mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 06:17:22 +00:00
Merge branch 'master' into v-gmoor-update-excluded-users
This commit is contained in:
Gary Moore
GitHub
commit
8aed251cfc
@ -2044,6 +2044,11 @@
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/supported-response-apis-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/supported-response-apis",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/supported-response-apis.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/threat-protection/windows-defender-atp/threat-indicator-concepts-windows-defender-advanced-threat-protection.md",
|
||||
@ -16524,6 +16529,11 @@
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-antivirus/antivirus-false-positives-negatives.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-exploit-guard/troubleshoot-asr.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-asr",
|
||||
"redirect_document_id": false
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@ -46,7 +46,7 @@ Application compatibility testing has historically been a burden when approachin
|
||||
|
||||
Most Windows 7–compatible desktop applications will be compatible with Windows 10 straight out of the box. Windows 10 achieved such high compatibility because the changes in the existing Win32 application programming interfaces were minimal. Combined with valuable feedback via the Windows Insider Program and diagnostic data, this level of compatibility can be maintained through each feature update. As for websites, Windows 10 includes Internet Explorer 11 and its backward-compatibility modes for legacy websites. Finally, UWP apps follow a compatibility story similar to desktop applications, so most of them will be compatible with Windows 10.
|
||||
|
||||
For the most important business-critical applications, organizations should still perform testing on a regular basis to validate compatibility with new builds. For remaining applications, consider validating them as part of a pilot deployment process to reduce the time spent on compatibility testing. Desktop Analytics s a cloud-based service that integrates with Configuration Manager. The service provides insight and intelligence for you to make more informed decisions about the update readiness of your Windows endpoints, including assessment of your existing applications. For more, see [Ready for modern desktop retirement FAQ](https://docs.microsoft.com/mem/configmgr/desktop-analytics/ready-for-windows).
|
||||
For the most important business-critical applications, organizations should still perform testing on a regular basis to validate compatibility with new builds. For remaining applications, consider validating them as part of a pilot deployment process to reduce the time spent on compatibility testing. Desktop Analytics is a cloud-based service that integrates with Configuration Manager. The service provides insight and intelligence for you to make more informed decisions about the update readiness of your Windows endpoints, including assessment of your existing applications. For more, see [Ready for modern desktop retirement FAQ](https://docs.microsoft.com/mem/configmgr/desktop-analytics/ready-for-windows).
|
||||
|
||||
### Device compatibility
|
||||
|
||||
|
||||
@ -478,6 +478,7 @@
|
||||
#### [General]()
|
||||
##### [Verify data storage location and update data retention settings](microsoft-defender-atp/data-retention-settings.md)
|
||||
##### [Configure alert notifications](microsoft-defender-atp/configure-email-notifications.md)
|
||||
##### [Configure vulnerability notifications](microsoft-defender-atp/configure-vulnerability-email-notifications.md)
|
||||
##### [Configure advanced features](microsoft-defender-atp/advanced-features.md)
|
||||
|
||||
#### [Permissions]()
|
||||
|
||||
@ -20,6 +20,9 @@ ms.technology: mde
|
||||
# Threat Protection
|
||||
[Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection) is a unified platform for preventative protection, post-breach detection, automated investigation, and response. Defender for Endpoint protects endpoints from cyber threats, detects advanced attacks and data breaches, automates security incidents, and improves security posture.
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
> [!TIP]
|
||||
> Enable your users to access cloud services and on-premises applications with ease and enable modern management capabilities for all devices. For more information, see [Secure your remote workforce](https://docs.microsoft.com/enterprise-mobility-security/remote-work/).
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
audience: ITPro
|
||||
ms.date: 01/08/2021
|
||||
ms.date: 02/01/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.technology: mde
|
||||
@ -62,13 +62,13 @@ Although potentially unwanted application protection in Microsoft Edge (Chromium
|
||||
|
||||
### Blocking URLs with Microsoft Defender SmartScreen
|
||||
|
||||
In Chromium-based Edge with PUA protection turned on, Microsoft Defender SmartScreen will protect you from PUA-associated URLs.
|
||||
In Chromium-based Edge with PUA protection turned on, Microsoft Defender SmartScreen protects you from PUA-associated URLs.
|
||||
|
||||
Admins can [configure](https://docs.microsoft.com/DeployEdge/configure-microsoft-edge) how Microsoft Edge and Microsoft Defender SmartScreen work together to protect groups of users from PUA-associated URLs. There are several [group policy settings](https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#smartscreen-settings) explicitly for Microsoft
|
||||
Defender SmartScreen available, including [one for blocking PUA](https://docs.microsoft.com/DeployEdge/microsoft-edge-policies#smartscreenpuaenabled). In addition, admins can
|
||||
[configure Microsoft Defender SmartScreen](https://docs.microsoft.com/microsoft-edge/deploy/available-policies?source=docs#configure-windows-defender-smartscreen) as a whole, using group policy settings to turn Microsoft Defender SmartScreen on or off.
|
||||
|
||||
Although Microsoft Defender for Endpoint has its own block list based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](../microsoft-defender-atp/manage-indicators.md) in the Microsoft Defender for Endpoint portal, Microsoft Defender SmartScreen will respect the new settings.
|
||||
Although Microsoft Defender for Endpoint has its own block list based upon a data set managed by Microsoft, you can customize this list based on your own threat intelligence. If you [create and manage indicators](../microsoft-defender-atp/manage-indicators.md) in the Microsoft Defender for Endpoint portal, Microsoft Defender SmartScreen respects the new settings.
|
||||
|
||||
## Microsoft Defender Antivirus
|
||||
|
||||
@ -87,7 +87,7 @@ The notification appears in the usual [quarantine list within the Windows Securi
|
||||
|
||||
You can enable PUA protection with [Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/device-protect), [Microsoft Endpoint Configuration Manager](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection), [Group Policy](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy), or via [PowerShell cmdlets](https://docs.microsoft.com/powershell/module/defender/?view=win10-ps&preserve-view=true).
|
||||
|
||||
You can also use PUA protection in audit mode to detect potentially unwanted applications without blocking them. The detections will be captured in the Windows event log.
|
||||
You can also use PUA protection in audit mode to detect potentially unwanted applications without blocking them. The detections are captured in the Windows event log.
|
||||
|
||||
> [!TIP]
|
||||
> Visit the Microsoft Defender for Endpoint demo website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com/Page/UrlRep) to confirm that the feature is working, and see it in action.
|
||||
@ -125,7 +125,7 @@ For System Center 2012 Configuration Manager, see [How to Deploy Potentially Unw
|
||||
|
||||
7. Select **Enabled** to enable PUA protection.
|
||||
|
||||
8. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting will work in your environment. Select **OK**.
|
||||
8. In **Options**, select **Block** to block potentially unwanted applications, or select **Audit Mode** to test how the setting works in your environment. Select **OK**.
|
||||
|
||||
9. Deploy your Group Policy object as you usually do.
|
||||
|
||||
@ -134,31 +134,53 @@ For System Center 2012 Configuration Manager, see [How to Deploy Potentially Unw
|
||||
##### To enable PUA protection
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -PUAProtection enable
|
||||
|
||||
Set-MpPreference -PUAProtection Enabled
|
||||
|
||||
```
|
||||
Setting the value for this cmdlet to `Enabled` will turn the feature on if it has been disabled.
|
||||
Setting the value for this cmdlet to `Enabled` turns the feature on if it has been disabled.
|
||||
|
||||
##### To set PUA protection to audit mode
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -PUAProtection auditmode
|
||||
|
||||
Set-MpPreference -PUAProtection AuditMode
|
||||
|
||||
```
|
||||
Setting `AuditMode` will detect PUAs without blocking them.
|
||||
Setting `AuditMode` detects PUAs without blocking them.
|
||||
|
||||
##### To disable PUA protection
|
||||
|
||||
We recommend keeping PUA protection turned on. However, you can turn it off by using the following cmdlet:
|
||||
|
||||
```PowerShell
|
||||
Set-MpPreference -PUAProtection disable
|
||||
|
||||
Set-MpPreference -PUAProtection Disabled
|
||||
|
||||
```
|
||||
Setting the value for this cmdlet to `Disabled` will turn the feature off if it has been enabled.
|
||||
Setting the value for this cmdlet to `Disabled` turns the feature off if it has been enabled.
|
||||
|
||||
See [Use PowerShell cmdlets to configure and run Microsoft Defender Antivirus](use-powershell-cmdlets-microsoft-defender-antivirus.md) and [Defender cmdlets](https://docs.microsoft.com/powershell/module/defender/index) for more information on how to use PowerShell with Microsoft Defender Antivirus.
|
||||
|
||||
### View PUA events
|
||||
|
||||
PUA events are reported in the Windows Event Viewer, but not in Microsoft Endpoint Manager or in Intune.
|
||||
PUA events are reported in the Windows Event Viewer, but not in Microsoft Endpoint Manager or in Intune. You can also use the `Get-MpThreat` cmdlet to view threats that Microsoft Defender Antivirus handled. Here's an example:
|
||||
|
||||
```console
|
||||
|
||||
CategoryID : 27
|
||||
DidThreatExecute : False
|
||||
IsActive : False
|
||||
Resources : {webfile:_q:\Builds\Dalton_Download_Manager_3223905758.exe|http://d18yzm5yb8map8.cloudfront.net/
|
||||
fo4yue@kxqdw/Dalton_Download_Manager.exe|pid:14196,ProcessStart:132378130057195714}
|
||||
RollupStatus : 33
|
||||
SchemaVersion : 1.0.0.0
|
||||
SeverityID : 1
|
||||
ThreatID : 213927
|
||||
ThreatName : PUA:Win32/InstallCore
|
||||
TypeID : 0
|
||||
PSComputerName :
|
||||
```
|
||||
|
||||
You can turn on email notifications to receive mail about PUA detections.
|
||||
|
||||
@ -170,7 +192,7 @@ Sometimes a file is erroneously blocked by PUA protection, or a feature of a PUA
|
||||
|
||||
For more information, see [Recommended antivirus exclusions for Configuration Manager site servers, site systems, and clients](https://docs.microsoft.com/troubleshoot/mem/configmgr/recommended-antivirus-exclusions#exclusions).
|
||||
|
||||
## Related articles
|
||||
## See also
|
||||
|
||||
- [Next-generation protection](microsoft-defender-antivirus-in-windows-10.md)
|
||||
- [Configure behavioral, heuristic, and real-time protection](configure-protection-features-microsoft-defender-antivirus.md)
|
||||
|
||||
@ -24,8 +24,6 @@ ms.technology: mde
|
||||
|
||||
Applies to:
|
||||
- Windows 10 multi-session running on Windows Virtual Desktop (WVD)
|
||||
> [!IMPORTANT]
|
||||
> Welcome to Microsoft Defender for Endpoint, the new name for Microsoft Defender for Endpoint. Read more about this and other updates here. We'll be updating names in products and in the docs in the near future.
|
||||
|
||||
> [!WARNING]
|
||||
> Microsoft Defender for Endpoint support for Windows Virtual Desktop multi-session scenarios is currently in Preview and limited up to 25 concurrent sessions per host/VM. However, single session scenarios on Windows Virtual Desktop are fully supported.
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: API release notes
|
||||
description: Release notes for anything that is new in the API.
|
||||
keywords: apis, mdatp api, updates, notes, release
|
||||
title: Microsoft Defender for Endpoint API release notes
|
||||
description: Release notes for updates made to the Microsoft Defender for Endpoint set of APIs.
|
||||
keywords: microsoft defender for endpoint api release notes, mde, apis, mdatp api, updates, notes, release
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: m365-security
|
||||
ms.mktglfcycl: deploy
|
||||
@ -17,9 +17,14 @@ ms.topic: article
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Release Notes
|
||||
<br>
|
||||
<hr>
|
||||
# Microsoft Defender for Endpoint API release notes
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
The following information lists the updates made to the Microsoft Defender for Endpoint APIs and the dates they were made.
|
||||
|
||||
|
||||
### 25.01.2021
|
||||
<hr>
|
||||
|
||||
@ -42,6 +42,7 @@ For a practical guidance on what needs to be in place for licensing and infrastr
|
||||
|
||||
For guidance on how to download and use Windows Security Baselines for Windows servers, see [Windows Security Baselines](https://docs.microsoft.com/windows/device-security/windows-security-baselines).
|
||||
|
||||
<br>
|
||||
|
||||
## Windows Server 2008 R2 SP1, Windows Server 2012 R2, and Windows Server 2016
|
||||
|
||||
@ -56,13 +57,13 @@ After completing the onboarding steps using any of the provided options, you'll
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> Defender for Endpoint standalone server license is required, per node, in order to onboard a Windows server through Microsoft Defender Security Center (Option 1), or an Azure Security Center Standard license is required, per node, in order to onboard a Windows server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services).
|
||||
> Defender for Endpoint standalone server license is required, per node, in order to onboard a Windows server through Microsoft Monitoring Agent (Option 1), or through Microsoft Endpoint Manager (Option 3). Alternatively, an Azure Defender for Servers license is required, per node, in order to onboard a Windows server through Azure Security Center (Option 2), see [Supported features available in Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-services).
|
||||
|
||||
|
||||
### Option 1: Onboard by installing and configuring Microsoft Monitoring Agent (MMA)
|
||||
You'll need to install and configure MMA for Windows servers to report sensor data to Defender for Endpoint. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
|
||||
|
||||
If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), attach the Microsoft Monitoring Agent (MMA) to report to your Defender for Endpoint workspace through Multihoming support.
|
||||
If you're already using System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), attach the Microsoft Monitoring Agent (MMA) to report to your Defender for Endpoint workspace through Multihoming support.
|
||||
|
||||
In general, you'll need to take the following steps:
|
||||
1. Fulfill the onboarding requirements outlined in **Before you begin** section.
|
||||
@ -102,6 +103,8 @@ Perform the following steps to fulfill the onboarding requirements:
|
||||
On the **Agent Setup Options** page, choose **Connect the agent to Azure Log Analytics (OMS)**.
|
||||
- [Install the agent using the command line](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script).
|
||||
|
||||
> [!NOTE]
|
||||
> If you are a [US Government customer](gov.md), under "Azure Cloud" you'll need to choose "Azure US Government".
|
||||
|
||||
|
||||
<span id="server-proxy"/>
|
||||
@ -140,6 +143,8 @@ You can onboard Windows Server 2012 R2 and Windows Server 2016 by using Microsof
|
||||
|
||||
After completing the onboarding steps, you'll need to [Configure and update System Center Endpoint Protection clients](#configure-and-update-system-center-endpoint-protection-clients).
|
||||
|
||||
<br>
|
||||
|
||||
## Windows Server (SAC) version 1803, Windows Server 2019, and Windows Server 2019 Core edition
|
||||
You can onboard Windows Server (SAC) version 1803, Windows Server 2019, or Windows Server 2019 Core edition by using the following deployment methods:
|
||||
|
||||
@ -179,12 +184,14 @@ Support for Windows Server provides deeper insight into server activities, cover
|
||||
|
||||
```sc.exe query Windefend```
|
||||
|
||||
If the result is 'The specified service does not exist as an installed service', then you'll need to install Microsoft Defender AV. For more information, see [Microsoft Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10).
|
||||
If the result is 'The specified service doesn't exist as an installed service', then you'll need to install Microsoft Defender AV. For more information, see [Microsoft Defender Antivirus in Windows 10](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10).
|
||||
|
||||
For information on how to use Group Policy to configure and manage Microsoft Defender Antivirus on your Windows servers, see [Use Group Policy settings to configure and manage Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/use-group-policy-microsoft-defender-antivirus).
|
||||
|
||||
<br>
|
||||
|
||||
## Integration with Azure Security Center
|
||||
Defender for Endpoint can integrate with Azure Security Center to provide a comprehensive Windows server protection solution. With this integration, Azure Security Center can leverage the power of Defender for Endpoint to provide improved threat detection for Windows Servers.
|
||||
Defender for Endpoint can integrate with Azure Security Center to provide a comprehensive Windows server protection solution. With this integration, Azure Security Center can use the power of Defender for Endpoint to provide improved threat detection for Windows Servers.
|
||||
|
||||
The following capabilities are included in this integration:
|
||||
- Automated onboarding - Defender for Endpoint sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
|
||||
@ -202,6 +209,7 @@ Data collected by Defender for Endpoint is stored in the geo-location of the ten
|
||||
> - Once configured, you cannot change the location where your data is stored. If you need to move your data to another location, you need to contact Microsoft Support to reset the tenant. <br>
|
||||
Server endpoint monitoring utilizing this integration has been disabled for Office 365 GCC customers.
|
||||
|
||||
<br>
|
||||
|
||||
## Configure and update System Center Endpoint Protection clients
|
||||
|
||||
@ -212,7 +220,7 @@ The following steps are required to enable this integration:
|
||||
|
||||
- Configure the SCEP client Cloud Protection Service membership to the **Advanced** setting.
|
||||
|
||||
|
||||
<br>
|
||||
|
||||
## Offboard Windows servers
|
||||
You can offboard Windows Server (SAC), Windows Server 2019, and Windows Server 2019 Core edition in the same method available for Windows 10 client devices.
|
||||
@ -264,6 +272,9 @@ To offboard the Windows server, you can use either of the following methods:
|
||||
$AgentCfg.ReloadConfiguration()
|
||||
|
||||
```
|
||||
|
||||
<br>
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 devices](configure-endpoints.md)
|
||||
- [Onboard non-Windows devices](configure-endpoints-non-windows.md)
|
||||
|
||||
@ -0,0 +1,93 @@
|
||||
---
|
||||
title: Configure vulnerability email notifications in Microsoft Defender for Endpoint
|
||||
description: Use Microsoft Defender for Endpoint to configure email notification settings for vulnerability events.
|
||||
keywords: email notifications, configure alert notifications, microsoft defender atp notifications, microsoft defender atp alerts, windows 10 enterprise, windows 10 education
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: ellevin
|
||||
author: levinec
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Configure vulnerability email notifications in Microsoft Defender for Endpoint
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-emailconfig-abovefoldlink)
|
||||
|
||||
Configure Microsoft Defender for Endpoint to send email notifications to specified recipients for new vulnerability events. This feature enables you to identify a group of individuals who will immediately be informed and can act on the notifications based on the event. The vulnerability information comes from Defender for Endpoint's [threat and vulnerability management](next-gen-threat-and-vuln-mgt.md) capability.
|
||||
|
||||
> [!NOTE]
|
||||
> Only users with 'Manage security settings' permissions can configure email notifications. If you've chosen to use basic permissions management, users with Security Administrator or Global Administrator roles can configure email notifications. [Learn more about permission options](user-roles.md)
|
||||
|
||||
The notification rules allow you to set the vulnerability events that trigger notifications, and add or remove email notification recipients. New recipients get notified about vulnerabilities after they are added.
|
||||
|
||||
If you're using role-based access control (RBAC), recipients will only receive notifications based on the device groups that were configured in the notification rule.
|
||||
Users with the proper permission can only create, edit, or delete notifications that are limited to their device group management scope. Only users assigned to the Global administrator role can manage notification rules that are configured for all device groups.
|
||||
|
||||
The email notification includes basic information about the vulnerability event. There are also links to filtered views in the threat and vulnerability management [Security recommendations](tvm-security-recommendation.md) and [Weaknesses](tvm-weaknesses.md) pages in the portal so you can further investigate. For example, you could get a list of all exposed devices or get additional details about the vulnerability.
|
||||
|
||||
## Create rules for alert notifications
|
||||
|
||||
Create a notification rule to send an email when there are certain exploit or vulnerability events, such as a new public exploit. For each rule, multiple event types can be selected.
|
||||
|
||||
1. In the navigation pane, go to **Settings** > **Email notifications** > **Vulnerabilities**.
|
||||
|
||||
2. Select **Add notification rule**.
|
||||
|
||||
3. Name the email notification rule and include a description.
|
||||
|
||||
4. Check **Notification enabled** to activate the notification. Select **Next**
|
||||
|
||||
5. Fill in the notification settings. Then select **Next**
|
||||
|
||||
- Choose device groups to get notifications for.
|
||||
- Choose the vulnerability event(s) that you want to be notified about when they affect your organization.
|
||||
- Options: new vulnerability found (including severity threshold), new public exploit, exploit added to an exploit kit, exploit was verified.
|
||||
- Include organization name if you want the organization name in the email
|
||||
|
||||
6. Enter the recipient email address then select **Add**. You can add multiple email addresses.
|
||||
|
||||
7. Review the settings for the new email notification rule and select **Create rule** when you're ready to create it.
|
||||
|
||||
## Edit a notification rule
|
||||
|
||||
1. Select the notification rule you'd like to edit.
|
||||
|
||||
2. Select the **Edit rule** button next to the pencil icon in the flyout. Make sure you have permission to edit or delete the rule.
|
||||
|
||||
## Delete notification rule
|
||||
|
||||
1. Select the notification rule you'd like to delete.
|
||||
|
||||
2. Select the **Delete** button next to the trash can icon in the flyout. Make sure you have permission to edit or delete the rule.
|
||||
|
||||
## Troubleshoot email notifications for alerts
|
||||
|
||||
This section lists various issues that you may encounter when using email notifications for alerts.
|
||||
|
||||
**Problem:** Intended recipients report they are not getting the notifications.
|
||||
|
||||
**Solution:** Make sure that the notifications are not blocked by email filters:
|
||||
|
||||
1. Check that the Defender for Endpoint email notifications are not sent to the Junk Email folder. Mark them as Not junk.
|
||||
2. Check that your email security product is not blocking the email notifications from Defender for Endpoint.
|
||||
3. Check your email application rules that might be catching and moving your Defender for Endpoint email notifications.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Threat and vulnerability management overview](next-gen-threat-and-vuln-mgt.md)
|
||||
- [Security recommendations](tvm-security-recommendation.md)
|
||||
- [Weaknesses](tvm-weaknesses.md)
|
||||
- [Event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||
@ -31,8 +31,16 @@ This offering is currently available to Microsoft 365 GCC and GCC High customers
|
||||
|
||||
> [!NOTE]
|
||||
> If you are a "GCC on Commercial" customer, please refer to the public documentation pages.
|
||||
<br>
|
||||
|
||||
## Portal URLs
|
||||
The following are the Microsoft Defender for Endpoint portal URLs for US Government customers:
|
||||
|
||||
Customer type | Portal URL
|
||||
:---|:---
|
||||
GCC | https://gcc.securitycenter.microsoft.us
|
||||
GCC High | https://securitycenter.microsoft.us
|
||||
|
||||
<br>
|
||||
|
||||
## Endpoint versions
|
||||
|
||||
@ -63,7 +71,10 @@ Android |  On engineering backlog |  On engineering backlog |  On engineering backlog
|
||||
|
||||
> [!NOTE]
|
||||
> A patch must be deployed before device onboarding in order to configure Defender for Endpoint to the correct environment.
|
||||
> Where a patch is specified, it must be deployed prior to device onboarding in order to configure Defender for Endpoint to the correct environment.
|
||||
|
||||
> [!NOTE]
|
||||
> Trying to onboard Windows Server 2016/2012 R2/2008 R2 SP1 or Windows 8.1 Enterprise/8 Pro/7 SP1 Enterprise/7 SP1 Pro using [Microsoft Monitoring Agent](configure-server-endpoints.md#option-1-onboard-by-installing-and-configuring-microsoft-monitoring-agent-mma)? You'll need to choose "Azure US Government" under "Azure Cloud".
|
||||
|
||||
### OS versions when using Azure Defender for Servers
|
||||
The following OS versions are supported when using [Azure Defender for Servers](https://docs.microsoft.com/azure/security-center/security-center-wdatp):
|
||||
@ -88,7 +99,6 @@ Defender for Endpoint GCC High specific | `winatp-gw-usgt.microsoft.com`<br>`win
|
||||
|
||||
<br>
|
||||
|
||||
|
||||
## API
|
||||
Instead of the public URIs listed in our [API documentation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/apis-intro), you'll need to use the following URIs:
|
||||
|
||||
@ -100,7 +110,6 @@ SIEM | `https://wdatp-alertexporter-us.gcc.securitycenter.windows.us` | `https:/
|
||||
|
||||
<br>
|
||||
|
||||
|
||||
## Feature parity with commercial
|
||||
Defender for Endpoint doesn't have complete parity with the commercial offering. While our goal is to deliver all commercial features and functionality to our US Government customers, there are some capabilities not yet available that we'd like to highlight.
|
||||
|
||||
@ -126,6 +135,6 @@ Integrations: Microsoft Defender for Identity |  On engineering backlog |  On engineering backlog
|
||||
Integrations: Microsoft Endpoint DLP |  On engineering backlog |  On engineering backlog
|
||||
Integrations: Microsoft Intune |  |  In development
|
||||
Integrations: Microsoft Power Automate & Azure Logic Apps |  Rolling out |  In development
|
||||
Integrations: Microsoft Power Automate & Azure Logic Apps |  |  In development
|
||||
Integrations: Skype for Business / Teams |  |  In development
|
||||
Microsoft Threat Experts |  On engineering backlog |  On engineering backlog
|
||||
|
||||
@ -28,40 +28,11 @@ ms.technology: mde
|
||||
> [!NOTE]
|
||||
> Defender for Endpoint for iOS would use a VPN in order to provide the Web Protection feature. This is not a regular VPN and is a local/self-looping VPN that does not take traffic outside the device.
|
||||
|
||||
## Configure compliance policy against jailbroken devices
|
||||
## Conditional Access with Defender for Endpoint for iOS
|
||||
Microsoft Defender for Endpoint for iOS along with Microsoft Intune and Azure Active Directory enables enforcing Device compliance and Conditional Access policies
|
||||
based on device risk levels. Defender for Endpoint is a Mobile Threat Defense (MTD) solution that you can deploy to leverage this capability via Intune.
|
||||
|
||||
To protect corporate data from being accessed on jailbroken iOS devices, we recommend that you set up the following compliance policy on Intune.
|
||||
|
||||
> [!NOTE]
|
||||
> At this time Microsoft Defender for Endpoint for iOS does not provide protection against jailbreak scenarios. If used on a jailbroken device, then in specific scenarios data that is used by the application like your corporate email id and corporate profile picture (if available) can be exposed locally
|
||||
|
||||
Follow the steps below to create a compliance policy against jailbroken devices.
|
||||
|
||||
1. In [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** -> **Compliance policies** -> click on **Create Policy**. Select "iOS/iPadOS" as platform and click **Create**.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
1. Specify a name of the policy, example "Compliance Policy for Jailbreak".
|
||||
1. In the compliance settings page, click to expand **Device Health** section and click **Block** for **Jailbroken devices** field.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
1. In the *Action for noncompliance* section, select the actions as per your requirements and click **Next**.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
1. In the *Assignments* section, select the user groups that you want to include for this policy and then click **Next**.
|
||||
1. In the **Review+Create** section, verify that all the information entered is correct and then select **Create**.
|
||||
|
||||
## Configure custom indicators
|
||||
|
||||
Defender for Endpoint for iOS enables admins to configure custom indicators on iOS devices as well. Refer to [Manage indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators) on how to configure custom indicators.
|
||||
|
||||
> [!NOTE]
|
||||
> Defender for Endpoint for iOS supports creating custom indicators only for IP addresses and URLs/domains.
|
||||
For more information about how to set up Conditional Access with Defender for Endpoint for iOS, see [Defender for Endpoint and Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection).
|
||||
|
||||
## Web Protection and VPN
|
||||
|
||||
@ -79,10 +50,46 @@ While enabled by default, there might be some cases that require you to disable
|
||||
> [!NOTE]
|
||||
> Web Protection will not be available when VPN is disabled. To re-enable Web Protection, open the Microsoft Defender for Endpoint app on the device and click or tap **Start VPN**.
|
||||
|
||||
### Co-existence of multiple VPN profiles
|
||||
## Co-existence of multiple VPN profiles
|
||||
|
||||
Apple iOS does not support multiple device-wide VPNs to be active simultaneously. While multiple VPN profiles can exist on the device, only one VPN can be active at a time.
|
||||
|
||||
|
||||
## Configure compliance policy against jailbroken devices
|
||||
|
||||
To protect corporate data from being accessed on jailbroken iOS devices, we recommend that you set up the following compliance policy on Intune.
|
||||
|
||||
> [!NOTE]
|
||||
> At this time Microsoft Defender for Endpoint for iOS does not provide protection against jailbreak scenarios. If used on a jailbroken device, then in specific scenarios data that is used by the application like your corporate email id and corporate profile picture (if available) can be exposed locally
|
||||
|
||||
Follow the steps below to create a compliance policy against jailbroken devices.
|
||||
|
||||
1. In [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), go to **Devices** -> **Compliance policies** -> **Create Policy**. Select "iOS/iPadOS" as platform and click **Create**.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
2. Specify a name of the policy, for example "Compliance Policy for Jailbreak".
|
||||
3. In the compliance settings page, click to expand **Device Health** section and click **Block** for **Jailbroken devices** field.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
4. In the *Action for noncompliance* section, select the actions as per your requirements and select **Next**.
|
||||
|
||||
> [!div class="mx-imgBorder"]
|
||||
> 
|
||||
|
||||
5. In the *Assignments* section, select the user groups that you want to include for this policy and then select **Next**.
|
||||
6. In the **Review+Create** section, verify that all the information entered is correct and then select **Create**.
|
||||
|
||||
## Configure custom indicators
|
||||
|
||||
Defender for Endpoint for iOS enables admins to configure custom indicators on iOS devices as well. For more information on how to configure custom indicators, see [Manage indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators).
|
||||
|
||||
> [!NOTE]
|
||||
> Defender for Endpoint for iOS supports creating custom indicators only for IP addresses and URLs/domains.
|
||||
|
||||
## Report unsafe site
|
||||
|
||||
Phishing websites impersonate trustworthy websites for the purpose of obtaining your personal or financial information. Visit the [Provide feedback about network protection](https://www.microsoft.com/wdsi/filesubmission/exploitguard/networkprotection) page if you want to report a website that could be a phishing site.
|
||||
|
||||
@ -1,52 +0,0 @@
|
||||
---
|
||||
title: Supported Microsoft Defender Advanced Threat Protection response APIs
|
||||
description: Learn about the specific response-related Microsoft Defender Advanced Threat Protection API calls.
|
||||
keywords: response apis, graph api, supported apis, actor, alerts, device, user, domain, ip, file
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: m365-security
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Supported Microsoft Defender for Endpoint query APIs
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
> [!TIP]
|
||||
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-supported-response-apis-abovefoldlink)
|
||||
|
||||
Learn about the supported response-related API calls you can run and details such as the required request headers, and expected response from the calls.
|
||||
|
||||
## In this section
|
||||
Topic | Description
|
||||
:---|:---
|
||||
Collect investigation package | Run this API to collect an investigation package from a device.
|
||||
Isolate device | Run this API to isolate a device from the network.
|
||||
Unisolate device | Remove a device from isolation.
|
||||
Restrict code execution | Run this API to contain an attack by stopping malicious processes. You can also lock down a device and prevent subsequent attempts of potentially malicious programs from running.
|
||||
Unrestrict code execution | Run this to reverse the restriction of applications policy after you have verified that the compromised device has been remediated.
|
||||
Run antivirus scan | Remotely initiate an antivirus scan to help identify and remediate malware that might be present on a compromised device.
|
||||
Stop and quarantine file | Run this call to stop running processes, quarantine files, and delete persistency such as registry keys.
|
||||
Request sample | Run this call to request a sample of a file from a specific device. The file will be collected from the device and uploaded to a secure storage.
|
||||
Block file | Run this API to prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
Unblock file | Allow a file run in the organization using Microsoft Defender Antivirus.
|
||||
Get package SAS URI | Run this API to get a URI that allows downloading an investigation package.
|
||||
Get MachineAction object | Run this API to get MachineAction object.
|
||||
Get MachineActions collection | Run this to get MachineAction collection.
|
||||
Get FileActions collection | Run this API to get FileActions collection.
|
||||
Get FileMachineAction object | Run this API to get FileMachineAction object.
|
||||
Get FileMachineActions collection | Run this API to get FileMachineAction collection.
|
||||
@ -33,6 +33,9 @@ Event timeline is a risk news feed that helps you interpret how risk is introduc
|
||||
|
||||
Event timeline also tells the story of your [exposure score](tvm-exposure-score.md) and [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) so you can determine the cause of large changes. Events can impact your devices or your score for devices. Reduce you exposure by addressing what needs to be remediated based on the prioritized [security recommendations](tvm-security-recommendation.md).
|
||||
|
||||
>[!TIP]
|
||||
>To get emails about new vulnerability events, see [Configure vulnerability email notifications in Microsoft Defender for Endpoint](configure-vulnerability-email-notifications.md)
|
||||
|
||||
## Navigate to the Event timeline page
|
||||
|
||||
There are also three entry points from the [threat and vulnerability management dashboard](tvm-dashboard-insights.md):
|
||||
|
||||
@ -29,9 +29,9 @@ ms.technology: mde
|
||||
|
||||
When you use [attack surface reduction rules](attack-surface-reduction.md) you may run into issues, such as:
|
||||
|
||||
- A rule blocks a file, process, or performs some other action that it should not (false positive)
|
||||
- A rule blocks a file, process, or performs some other action that it shouldn't (false positive)
|
||||
|
||||
- A rule does not work as described, or does not block a file or process that it should (false negative)
|
||||
- A rule doesn't work as described, or doesn't block a file or process that it should (false negative)
|
||||
|
||||
There are four steps to troubleshooting these problems:
|
||||
|
||||
@ -53,7 +53,7 @@ Attack surface reduction rules will only work on devices with the following cond
|
||||
|
||||
- [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled.
|
||||
|
||||
- Audit mode is not enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
|
||||
- Audit mode isn't enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
|
||||
|
||||
If these prerequisites have all been met, proceed to the next step to test the rule in audit mode.
|
||||
|
||||
@ -61,7 +61,7 @@ If these prerequisites have all been met, proceed to the next step to test the r
|
||||
|
||||
You can visit the Windows Defender Test ground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm attack surface reduction rules are generally working for pre-configured scenarios and processes on a device, or you can use audit mode, which enables rules for reporting only.
|
||||
|
||||
Follow these instructions in [Use the demo tool to see how attack surface reduction rules work](evaluate-attack-surface-reduction.md) to test the specific rule you are encountering problems with.
|
||||
Follow these instructions in [Use the demo tool to see how attack surface reduction rules work](evaluate-attack-surface-reduction.md) to test the specific rule you're encountering problems with.
|
||||
|
||||
1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). Audit mode allows the rule to report the file or process, but will still allow it to run.
|
||||
|
||||
@ -69,19 +69,19 @@ Follow these instructions in [Use the demo tool to see how attack surface reduct
|
||||
|
||||
3. [Review the attack surface reduction rule event logs](attack-surface-reduction.md) to see if the rule would have blocked the file or process if the rule had been set to **Enabled**.
|
||||
|
||||
If a rule is not blocking a file or process that you are expecting it should block, first check if audit mode is enabled.
|
||||
If a rule isn't blocking a file or process that you're expecting it should block, first check if audit mode is enabled.
|
||||
|
||||
Audit mode may have been enabled for testing another feature, or by an automated PowerShell script, and may not have been disabled after the tests were completed.
|
||||
|
||||
If you've tested the rule with the demo tool and with audit mode, and attack surface reduction rules are working on pre-configured scenarios, but the rule is not working as expected, proceed to either of the following sections based on your situation:
|
||||
If you've tested the rule with the demo tool and with audit mode, and attack surface reduction rules are working on pre-configured scenarios, but the rule isn't working as expected, proceed to either of the following sections based on your situation:
|
||||
|
||||
1. If the attack surface reduction rule is blocking something that it should not block (also known as a false positive), you can [first add an attack surface reduction rule exclusion](#add-exclusions-for-a-false-positive).
|
||||
1. If the attack surface reduction rule is blocking something that it shouldn't block (also known as a false positive), you can [first add an attack surface reduction rule exclusion](#add-exclusions-for-a-false-positive).
|
||||
|
||||
2. If the attack surface reduction rule is not blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data-for-file-submissions).
|
||||
2. If the attack surface reduction rule isn't blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data-for-file-submissions).
|
||||
|
||||
## Add exclusions for a false positive
|
||||
|
||||
If the attack surface reduction rule is blocking something that it should not block (also known as a false positive), you can add exclusions to prevent attack surface reduction rules from evaluating the excluded files or folders.
|
||||
If the attack surface reduction rule is blocking something that it shouldn't block (also known as a false positive), you can add exclusions to prevent attack surface reduction rules from evaluating the excluded files or folders.
|
||||
|
||||
To add an exclusion, see [Customize Attack surface reduction](customize-attack-surface-reduction.md).
|
||||
|
||||
@ -95,12 +95,12 @@ Use the [Windows Defender Security Intelligence web-based submission form](https
|
||||
|
||||
## Collect diagnostic data for file submissions
|
||||
|
||||
When you report a problem with attack surface reduction rules, you are asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues.
|
||||
When you report a problem with attack surface reduction rules, you're asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues.
|
||||
|
||||
1. Open an elevated command prompt and change to the Windows Defender directory:
|
||||
|
||||
```console
|
||||
cd c:\program files\windows defender
|
||||
cd "c:\program files\windows defender"
|
||||
```
|
||||
|
||||
2. Run this command to generate the diagnostic logs:
|
||||
@ -109,7 +109,7 @@ When you report a problem with attack surface reduction rules, you are asked to
|
||||
mpcmdrun -getfiles
|
||||
```
|
||||
|
||||
3. By default, they are saved to `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`. Attach the file to the submission form.
|
||||
3. By default, they're saved to `C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab`. Attach the file to the submission form.
|
||||
|
||||
## Related articles
|
||||
|
||||
|
||||
@ -34,6 +34,9 @@ Cybersecurity weaknesses identified in your organization are mapped to actionabl
|
||||
|
||||
Each security recommendation includes actionable remediation steps. To help with task management, the recommendation can also be sent using Microsoft Intune and Microsoft Endpoint Configuration Manager. When the threat landscape changes, the recommendation also changes as it continuously collects information from your environment.
|
||||
|
||||
>[!TIP]
|
||||
>To get emails about new vulnerability events, see [Configure vulnerability email notifications in Microsoft Defender for Endpoint](configure-vulnerability-email-notifications.md)
|
||||
|
||||
## How it works
|
||||
|
||||
Each device in the organization is scored based on three important factors to help customers to focus on the right things at the right time.
|
||||
@ -105,7 +108,7 @@ From the flyout, you can choose any of the following options:
|
||||
|
||||
### Investigate changes in device exposure or impact
|
||||
|
||||
If there is a large jump in the number of exposed devices, or a sharp increase in the impact on your organization exposure score and configuration score, then that security recommendation is worth investigating.
|
||||
If there is a large jump in the number of exposed devices, or a sharp increase in the impact on your organization exposure score and Microsoft Secure Score for Devices, then that security recommendation is worth investigating.
|
||||
|
||||
1. Select the recommendation and **Open software page**
|
||||
2. Select the **Event timeline** tab to view all the impactful events related to that software, such as new vulnerabilities or new public exploits. [Learn more about event timeline](threat-and-vuln-mgt-event-timeline.md)
|
||||
|
||||
@ -38,9 +38,9 @@ Before you begin, ensure that you meet the following operating system or platfor
|
||||
Operating system | Security assessment support
|
||||
:---|:---
|
||||
Windows 7 | Operating System (OS) vulnerabilities
|
||||
Windows 8.1 | Not supported
|
||||
Windows 10 1607-1703 | Operating System (OS) vulnerabilities
|
||||
Windows 10 1709+ |Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows 8.1 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment |
|
||||
Windows 10, versions 1607-1703 | Operating System (OS) vulnerabilities
|
||||
Windows 10, version 1709 or later |Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2008 R2 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2012 R2 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
Windows Server 2016 | Operating System (OS) vulnerabilities<br/>Software product vulnerabilities<br/>Operating System (OS) configuration assessment<br/>Security controls configuration assessment<br/>Software product configuration assessment
|
||||
|
||||
@ -36,12 +36,8 @@ The **Weaknesses** page lists the software vulnerabilities your devices are expo
|
||||
>[!NOTE]
|
||||
>If there is no official CVE-ID assigned to a vulnerability, the vulnerability name is assigned by threat and vulnerability management.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>To boost your vulnerability assessment detection rates, you can download the following mandatory security updates and deploy them in your network:
|
||||
>- 19H1 customers | [KB 4512941](https://support.microsoft.com/help/4512941/windows-10-update-kb4512941)
|
||||
>- RS5 customers | [KB 4516077](https://support.microsoft.com/help/4516077/windows-10-update-kb4516077)
|
||||
>- RS4 customers | [KB 4516045](https://support.microsoft.com/help/4516045/windows-10-update-kb4516045)
|
||||
>- RS3 customers | [KB 4516071](https://support.microsoft.com/help/4516071/windows-10-update-kb4516071)
|
||||
>[!TIP]
|
||||
>To get emails about new vulnerability events, see [Configure vulnerability email notifications in Microsoft Defender for Endpoint](configure-vulnerability-email-notifications.md)
|
||||
|
||||
## Navigate to the Weaknesses page
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user