMA URI](https://docs.microsoft.com/intune/custom-settings-windows-10)) policies available to IT Professionals using Microsoft Intune to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article. While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience.
|
||||
|
||||
Note: The 1903 settings in the Windows Restricted Traffic Limited Functionality Baseline package are applicable to 1909 Windows Enterprise devices.
|
||||
|
||||
Note: If a user executes the "Reset this PC" command (Settings -> Update & Security -> Recovery) with the "Keep my files" option the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied to in order re-restrict the device. Also, egress traffic may occur during the period leading up to the re-applications of the Restricted Traffic Limited Functionality Baseline settings.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>- The Allowed Traffic endpoints for an MDM configuration are here: [Allowed Traffic](#bkmk-mdm-allowedtraffic)
|
||||
> - CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) network traffic cannot be disabled and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of these authorities. There are many others such as DigiCert, Thawte, Google, Symantec, and VeriSign.
|
||||
|
||||
@ -31,7 +31,7 @@
|
||||
### [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md)
|
||||
### [Exposure score](microsoft-defender-atp/tvm-exposure-score.md)
|
||||
### [Configuration score](microsoft-defender-atp/configuration-score.md)
|
||||
### [Security recommendation](microsoft-defender-atp/tvm-security-recommendation.md)
|
||||
### [Security recommendations](microsoft-defender-atp/tvm-security-recommendation.md)
|
||||
### [Remediation and exception](microsoft-defender-atp/tvm-remediation.md)
|
||||
### [Software inventory](microsoft-defender-atp/tvm-software-inventory.md)
|
||||
### [Weaknesses](microsoft-defender-atp/tvm-weaknesses.md)
|
||||
|
||||
@ -26,6 +26,8 @@ Conducting a comprehensive security product evaluation can be a complex process
|
||||
The Microsoft Defender ATP evaluation lab is designed to eliminate the complexities of machine and environment configuration so that you can
|
||||
focus on evaluating the capabilities of the platform, running simulations, and seeing the prevention, detection, and remediation features in action.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUM]
|
||||
|
||||
When you get started with the lab, you'll be guided through a simple set-up process where you can specify the type of configuration that best suits your needs.
|
||||
|
||||
After the lab setup process is complete, you can add Windows 10 or Windows Server 2019 machines. These test machines come pre-configured to have the latest and greatest OS versions with the right security components in place and Office 2019 Standard installed.
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 51 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 64 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 25 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 68 KiB |
@ -30,6 +30,9 @@ When you investigate an incident, you'll see:
|
||||
- Incident comments and actions
|
||||
- Tabs (alerts, machines, investigations, evidence, graph)
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUV]
|
||||
|
||||
|
||||
## Analyze incident details
|
||||
Click an incident to see the **Incident pane**. Select **Open incident page** to see the incident details and related information (alerts, machines, investigations, evidence, graph).
|
||||
|
||||
|
||||
@ -1,123 +0,0 @@
|
||||
---
|
||||
title: Validate licensing provisioning and complete Microsoft Defender ATP set up
|
||||
description: Validating licensing provisioning, setting up initial preferences, and completing the user set up for Microsoft Defender Advanced Threat Protection portal.
|
||||
keywords: license, licensing, account, set up, validating licensing, windows defender atp
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Validate licensing provisioning and complete set up for Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-validatelicense-abovefoldlink)
|
||||
|
||||
## Check license state
|
||||
|
||||
Checking for the license state and whether it got properly provisioned, can be done through the admin center or through the **Microsoft Azure portal**.
|
||||
|
||||
1. To view your licenses go to the **Microsoft Azure portal** and navigate to the [Microsoft Azure portal license section](https://portal.azure.com/#blade/Microsoft_AAD_IAM/LicensesMenuBlade/Products).
|
||||
|
||||
|
||||
|
||||
1. Alternately, in the admin center, navigate to **Billing** > **Subscriptions**.
|
||||
|
||||
- On the screen you will see all the provisioned licenses and their current **Status**.
|
||||
|
||||
|
||||
|
||||
|
||||
## Cloud Service Provider validation
|
||||
|
||||
To gain access into which licenses are provisioned to your company, and to check the state of the licenses, go to the admin center.
|
||||
|
||||
1. From the **Partner portal**, click on the **Administer services > Office 365**.
|
||||
|
||||
2. Clicking on the **Partner portal** link will leverage the **Admin on behalf** option and will give you access to the customer admin center.
|
||||
|
||||
|
||||
|
||||
## Access Microsoft Defender Security Center for the first time
|
||||
|
||||
When accessing [Microsoft Defender Security Center](https://SecurityCenter.Windows.com) for the first time there will be a setup wizard that will guide you through some initial steps. At the end of the setup wizard there will be a dedicated cloud instance of Microsoft Defender ATP created.
|
||||
|
||||
1. Each time you access the portal you will need to validate that you are authorized to access the product. This **Set up your permissions** step will only be available if you are not currently authorized to access the product.
|
||||
|
||||
|
||||
|
||||
Once the authorization step is completed, the **Welcome** screen will be displayed.
|
||||
|
||||
2. The **Welcome** screen will provide some details as to what is about to occur during the set up wizard.
|
||||
|
||||
|
||||
|
||||
You will need to set up your preferences for Microsoft Defender Security Center.
|
||||
|
||||
3. Set up preferences
|
||||
|
||||
|
||||
|
||||
1. **Select data storage location** <br> When onboarding the service for the first time, you can choose to store your data in the Microsoft Azure datacenters in the United States, the European Union, or the United Kingdom. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation.
|
||||
|
||||
> [!WARNING]
|
||||
> This option cannot be changed without completely offboarding from Microsoft Defender ATP and completing a new enrollment process.
|
||||
|
||||
2. **Select the data retention policy** <br> Microsoft Defender ATP will store data up to a period of 6 months in your cloud instance, however, you have the option to set the data retention period for a shorter timeframe during this step of the set up process.
|
||||
|
||||
> [!NOTE]
|
||||
> This option can be changed at a later time.
|
||||
|
||||
3. **Select the size of your organization** <br> You will need to indicate the size of your organization based on an estimate of the number of employees currently employed.
|
||||
|
||||
> [!NOTE]
|
||||
> The **organization size** question is not related to how many licenses were purchased for your organization. It is used by the service to optimize the creation of the data cluster for your organization.
|
||||
|
||||
4. **Turn on preview features** <br> Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on **Preview features**.
|
||||
|
||||
You'll have access to upcoming features which you can provide feedback on to help improve the overall experience before features are generally available.
|
||||
|
||||
- Toggle the setting between On and Off to choose **Preview features**.
|
||||
|
||||
> [!NOTE]
|
||||
> This option can be changed at a later time.
|
||||
|
||||
4. You will receive a warning notifying you that you won't be able to change some of your preferences once you click **Continue**.
|
||||
|
||||
> [!NOTE]
|
||||
> Some of these options can be changed at a later time in Microsoft Defender Security Center.
|
||||
|
||||
|
||||
|
||||
5. A dedicated cloud instance of Microsoft Defender Security Center is being created at this time. This step will take an average of 5 minutes to complete.
|
||||
|
||||
6. You are almost done. Before you can start using Microsoft Defender ATP you'll need to:
|
||||
|
||||
- [Onboard Windows 10 machines](configure-endpoints.md)
|
||||
|
||||
- Run detection test (optional)
|
||||
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you click **Start using Microsoft Defender ATP** before onboarding machines you will receive the following notification:
|
||||
> 
|
||||
|
||||
7. After onboarding machines you can click **Start using Microsoft Defender ATP**. You will now launch Microsoft Defender ATP for the first time.
|
||||
|
||||
## Related topics
|
||||
- [Onboard machines to the Microsoft Defender Advanced Threat Protection service](onboard-configure.md)
|
||||
- [Troubleshoot onboarding process and portal access issues](troubleshoot-onboarding-error-messages.md)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Deploy Microsoft Defender ATP for Linux with Ansible
|
||||
ms.reviewer:
|
||||
ms.reviewer:
|
||||
description: Describes how to deploy Microsoft Defender ATP for Linux using Ansible.
|
||||
keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -14,7 +14,7 @@ author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
@ -36,14 +36,14 @@ This topic describes how to deploy Microsoft Defender ATP for Linux using Ansibl
|
||||
Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version.
|
||||
|
||||
- Ansible needs to be installed on at least on one computer (we will call it the master).
|
||||
- Passwordless SSH must be configured for the root user between the master and all clients.
|
||||
- SSH must be configured for an administrator account between the master and all clients, and it is recommended be configured with public key authentication.
|
||||
- The following software must be installed on all clients:
|
||||
- Python-apt
|
||||
- Curl
|
||||
- Unzip
|
||||
- curl
|
||||
- python-apt
|
||||
- unzip
|
||||
|
||||
- All hosts must be listed in the following format in the `/etc/ansible/hosts` file:
|
||||
|
||||
|
||||
```bash
|
||||
[servers]
|
||||
host1 ansible_ssh_host=10.171.134.39
|
||||
@ -67,7 +67,7 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
|
||||
4. From a command prompt, verify that you have the file. Extract the contents of the archive:
|
||||
|
||||
|
||||
```bash
|
||||
$ ls -l
|
||||
total 8
|
||||
@ -79,12 +79,11 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
## Create Ansible YAML files
|
||||
|
||||
Create subtask or role files that contribute to an actual task. Create the following files under the `/etc/ansible/roles` directory.
|
||||
Create subtask or role files that contribute to an actual task. First create the `copy_onboarding_pkg.yml` file under the `/etc/ansible/roles` directory:
|
||||
|
||||
- Copy the onboarding package to all client machines:
|
||||
|
||||
```bash
|
||||
$ cat /etc/ansible/roles/copy_onboarding_pkg.yml
|
||||
- name: Copy the zip file
|
||||
copy:
|
||||
src: /root/WindowsDefenderATPOnboardingPackage.zip
|
||||
@ -92,29 +91,33 @@ Create subtask or role files that contribute to an actual task. Create the follo
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Add Microsoft apt signing key
|
||||
apt_key:
|
||||
url: https://packages.microsoft.com/keys/microsoft.asc
|
||||
state: present
|
||||
when: ansible_os_family == "Debian"
|
||||
```
|
||||
|
||||
- Create a `setup.sh` script that operates on the onboarding file:
|
||||
- Create the `setup.sh` script that operates on the onboarding file, in this example located in the `/root` directory:
|
||||
|
||||
```bash
|
||||
$ cat /root/setup.sh
|
||||
|
||||
#!/bin/bash
|
||||
|
||||
# We assume WindowsDefenderATPOnboardingPackage.zip is stored in /root
|
||||
cd /root || exit 1
|
||||
# Unzip the archive and create the onboarding file
|
||||
mkdir -p /etc/opt/microsoft/mdatp/
|
||||
unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
cp mdatp_onboard.json /etc/opt/microsoft/mdatp/mdatp_onboard.json
|
||||
|
||||
# get the GPG key
|
||||
curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg
|
||||
sudo mv microsoft.gpg /etc/apt/trusted.gpg.d/
|
||||
```
|
||||
|
||||
- Create the onboarding file:
|
||||
- Create the onboarding task, `onboarding_setup.yml`, under the `/etc/ansible/roles` directory:
|
||||
|
||||
```bash
|
||||
$ cat setup_blob.yml
|
||||
- name: Register mdatp_onboard.json
|
||||
stat: path=/etc/opt/microsoft/mdatp/mdatp_onboard.json
|
||||
register: mdatp_onboard
|
||||
|
||||
- name: Copy the setup script file
|
||||
copy:
|
||||
src: /root/setup.sh
|
||||
@ -124,7 +127,8 @@ Create subtask or role files that contribute to an actual task. Create the follo
|
||||
mode: '0744'
|
||||
|
||||
- name: Run a script to create the onboarding file
|
||||
script: /root/setup.sh
|
||||
script: /root/setup.sh
|
||||
when: not mdatp_onboard.stat.exists
|
||||
```
|
||||
|
||||
- Add the Microsoft Defender ATP repository and key.
|
||||
@ -142,28 +146,22 @@ Create subtask or role files that contribute to an actual task. Create the follo
|
||||
> [!NOTE]
|
||||
> In case of Oracle Linux, replace *[distro]* with “rhel”.
|
||||
|
||||
- For apt-based distributions use the following YAML file:
|
||||
|
||||
```bash
|
||||
$ cat add_apt_repo.yml
|
||||
- name: Add Microsoft repository for MDATP
|
||||
- name: Add Microsoft apt repository for MDATP
|
||||
apt_repository:
|
||||
repo: deb [arch=arm64,armhf,amd64] https://packages.microsoft.com/[distro]/[version]/prod [channel] main
|
||||
update_cache: yes
|
||||
state: present
|
||||
filename: microsoft-[channel].list
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- name: Add Microsoft APT key
|
||||
apt_key:
|
||||
keyserver: https://packages.microsoft.com/
|
||||
id: BC528686B50D79E339D3721CEB3E94ADBE1229C
|
||||
```
|
||||
apt_key:
|
||||
keyserver: https://packages.microsoft.com/
|
||||
id: BC528686B50D79E339D3721CEB3E94ADBE1229C
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- For yum-based distributions use the following YAML file:
|
||||
|
||||
```bash
|
||||
$ cat add_yum_repo.yml
|
||||
- name: Add Microsoft repository for MDATP
|
||||
- name: Add Microsoft yum repository for MDATP
|
||||
yum_repository:
|
||||
name: packages-microsoft-com-prod-[channel]
|
||||
description: Microsoft Defender ATP
|
||||
@ -171,6 +169,7 @@ Create subtask or role files that contribute to an actual task. Create the follo
|
||||
baseurl: https://packages.microsoft.com/[distro]/[version]/[channel]/
|
||||
gpgcheck: yes
|
||||
enabled: Yes
|
||||
when: ansible_os_family == "RedHat"
|
||||
```
|
||||
|
||||
- Create the actual install/uninstall YAML files under `/etc/ansible/playbooks`.
|
||||
|
||||
@ -27,6 +27,8 @@ Live response is a capability that gives you instantaneous access to a machine u
|
||||
|
||||
Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUW]
|
||||
|
||||
With live response, analysts will have the ability to:
|
||||
- Run basic and advanced commands to do investigative work
|
||||
- Download files such as malware samples and outcomes of PowerShell scripts
|
||||
|
||||
@ -34,6 +34,9 @@ Microsoft Cloud App Security (Cloud App Security) is a comprehensive solution th
|
||||
|
||||
Cloud App Security discovery relies on cloud traffic logs being forwarded to it from enterprise firewall and proxy servers. Microsoft Defender ATP integrates with Cloud App Security by collecting and forwarding all cloud app networking activities, providing unparalleled visibility to cloud app usage. The monitoring functionality is built into the device, providing complete coverage of network activity.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4r4yQ]
|
||||
|
||||
|
||||
The integration provides the following major improvements to the existing Cloud App Security discovery:
|
||||
|
||||
- Available everywhere - Since the network activity is collected directly from the endpoint, it's available wherever the device is, on or off corporate network, as it's no longer depended on traffic routed through the enterprise firewall or proxy servers.
|
||||
|
||||
@ -29,6 +29,9 @@ ms.topic: article
|
||||
|
||||
Microsoft Defender ATP supports streaming all the events available through [Advanced Hunting](advanced-hunting-overview.md) to an [Event Hubs](https://docs.microsoft.com/azure/event-hubs/) and/or [Azure storage account](https://docs.microsoft.com/azure/event-hubs/).
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4r4ga]
|
||||
|
||||
|
||||
## In this section
|
||||
|
||||
Topic | Description
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Security recommendation
|
||||
description: The weaknesses identified in the environment are mapped to actionable security recommendations and prioritized by their impact on the organizational exposure score.
|
||||
title: Security recommendations
|
||||
description: Get actionable security recommendations prioritized by threat, likelihood to be breached, and value.
|
||||
keywords: threat and vulnerability management, mdatp tvm security recommendation, cybersecurity recommendation, actionable security recommendation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -8,17 +8,18 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.author: ellevin
|
||||
author: levinec
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/11/2019
|
||||
---
|
||||
# Security recommendation
|
||||
# Security recommendations
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> [!TIP]
|
||||
@ -26,80 +27,77 @@ ms.date: 04/11/2019
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The cyber security weaknesses identified in your organization are mapped to actionable security recommendations and prioritized by their impact on the security recommendation list. Prioritized recommendation helps shorten the mean time to mitigate or remediate vulnerabilities and drive compliance.
|
||||
Cybersecurity weaknesses identified in your organization are mapped to actionable security recommendations and prioritized by their impact. Prioritized recommendation helps shorten the time to mitigate or remediate vulnerabilities and drive compliance.
|
||||
|
||||
Each security recommendation includes an actionable remediation recommendation which can be pushed into the IT task queue through a built-in integration with Microsoft Intune and Microsoft Endpoint Configuration Manager. It is also dynamic in the sense that when the threat landscape changes, the recommendation also changes as it continuously collects information from your environment.
|
||||
Each security recommendation includes an actionable remediation recommendation which can be pushed into the IT task queue through a built-in integration with Microsoft Intune and Microsoft Endpoint Configuration Manager. When the threat landscape changes, the recommendation also changes as it continuously collects information from your environment.
|
||||
|
||||
## The basis of the security recommendation
|
||||
Each machine in the organization is scored based on three important factors: threat, likelihood to be breached, and value, to help customers to focus on the right things at the right time.
|
||||
## Criteria
|
||||
|
||||
- Threat - Characteristics of the vulnerabilities and exploits in your organizations' devices and breach history. Based on these factors, the security recommendations shows the corresponding links to active alerts, ongoing threat campaigns, and their corresponding threat analytic reports.
|
||||
Each machine in the organization is scored based on three important factors to help customers to focus on the right things at the right time.
|
||||
|
||||
- Breach likelihood - Your organization's security posture and resilience against threats
|
||||
- **Threat** - Characteristics of the vulnerabilities and exploits in your organizations' devices and breach history. Based on these factors, the security recommendations shows the corresponding links to active alerts, ongoing threat campaigns, and their corresponding threat analytic reports.
|
||||
|
||||
- Business value - Your organization's assets, critical processes, and intellectual properties
|
||||
- **Breach likelihood** - Your organization's security posture and resilience against threats
|
||||
|
||||
- **Business value** - Your organization's assets, critical processes, and intellectual properties
|
||||
|
||||
## Navigate through your security recommendations
|
||||
## Navigate to security recommendations
|
||||
|
||||
You can access the security recommendation from the Microsoft Defender ATP Threat & Vulnerability Management menu, dashboard, software page, and machine page, to give you the context that you need, as you require it.
|
||||
You can access security recommendations from the Microsoft Defender ATP Threat & Vulnerability Management menu, dashboard, software page, and machine page.
|
||||
|
||||
*Security recommendations option from the left navigation menu*
|
||||
### Top security recommendations in the Threat & Vulnerability Management dashboard
|
||||
|
||||
1. Go to the Threat & Vulnerability Management navigation menu and select **Security recommendations** to open up the list of security recommendations for the threats and vulnerabilities found in your organization. It gives you an overview of the security recommendation context: weaknesses found, related components, the application and operating system where the threat or vulnerabilities were found, network, accounts, and security controls, associated breach, threats, and recommendation insights, exposed machine trends, status, remediation type and activities.
|
||||
|
||||
In a given day as a Security Administrator, you can take a look at the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md) to see your [exposure score](tvm-exposure-score.md) side-by-side with your [configuration score](configuration-score.md). The goal is to **lower** your organization's exposure from vulnerabilities, and **increase** your organization's security configuration to be more resilient against cybersecurity threat attacks. The top security recommendations list can help you achieve that goal.
|
||||
|
||||
>[!NOTE]
|
||||
> The color of the **Exposed machines** graph changes as the trend changes. If the number of exposed machines is on the rise, the color changes into red. If there's a decrease in the amount of exposed machines, the color of the graph will change into green. This happens when the numbers on the right hand side is greater than what’s on the left, which means an increase or decrease at the end of even a single machine will change the graph's color.
|
||||
|
||||
|
||||
You can filter your view based on related components, status, and remediation type. If you want to see the remediation activities of software and software versions which have reached their end-of-life, select **Active**, then select **Software update** from the **Remediation Type** filter, and click **Apply**.
|
||||
<br></br>
|
||||
The top security recommendations lists the improvement opportunities prioritized based on the important factors mentioned in the previous section - threat, likelihood to be breached, and value. Selecting a recommendation will take you to the security recommendations page with more details about the recommendation.
|
||||
|
||||
2. Select the security recommendation that you need to investigate or process.
|
||||
<br></br>
|
||||
### Navigation menu
|
||||
|
||||
|
||||
*Top security recommendations from the dashboard*
|
||||
Go to the Threat & Vulnerability Management navigation menu and select **Security recommendations** to open the list of security recommendations for the threats and vulnerabilities found in your organization.
|
||||
|
||||
In a given day as a Security Administrator, you can take a look at the dashboard to see your exposure score side-by-side with your configuration score. The goal is to lower down your organization's exposure from vulnerabilities, and increase your organization's security configuration to be more resilient against cybersecurity threat attacks. The top security recommendations list can help you achieve that goal.
|
||||
## Security recommendations overview
|
||||
|
||||
The top security recommendations lists down the improvement opportunities prioritized based on the three important factors mentioned in the previous section - threat, likelihood to be breached, and value.
|
||||
You will be able to view the recommendation, the number of weaknesses found, related components, threat insights, number of exposed machines, status, remediation type, remediation activities, impact to your exposure and configuration scores, and associated tags.
|
||||
|
||||
You can click on each one of them and see the details, the description, the potential risk if you don't act on or remediate it, insights, vulnerabilities, other threats found, how many exposed devices are associated with the security recommendation, and business impact of each security recommendation on the organizational exposure and configuration score.
|
||||
The color of the **Exposed machines** graph changes as the trend changes. If the number of exposed machines is on the rise, the color changes into red. If there's a decrease in the amount of exposed machines, the color of the graph will change into green. This happens when the numbers on the right hand side is greater than what's on the left, which means an increase or decrease at the end of even a single machine will change the graph's color.
|
||||
|
||||
From that page, you can do any of the following depending on what you need to do:
|
||||
|
||||
|
||||
- Open software page - Drill down and open the software page to get more context of the software details, prevalence in the organization, weaknesses discovered, version distribution, software or software version end-of-life, and charts so you can see the exposure trend over time.
|
||||
Select the security recommendation that you want to investigate or process.
|
||||
|
||||
- Choose from remediation options - Submit a remediation request to open a ticket in Microsoft Intune for your IT Administrator to pick up and address.
|
||||
|
||||
|
||||
- Choose from exception options - Submit an exception, provide justification, and set exception duration if you can't remediate the issue just yet due to specific business reasons, compensation controls, or if it is a false positive.
|
||||
From the flyout, you can do any of the following:
|
||||
|
||||
- **Open software page** - Drill down and open the software page to get more context of the software details, prevalence in the organization, weaknesses discovered, version distribution, software or software version end-of-life, and charts so you can see the exposure trend over time.
|
||||
|
||||
- **Remediation options** - Submit a remediation request to open a ticket in Microsoft Intune for your IT Administrator to pick up and address.
|
||||
|
||||
- **Exception options** - Submit an exception, provide justification, and set exception duration if you can't remediate the issue just yet due to specific business reasons, compensation controls, or if it is a false positive.
|
||||
|
||||
>[!NOTE]
|
||||
>When a change is made on a machine, it may take up to two hours for the data to be reflected in the Microsoft Defender Security Center.
|
||||
|
||||
## Report inaccuracy
|
||||
|
||||
You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated security recommendation information in the machine page.
|
||||
You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated security recommendation information.
|
||||
|
||||
1. Select the **Security recommendation** tab.
|
||||
1. Open the Security recommendation.
|
||||
|
||||
2. Click **:** beside the security recommendation that you want to report about, then select **Report inaccuracy**.
|
||||
|
||||
<br>A flyout pane opens.</br>
|
||||
|
||||
2. Select the three dots beside the security recommendation that you want to report, then select **Report inaccuracy**.
|
||||
|
||||
3. From the flyout pane, select the inaccuracy category from the drop-down menu.
|
||||
<br></br>
|
||||
|
||||
|
||||
4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported.
|
||||
3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details regarding the inaccuracy.
|
||||
|
||||
5. Include your machine name for investigation context.
|
||||
|
||||
>[!TIP]
|
||||
> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context.
|
||||
|
||||
6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context.
|
||||
|
||||
|
||||
4. Select **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md)
|
||||
@ -109,9 +107,9 @@ You can report a false positive when you see any vague, inaccurate, incomplete,
|
||||
- [Software inventory](tvm-software-inventory.md)
|
||||
- [Weaknesses](tvm-weaknesses.md)
|
||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||
- [Configure data access for Threat & Vulnerability Management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
- [Recommendation APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/vulnerability)
|
||||
- [Machine APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine)
|
||||
- [Score APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/score)
|
||||
- [Software APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/software)
|
||||
- [Vulnerability APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/vulnerability)
|
||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
- [Recommendation APIs](vulnerability.md)
|
||||
- [Machine APIs](machine.md)
|
||||
- [Score APIs](score.md)
|
||||
- [Software APIs](software.md)
|
||||
- [Vulnerability APIs](vulnerability.md)
|
||||
|
||||
@ -8,33 +8,37 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.author: ellevin
|
||||
author: levinec
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/11/2019
|
||||
---
|
||||
# Software inventory
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
Microsoft Defender ATP Threat & Vulnerability management's discovery capability shows in the **Software inventory** page. The software inventory includes the name of the product or vendor, the latest version it is in, and the number of weaknesses and vulnerabilities detected with it.
|
||||
|
||||
## Navigate through your software inventory
|
||||
1. Select **Software inventory** from the Threat & Vulnerability management navigation menu. The **Software inventory** page opens with a list of software installed in your network, vendor name, weaknesses found, threats associated with them, exposed machines, impact, tags. You can also filter the software inventory list view based on weaknesses found in the software, threats associated with them, and whether the software or software versions have reached their end-of-life.
|
||||
|
||||
1. Select **Software inventory** from the Threat & Vulnerability management navigation menu. The **Software inventory** page opens with a list of software installed in your network, vendor name, weaknesses found, threats associated with them, exposed machines, impact to exposure score, tags. You can also filter the software inventory list view based on weaknesses found in the software, threats associated with them, and whether the software or software versions have reached end-of-support.
|
||||
|
||||
2. In the **Software inventory** page, select the software that you want to investigate and a flyout panel opens up with the same details mentioned above but in a more compact view. You can either dive deeper into the investigation and select **Open software page** or flag any technical inconsistencies by selecting **Report inaccuracy**.
|
||||
3. Select **Open software page** to dive deeper into your software inventory to see how many weaknesses are discovered in the software, devices exposed, installed machines, version distribution, and the corresponding security recommendations for the weaknesses and vulnerabilities identified. From the **Version distribution** tab, you can also filter the view by **Version EOL** if you want to see the software versions that has reached their end-of-life which needs to be uninstalled, replaced, or updated.
|
||||
|
||||
2. In the **Software inventory** page, select the software that you want to investigate and a flyout panel opens up with the same details mentioned above but in a more compact view. You can either dive deeper into the investigation and select **Open software page** or flag any technical inconsistencies by selecting **Report inaccuracy**.
|
||||
|
||||
3. Select **Open software page** to dive deeper into your software inventory to see how many weaknesses are discovered in the software, devices exposed, installed machines, version distribution, and the corresponding security recommendations for the weaknesses and vulnerabilities identified.
|
||||
|
||||
## How it works
|
||||
In the field of discovery, we are leveraging the same set of signals in Microsoft Defender ATP's endpoint detection and response that's responsible for detection, for vulnerability assessment.
|
||||
|
||||
In the field of discovery, we are leveraging the same set of signals in Microsoft Defender ATP's endpoint detection and response that's responsible for detection, for vulnerability assessment.
|
||||
|
||||
Since it is real-time, in a matter of minutes, you will see vulnerability information as they get discovered. The engine automatically grabs information from multiple security feeds. In fact, you'll will see if a particular software is connected to a live threat campaign. It also provides a link to a Threat Analytics report soon as it's available.
|
||||
|
||||
@ -42,29 +46,22 @@ Since it is real-time, in a matter of minutes, you will see vulnerability inform
|
||||
|
||||
You can report a false positive when you see any vague, inaccurate version, incomplete, or already remediated software inventory information in the machine page.
|
||||
|
||||
1. Select the **Software inventory** tab.
|
||||
1. Select one of the software rows. A flyout will appear.
|
||||
|
||||
2. Click **:** beside the software that you want to report about, and then select **Report inaccuracy**.
|
||||
|
||||
<br>A flyout pane opens.</br>
|
||||
|
||||
2. Select "Report inaccuracy" in the flyout
|
||||
|
||||
3. From the flyout pane, select the inaccuracy category from the **Software inventory inaccuracy reason** drop-down menu.
|
||||
<br></br>
|
||||
|
||||
|
||||
4. Include your email address so Microsoft can send you feedback regarding the inaccuracy you reported.
|
||||
3. From the flyout pane, select the inaccuracy category from the drop-down menu, fill in your email address, and details regarding the inaccuracy.
|
||||
|
||||
5. Include your machine name for investigation context.
|
||||
|
||||
>[!NOTE]
|
||||
> You can also provide details regarding the inaccuracy you reported in the **Tell us more (optional)** field to give the threat and vulnerability management investigators context.
|
||||
|
||||
6. Click **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts with its context.
|
||||
|
||||
|
||||
4. Select **Submit**. Your feedback is immediately sent to the Threat & Vulnerability Management experts.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Supported operating systems and platforms](tvm-supported-os.md)
|
||||
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md)
|
||||
- [Exposure score](tvm-exposure-score.md)
|
||||
- [Configuration score](configuration-score.md)
|
||||
@ -72,10 +69,9 @@ You can report a false positive when you see any vague, inaccurate version, inco
|
||||
- [Remediation and exception](tvm-remediation.md)
|
||||
- [Weaknesses](tvm-weaknesses.md)
|
||||
- [Scenarios](threat-and-vuln-mgt-scenarios.md)
|
||||
- [Configure data access for Threat & Vulnerability Management roles](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
- [Software APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/software)
|
||||
- [Machine APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine)
|
||||
- [Vulnerability APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/vulnerability)
|
||||
- [Recommendation APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/vulnerability)
|
||||
- [Score APIs](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/score)
|
||||
|
||||
- [Configure data access for Threat & Vulnerability Management roles](user-roles.md#create-roles-and-assign-the-role-to-an-azure-active-directory-group)
|
||||
- [Recommendation APIs](vulnerability.md)
|
||||
- [Machine APIs](machine.md)
|
||||
- [Score APIs](score.md)
|
||||
- [Software APIs](software.md)
|
||||
- [Vulnerability APIs](vulnerability.md)
|
||||
|
||||
@ -24,10 +24,12 @@ ms.collection:
|
||||
|
||||
## What is shadow protection?
|
||||
|
||||
Shadow protection (currently in [limited private preview](#can-i-participate-in-the-private-preview-of-shadow-protection)) extends behavioral-based blocking and containment capabilities by blocking malicious artifacts or behaviors even if [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) is not your active antivirus protection. If your organization has decided to use an antivirus solution other than Windows Defender Antivirus, you are still protected through shadow protection.
|
||||
When enabled, shadow protection extends behavioral-based blocking and containment capabilities by blocking malicious artifacts or behaviors observed through post-breach protection. This is the case even if [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) is not your active antivirus protection. Shadow protection is useful if your organization has not fully transitioned to Windows Defender Antivirus and you are presently using a third-party antivirus solution. Shadow protection works behind the scenes by remediating malicious entities identified in post-breach protection that the existing third-party antivirus solution missed.
|
||||
|
||||
> [!TIP]
|
||||
> To get the best protection, [deploy Microsoft Defender ATP baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline). And see [Better together: Windows Defender Antivirus and Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus).
|
||||
> [!NOTE]
|
||||
> Shadow protection is currently in [limited private preview](#can-i-participate-in-the-private-preview-of-shadow-protection).
|
||||
|
||||
To get the best protection, [deploy Microsoft Defender ATP baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline). And see [Better together: Windows Defender Antivirus and Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus).
|
||||
|
||||
## What happens when something is detected?
|
||||
|
||||
|
||||
@ -21,23 +21,24 @@
|
||||
### [Audit WDAC policies](audit-windows-defender-application-control-policies.md)
|
||||
### [Merge WDAC policies](merge-windows-defender-application-control-policies.md)
|
||||
### [Enforce WDAC policies](enforce-windows-defender-application-control-policies.md)
|
||||
### [Allow COM object registration](allow-com-object-registration-in-windows-defender-application-control-policy.md)
|
||||
### [Deploy WDAC policies using Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md)
|
||||
### [Deploy WDAC policies using Intune](deploy-windows-defender-application-control-policies-using-intune.md)
|
||||
### [Allow COM object registration](allow-com-object-registration-in-windows-defender-application-control-policy.md)
|
||||
### [Use WDAC with .NET hardening](use-windows-defender-application-control-with-dynamic-code-security.md)
|
||||
### [Query WDAC events with Advanced hunting](querying-application-control-events-centrally-using-advanced-hunting.md)
|
||||
### [Manage packaged apps with WDAC](manage-packaged-apps-with-windows-defender-application-control.md)
|
||||
### [Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules](use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md)
|
||||
### [Use code signing to simplify application control for classic Windows applications](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md)
|
||||
#### [Optional: Use the Device Guard Signing Portal in the Microsoft Store for Business](use-device-guard-signing-portal-in-microsoft-store-for-business.md)
|
||||
#### [Optional: Create a code signing cert for WDAC](create-code-signing-cert-for-windows-defender-application-control.md)
|
||||
#### [Deploy catalog files to support WDAC](deploy-catalog-files-to-support-windows-defender-application-control.md)
|
||||
### [Manage packaged apps with WDAC](manage-packaged-apps-with-windows-defender-application-control.md)
|
||||
### [Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules](use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md)
|
||||
### [Use signed policies to protect Windows Defender Application Control against tampering](use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md)
|
||||
#### [Signing WDAC policies with SignTool.exe](signing-policies-with-signtool.md)
|
||||
### [Disable WDAC policies](disable-windows-defender-application-control-policies.md)
|
||||
### [LOB Win32 Apps on S Mode](LOB-win32-apps-on-s.md)
|
||||
|
||||
|
||||
## [Windows Defender Application Control operational guide](windows-defender-application-control-operational-guide.md)
|
||||
### [Understanding Application Control events](event-id-explanations.md)
|
||||
### [Query WDAC events with Advanced hunting](querying-application-control-events-centrally-using-advanced-hunting.md)
|
||||
|
||||
## [AppLocker](applocker\applocker-overview.md)
|
||||
### [Administer AppLocker](applocker\administer-applocker.md)
|
||||
|
||||
@ -0,0 +1,80 @@
|
||||
---
|
||||
title: Understanding Application Control events (Windows 10)
|
||||
description: Learn what different Windows Defender Application Control events signify.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 3/17/2020
|
||||
---
|
||||
|
||||
# Understanding Application Control events
|
||||
|
||||
A Windows Defender Application Control (WDAC) policy logs events locally in Windows Event Viewer in either enforced or audit mode. These events are generated under two locations:
|
||||
|
||||
1. Event IDs beginning with 30 appear in Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational
|
||||
2. Event IDs beginning with 80 appear in Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script
|
||||
|
||||
## Microsoft Windows CodeIntegrity Operational log event IDs
|
||||
|
||||
| Event ID | Explanation |
|
||||
|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 3076 | Audit executable/dll file |
|
||||
| 3077 | Block executable/dll file |
|
||||
| 3089 | Signing information event correlated with either a 3076 or 3077 event. One 3089 event is generated for each signature of a file. Contains the total number of signatures on a file and an index as to which signature it is.<br>Unsigned files will generate a single 3089 event with TotalSignatureCount 0. Correlated in the “System” portion of the event data under “Correlation ActivityID”. |
|
||||
| 3099 | Indicates that a policy has been loaded |
|
||||
|
||||
## Microsoft Windows Applocker MSI and Script log event IDs
|
||||
|
||||
| Event ID | Explanation |
|
||||
|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 8028 | Audit script/MSI file generated by Windows LockDown Policy (WLDP) being called by the scripthosts themselves. Note: there is no WDAC enforcement on 3rd party scripthosts. |
|
||||
| 8029 | Block script/MSI file |
|
||||
| 8038 | Signing information event correlated with either a 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. Correlated in the “System” portion of the event data under “Correlation ActivityID”. | |
|
||||
|
||||
## Optional Intelligent Security Graph (ISG) or Managed Installer (MI) diagnostic events
|
||||
|
||||
If either the ISG or MI is enabled in a WDAC policy, you can optionally choose to enable 3090, 3091, and 3092 events to provide additional diagnostic information.
|
||||
|
||||
| Event ID | Explanation |
|
||||
|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 3090 | Allow executable/dll file |
|
||||
| 3091 | Audit executable/dll file |
|
||||
| 3092 | Block executable/dll file |
|
||||
|
||||
3090, 3091, and 3092 events are generated based on the status code of whether a binary passed the policy, regardless of what reputation it was given or whether it was allowed by a designated MI. The SmartLocker template which appears in the event should indicate why the binary passed/failed. Only one event is generated per binary pass/fail. If both ISG and MI are disabled, 3090, 3091, and 3092 events will not be generated.
|
||||
|
||||
### SmartLocker template
|
||||
|
||||
Below are the fields which help to diagnose what a 3090, 3091, or 3092 event indicates.
|
||||
|
||||
| Name | Explanation |
|
||||
|-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| StatusCode | STATUS_SUCCESS indicates a binary passed the active WDAC policies. If so, a 3090 event is generated. If not, a 3091 event is generated if the blocking policy is in audit mode, and a 3092 event is generated if the policy is in enforce mode. |
|
||||
| ManagedInstallerEnabled | Policy trusts a MI |
|
||||
| PassesManagedInstaller | File originated from a trusted MI |
|
||||
| SmartlockerEnabled | Policy trusts the ISG |
|
||||
| PassesSmartlocker | File had positive reputation |
|
||||
| AuditEnabled | True if the policy is in audit mode, otherwise it is in enforce mode |
|
||||
|
||||
### Enabling ISG and MI diagnostic events
|
||||
|
||||
In order to enable 3091 audit events and 3092 block events, you must create a TestFlags regkey with a value of 0x100. You can do so using the following PowerShell command:
|
||||
|
||||
```powershell
|
||||
reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x100
|
||||
```
|
||||
In order to enable 3090 allow events, you must create a TestFlags regkey with a value of 0x300. You can do so using the following PowerShell command:
|
||||
|
||||
```powershell
|
||||
reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x300
|
||||
```
|
||||
@ -1,91 +0,0 @@
|
||||
---
|
||||
title: Signing Windows Defender Application Control policies with SignTool.exe (Windows 10)
|
||||
description: SSigned WDAC policies give organizations the highest level of malware protection available in Windows 10.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 02/21/2018
|
||||
---
|
||||
|
||||
# Signing Windows Defender Application Control policies with SignTool.exe
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
Signed WDAC policies give organizations the highest level of malware protection available in Windows 10.
|
||||
In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer.
|
||||
These policies are designed to prevent administrative tampering and kernel mode exploit access.
|
||||
With this in mind, it is much more difficult to remove signed WDAC policies.
|
||||
Before you sign and deploy a signed WDAC policy, we recommend that you [audit the policy](audit-windows-defender-application-control-policies.md) to discover any blocked applications that should be allowed to run.
|
||||
|
||||
Signing WDAC policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward.
|
||||
If you do not currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md) to create one with your on-premises CA.
|
||||
|
||||
Before signing WDAC policies for the first time, be sure to enable rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) to leave troubleshooting options available to administrators. To ensure that a rule option is enabled, you can run a command such as `Set-RuleOption -FilePath <PathAndFilename> -Option 9` even if you're not sure whether the option is already enabled—if so, the command has no effect. When validated and ready for enterprise deployment, you can remove these options. For more information about rule options, see [Windows Defender Application Control policy rules](select-types-of-rules-to-create.md).
|
||||
|
||||
To sign a WDAC policy with SignTool.exe, you need the following components:
|
||||
|
||||
- SignTool.exe, found in the Windows SDK (Windows 7 or later)
|
||||
|
||||
- The binary format of the WDAC policy that you generated in the [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md) section or another WDAC policy that you have created
|
||||
|
||||
- An internal CA code signing certificate or a purchased code signing certificate
|
||||
|
||||
If you do not have a code signing certificate, see the [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md) section for instructions on how to create one. If you use an alternate certificate or WDAC policy, be sure to update the following steps with the appropriate variables and certificate so that the commands will function properly. To sign the existing WDAC policy, copy each of the following commands into an elevated Windows PowerShell session:
|
||||
|
||||
1. Initialize the variables that will be used:
|
||||
|
||||
`$CIPolicyPath=$env:userprofile+"\Desktop\"`
|
||||
|
||||
`$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"`
|
||||
|
||||
`$CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"`
|
||||
|
||||
> [!NOTE]
|
||||
> This example uses the WDAC policy that you created in [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md). If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information.
|
||||
|
||||
2. Import the .pfx code signing certificate. Import the code signing certificate that you will use to sign the WDAC policy into the signing user’s personal store on the computer that will be doing the signing. In this example, you use the certificate that was created in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md).
|
||||
|
||||
3. Export the .cer code signing certificate. After the code signing certificate has been imported, export the .cer version to your desktop. This version will be added to the policy so that it can be updated later.
|
||||
|
||||
4. Navigate to your desktop as the working directory:
|
||||
|
||||
`cd $env:USERPROFILE\Desktop`
|
||||
|
||||
5. Use [Add-SignerRule](https://docs.microsoft.com/powershell/module/configci/add-signerrule) to add an update signer certificate to the WDAC policy:
|
||||
|
||||
`Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath <Path to exported .cer certificate> -Kernel -User –Update`
|
||||
|
||||
> [!NOTE]
|
||||
> \<Path to exported .cer certificate> should be the full path to the certificate that you exported in step 3.
|
||||
Also, adding update signers is crucial to being able to modify or disable this policy in the future.
|
||||
|
||||
6. Use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption) to remove the unsigned policy rule option:
|
||||
|
||||
`Set-RuleOption -FilePath $InitialCIPolicy -Option 6 -Delete`
|
||||
|
||||
7. Use [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy) to convert the policy to binary format:
|
||||
|
||||
`ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin`
|
||||
|
||||
8. Sign the WDAC policy by using SignTool.exe:
|
||||
|
||||
`<Path to signtool.exe> sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin`
|
||||
|
||||
> [!NOTE]
|
||||
> The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the WDAC policy. You should import this certificate to your personal certificate store on the computer you use to sign the policy.
|
||||
|
||||
9. Validate the signed file. When complete, the commands should output a signed policy file called DeviceGuardPolicy.bin.p7 to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy WDAC policies, see [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md).
|
||||
|
||||
@ -28,10 +28,8 @@ ms.date: 05/03/2018
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Signed WDAC policies give organizations the highest level of malware protection available in Windows 10.
|
||||
In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer.
|
||||
These policies are designed to prevent administrative tampering and kernel mode exploit access.
|
||||
With this in mind, it is much more difficult to remove signed WDAC policies.
|
||||
Signed WDAC policies give organizations the highest level of malware protection available in Windows 10. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed WDAC policies. Note that SecureBoot must be enabled in order to restrict users from updating or removing signed WDAC policies.
|
||||
|
||||
Before you sign and deploy a signed WDAC policy, we recommend that you [audit the policy](audit-windows-defender-application-control-policies.md) to discover any blocked applications that should be allowed to run.
|
||||
|
||||
Signing WDAC policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward.
|
||||
|
||||
@ -0,0 +1,42 @@
|
||||
---
|
||||
title: Managing and troubleshooting Windows Defender Application Control policies (Windows 10)
|
||||
description: Gather information about how your deployed Windows Defender Application Control policies are behaving.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 03/16/2020
|
||||
---
|
||||
|
||||
# Windows Defender Application Control operational guide
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
After designing and deploying your Windows Defender Application Control (WDAC) policies, this guide covers understanding the effects your policies are having and troubleshooting when they are not behaving as expected. It contains information on where to find events and what they mean, and also querying these events with Microsoft Defender Advanted Threat Protection (MDATP) Advanced Hunting feature.
|
||||
|
||||
## WDAC Events Overview
|
||||
|
||||
WDAC generates and logs events when a policy is loaded as well as when a binary attempts to execute and is blocked. These events include information that identifies the policy and gives more details about the block. Generally, WDAC does not generate events when a binary is allowed; however, there is the option to enable allow events when Managed Installer and/or the Intelligent Security Graph (ISG) is configured.
|
||||
|
||||
WDAC events are generated under two locations:
|
||||
|
||||
1. Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational
|
||||
2. Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script
|
||||
|
||||
## In this section
|
||||
|
||||
| Topic | Description |
|
||||
| - | - |
|
||||
| [Understanding Application Control events](event-id-explanations.md) | This topic explains the meaning of different WDAC events. |
|
||||
| [Query WDAC events with Advanced hunting](querying-application-control-events-centrally-using-advanced-hunting.md) | This topic covers how to view WDAC events centrally from all systems that are connected to Microsoft Defender ATP. |
|
||||
Reference in New Issue
Block a user