diff --git a/windows/security/index.yml b/windows/security/index.yml index 05c303413e..c06e4aad88 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -85,7 +85,7 @@ sections: Prevent, detect, investigate, and respond to advanced threats. The following capabilities are available across multiple products that make up the Windows Defender ATP platform.
 
- + diff --git a/windows/security/threat-protection/TOC.md b/windows/security/threat-protection/TOC.md index a2056d0d86..2340e23606 100644 --- a/windows/security/threat-protection/TOC.md +++ b/windows/security/threat-protection/TOC.md @@ -15,20 +15,20 @@ #### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md) #### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md) -#### [Evaluate WDATP](evaluate.md) -##### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) +#### [Evaluate Windows Defender ATP](evaluate.md) +##### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) ##### [Evaluate Exploit protection](windows-defender-exploit-guard\evaluate-exploit-protection.md) ##### [Evaluate Network Protection](windows-defender-exploit-guard\evaluate-network-protection.md) ##### [Evaluate Controlled folder access](windows-defender-exploit-guard\evaluate-controlled-folder-access.md) -##### [Evaluate Attack surface reduction - ASR controls](windows-defender-exploit-guard\evaluate-attack-surface-reduction.md) +##### [Evaluate Windows Defender Antivirus protection](windows-defender-antivirus\evaluate-windows-defender-antivirus.md) ##### [Evaluate Windows Defender Exploit Guard-rewrite](windows-defender-exploit-guard\evaluate-windows-defender-exploit-guard.md) ##### [Use auditing mode to evaluate Windows Defender Exploit Guard](windows-defender-exploit-guard\audit-windows-defender-exploit-guard.md) +##### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) - -### [Onboard and configure](onboard.md) -#### [Onboard machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) +### [Onboard and configure machines to Windows Defender ATP](onboard.md) +#### [Onboard machines - need to revise this page](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md) ##### [Onboard previous versions of Windows](windows-defender-atp\onboard-downlevel-windows-defender-advanced-threat-protection.md) ##### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md) ###### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md) @@ -43,12 +43,21 @@ ##### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md) ##### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md) ##### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) + + + + ####[Configure ASR](configure1.md) +##### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) +##### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) +##### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) -#### [Configure NGP](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) + + +#### [Configure Next generation protection](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md) ##### [Windows Defender AV on Windows Server 2016](windows-defender-antivirus\windows-defender-antivirus-on-windows-server-2016.md) ##### [Windows Defender Antivirus compatibility](windows-defender-antivirus\windows-defender-antivirus-compatibility.md) ###### [Use limited periodic scanning in Windows Defender AV](windows-defender-antivirus\limited-periodic-scanning-windows-defender-antivirus.md) @@ -88,7 +97,7 @@ -####[Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) +#### [Configure AutoIR - needs new content, u can configure through the portal settings + link to the settings page](configure3.md) @@ -122,13 +131,11 @@ -### [Windows Defender Security Center](windows-defender-atp/windows-defender-security-center-atp.md) -#### [Understand the portal / Windows Defender Security Center ](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) -##### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) -##### [View the Security operations dashboard](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) +### [Windows Defender Security Center](windows-defender-atp\use-windows-defender-advanced-threat-protection.md) +#### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md) +#### [View the Security operations dashboard - consdier moving to the relevant pillar](windows-defender-atp\security-operations-dashboard-windows-defender-advanced-threat-protection.md) -##### [View the Threat analytics dashboard and take recommended mitigation actions](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) -##### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) +#### [Access the Windows Defender Security Center Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md) @@ -142,21 +149,16 @@ -### [Attack surface reduction](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) +### [Attack surface reduction - Chris, Amitai, Justin](windows-defender-exploit-guard\attack-surface-reduction-exploit-guard.md) #### [Hardware based isolation](windows-defender-application-guard/wd-app-guard-overview.md) -##### [System requirements for Windows Defender Application Guard](windows-defender-application-guard/reqs-wd-app-guard.md) -##### [Prepare and install Windows Defender Application Guard](windows-defender-application-guard/install-wd-app-guard.md) -##### [Configure the Group Policy settings for Windows Defender Application Guard](windows-defender-application-guard/configure-wd-app-guard.md) -##### [Testing scenarios using Windows Defender Application Guard in your business or organization](windows-defender-application-guard/test-scenarios-wd-app-guard.md) ##### [Frequently Asked Questions - Windows Defender Application Guard](windows-defender-application-guard/faq-wd-app-guard.md) - #### [Windows Defender Application Control](windows-defender-application-control/windows-defender-application-control.md) -#### [Exploit protection](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) +#### [Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\exploit-protection-exploit-guard.md) ##### [Comparison with Enhanced Mitigation Experience Toolkit](windows-defender-exploit-guard\emet-exploit-protection-exploit-guard.md) -##### [Enable Exploit protection](windows-defender-exploit-guard\enable-exploit-protection.md) +##### [Enable Exploit protection - Chris, Amitai, Justin](windows-defender-exploit-guard\enable-exploit-protection.md) ##### [Customize Exploit protection](windows-defender-exploit-guard\customize-exploit-protection.md) ###### [Import, export, and deploy Exploit protection configurations](windows-defender-exploit-guard/import-export-exploit-protection-emet-xml.md) @@ -175,7 +177,7 @@ ##### [Customize Attack surface reduction](windows-defender-exploit-guard\customize-attack-surface-reduction.md) ##### [Troubleshoot Attack surface reduction rules](windows-defender-exploit-guard\troubleshoot-asr.md) -### [Next gen protection](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) +### [Next gen protection - Andrea, Chris, Amitai](windows-defender-antivirus\configure-windows-defender-antivirus-features.md) #### [Utilize Microsoft cloud-delivered protection](windows-defender-antivirus\utilize-microsoft-cloud-protection-windows-defender-antivirus.md) ##### [Enable cloud-delivered protection](windows-defender-antivirus\enable-cloud-protection-windows-defender-antivirus.md) ##### [Specify the cloud-delivered protection level](windows-defender-antivirus\specify-cloud-protection-level-windows-defender-antivirus.md) @@ -188,7 +190,7 @@ -### [EDR](faketopic.md) +### [Endpoint detection and response - Tomer B.](faketopic.md) ####Alerts queue ##### [View and organize the Alerts queue](windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection.md) ##### [Manage alerts](windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md) @@ -238,13 +240,16 @@ ##### [Advanced hunting query language best practices](windows-defender-atp\advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md) -### [Automatic investigation and remediation](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) +### [Automatic investigation and remediation - Benny](windows-defender-atp\automated-investigations-windows-defender-advanced-threat-protection.md) -### [View the Secure Score dashboard and improve your secure score](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) +###Security posture +#### [Secure posture - Evald](windows-defender-atp\secure-score-dashboard-windows-defender-advanced-threat-protection.md) +#### [View the Threat analytics dashboard and take recommended mitigation actions - Evald](windows-defender-atp\threat-analytics-dashboard-windows-defender-advanced-threat-protection.md) -### [Managment and APIs](management-apis.md) + +### [Management and APIs](management-apis.md) #### [Pull alerts to your SIEM tools](windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection.md) ##### [Enable SIEM integration](windows-defender-atp/enable-siem-integration-windows-defender-advanced-threat-protection.md) ##### [Configure Splunk to pull alerts](windows-defender-atp/configure-splunk-windows-defender-advanced-threat-protection.md) @@ -336,7 +341,7 @@ -### [Microsoft threat protection - need to make new page - put anchors inside for each integ](integration.md) +### [Microsoft threat protection - Heike or Raviv or Alon - need to make new page - put anchors inside for each integ](integration.md) #### [Protect users, data, and devices with conditional access](windows-defender-atp\conditional-access-windows-defender-advanced-threat-protection.md) @@ -360,18 +365,19 @@ -### [Troubleshoot everything](troubleshoot.md) -#### [Review event logs and error codes to troubleshoot issues](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) +###Troubleshoot Windows Defender ATP +#### [Review AV/NEXT GEN event logs and error codes to troubleshoot issues - Amitai, etc](windows-defender-antivirus\troubleshoot-windows-defender-antivirus.md) -####[Check service health and sensor state](troubleshoot-sense.md) +####Troubleshoot sensor state - Ask Heike name of sensor ##### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md) ##### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) ##### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines) ##### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines) -##### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) +##### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) #### [Troubleshoot Windows Defender ATP service issues](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md) -##### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md) +##### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md) + diff --git a/windows/security/threat-protection/configure1.md b/windows/security/threat-protection/configure1.md index e69de29bb2..37062fcdb7 100644 --- a/windows/security/threat-protection/configure1.md +++ b/windows/security/threat-protection/configure1.md @@ -0,0 +1,16 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# To do: Amitai and Andrea and Justin diff --git a/windows/security/threat-protection/configure3.md b/windows/security/threat-protection/configure3.md index e69de29bb2..ecfb414741 100644 --- a/windows/security/threat-protection/configure3.md +++ b/windows/security/threat-protection/configure3.md @@ -0,0 +1,18 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# TO do: Benny and joey to write this topic + +You can configure it through the portal, see Settings \ No newline at end of file diff --git a/windows/security/threat-protection/integration.md b/windows/security/threat-protection/integration.md index e69de29bb2..6c22bd96e1 100644 --- a/windows/security/threat-protection/integration.md +++ b/windows/security/threat-protection/integration.md @@ -0,0 +1,20 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# TO do: Heike, Alon, or Raviv + +These are all the products that WDATP integrates with then link to their documentation. + +Have links to the different configuration settings and put links there. \ No newline at end of file diff --git a/windows/security/threat-protection/management-apis.md b/windows/security/threat-protection/management-apis.md index e69de29bb2..44ff4dfc98 100644 --- a/windows/security/threat-protection/management-apis.md +++ b/windows/security/threat-protection/management-apis.md @@ -0,0 +1,26 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# To do: Raviv + +Talk about all the tools that you can use with WDATP + +OR one liner + +wdatp allows you to interact with the platform and other systems + +enable to manage and interact with the system + +APIs, SIEM connectors, Reporting, powerbi, etc \ No newline at end of file diff --git a/windows/security/threat-protection/onboard.md b/windows/security/threat-protection/onboard.md index e69de29bb2..f9ac29a1f8 100644 --- a/windows/security/threat-protection/onboard.md +++ b/windows/security/threat-protection/onboard.md @@ -0,0 +1,16 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# TO do: naama and joey to write this topic \ No newline at end of file diff --git a/windows/security/threat-protection/troubleshoot-sense.md b/windows/security/threat-protection/troubleshoot-sense.md index e69de29bb2..bcc523b5a6 100644 --- a/windows/security/threat-protection/troubleshoot-sense.md +++ b/windows/security/threat-protection/troubleshoot-sense.md @@ -0,0 +1,18 @@ +--- +title: +description: +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# TO do: Heike + +What do you want to call sense \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md index a59d266c4b..3d8ae4ab64 100644 --- a/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection.md @@ -23,7 +23,7 @@ ms.date: 05/21/2018 - Windows 10 Pro Education - Windows Defender Advanced Threat Protection (Windows Defender ATP) - +BENNY: look at this page and see if there are "settings/ configurations" if yes, point them to the settings page and remove it from here. >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink) diff --git a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md index 97d408e645..3c6c0f6222 100644 --- a/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/onboard-configure-windows-defender-advanced-threat-protection.md @@ -18,7 +18,11 @@ ms.date: 07/01/2018 **Applies to:** - Windows Defender Advanced Threat Protection (Windows Defender ATP) -You need to onboard machines to Windows Defender ATP before you can use the service. +You need to turn on the sensor to give visibility within Windows Defender ATP. + +JOEY: LOOK INTO THIS AGAIN - REVISE +OWNER: NAAMA + For more information, see [Onboard your Windows 10 machines to Windows Defender ATP](https://www.youtube.com/watch?v=JT7VGYfeRlA&feature=youtu.be). diff --git a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md index 769e84dfb8..da8569a91a 100644 --- a/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/preferences-setup-windows-defender-advanced-threat-protection.md @@ -32,7 +32,7 @@ Use the **Settings** menu to modify general settings, advanced features, enable Topic | Description :---|:--- -[Update general settings](data-retention-settings-windows-defender-advanced-threat-protection.md) | Modify your general settings that were previously defined as part of the onboarding process. +General settings | Modify your general settings that were previously defined as part of the onboarding process. Permissions | Manage portal access using RBAC as well as machine groups. APIs | Enable the threat intel and SIEM integration. Rules | Configure suppressions rules and automation settings.
Attack surface reductionNext generation protectionEndpoint detection and responseAuto investigation and remediationSecurity posture
[Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/hardware-protection/how-hardware-based-containers-help-protect-windows)

[Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

[Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

[Device restrictions](https://docs.microsoft.com/en-us/intune/device-restrictions-configure)

[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

[Network firewall](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

[Attack surface reduction controls](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)
[Hardware based isolation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-guard/wd-app-guard-overview)

[Application control](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control)

[Exploit protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/windows-defender-exploit-guard)

[Network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard)

[Device restrictions](https://docs.microsoft.com/en-us/intune/device-restrictions-configure)

[Controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard)

[Network firewall](https://docs.microsoft.com/en-us/windows/security/identity-protection/windows-firewall/windows-firewall-with-advanced-security)

[Attack surface reduction controls](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard)		 [Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10)

[Machine learning](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/utilize-microsoft-cloud-protection-windows-defender-antivirus)

[Automated sandbox service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/configure-block-at-first-sight-windows-defender-antivirus)		 [Alerts queue](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/alerts-queue-windows-defender-advanced-threat-protection)

[Historical endpoint data](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection#machine-timeline)

[Realtime and historical threat hunting](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection)

[API and SIEM integration](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/configure-siem-windows-defender-advanced-threat-protection)

[Response orchestration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/response-actions-windows-defender-advanced-threat-protection)

[Forensic collection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/respond-machine-alerts-windows-defender-advanced-threat-protection#collect-investigation-package-from-machines)

[Threat intelligence](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection)

[Advanced detonation and analysis service](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/respond-file-alerts-windows-defender-advanced-threat-protection#deep-analysis)		 [Automated investigation and remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)

[Threat remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#how-threats-are-remediated)

[Manage automated investigations](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#manage-automated-investigations)

[Analyze automated investigation](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection#analyze-automated-investigations)