mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 05:17:22 +00:00
remove all instances of wdatp within topics
This commit is contained in:
Joey Caparas
parent
552ea6dcb0
commit
91bf200c2b
@ -1,4 +1,4 @@
|
||||
# [Windows Defender Advanced Threat Protection](windows-defender-advanced-threat-protection.md)
|
||||
# [Microsoft Defender Advanced Threat Protection](microsoft-defender-advanced-threat-protection.md)
|
||||
|
||||
## [Overview](overview.md)
|
||||
### [Attack surface reduction](overview-attack-surface-reduction.md)
|
||||
@ -14,82 +14,82 @@
|
||||
#### [Network firewall](../windows-firewall/windows-firewall-with-advanced-security.md)
|
||||
### [Next generation protection](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md)
|
||||
### [Endpoint detection and response](overview-endpoint-detection-response.md)
|
||||
#### [Security operations dashboard](security-operations-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
#### [Security operations dashboard](security-operations-dashboard.md)
|
||||
|
||||
|
||||
#### [Incidents queue](incidents-queue.md)
|
||||
##### [View and organize the Incidents queue](view-incidents-queue.md)
|
||||
##### [Manage incidents](manage-incidents-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate incidents](investigate-incidents-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage incidents](manage-incidents.md)
|
||||
##### [Investigate incidents](investigate-incidents.md)
|
||||
|
||||
|
||||
#### Alerts queue
|
||||
##### [View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
##### [Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
##### [View and organize the Alerts queue](alerts-queue.md)
|
||||
##### [Manage alerts](manage-alerts.md)
|
||||
##### [Investigate alerts](investigate-alerts.md)
|
||||
##### [Investigate files](investigate-files.md)
|
||||
##### [Investigate machines](investigate-machines.md)
|
||||
##### [Investigate an IP address](investigate-ip.md)
|
||||
##### [Investigate a domain](investigate-domain.md)
|
||||
##### [Investigate a user account](investigate-user.md)
|
||||
|
||||
#### Machines list
|
||||
##### [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage machine group and tags](machine-tags-windows-defender-advanced-threat-protection.md)
|
||||
##### [Alerts related to this machine](investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine)
|
||||
##### [Machine timeline](investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline)
|
||||
###### [Search for specific events](investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events)
|
||||
###### [Filter events from a specific date](investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date)
|
||||
###### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events)
|
||||
###### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages)
|
||||
##### [View and organize the Machines list](machines-view-overview.md)
|
||||
##### [Manage machine group and tags](machine-tags.md)
|
||||
##### [Alerts related to this machine](investigate-machines.md#alerts-related-to-this-machine)
|
||||
##### [Machine timeline](investigate-machines.md#machine-timeline)
|
||||
###### [Search for specific events](investigate-machines.md#search-for-specific-events)
|
||||
###### [Filter events from a specific date](investigate-machines.md#filter-events-from-a-specific-date)
|
||||
###### [Export machine timeline events](investigate-machines.md#export-machine-timeline-events)
|
||||
###### [Navigate between pages](investigate-machines.md#navigate-between-pages)
|
||||
|
||||
|
||||
#### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md)
|
||||
##### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md)
|
||||
###### [Collect investigation package](respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package-from-machines)
|
||||
###### [Run antivirus scan](respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines)
|
||||
###### [Restrict app execution](respond-machine-alerts-windows-defender-advanced-threat-protection.md#restrict-app-execution)
|
||||
###### [Remove app restriction](respond-machine-alerts-windows-defender-advanced-threat-protection.md#remove-app-restriction)
|
||||
###### [Isolate machines from the network](respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network)
|
||||
###### [Release machine from isolation](respond-machine-alerts-windows-defender-advanced-threat-protection.md#release-machine-from-isolation)
|
||||
###### [Check activity details in Action center](respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
|
||||
#### [Take response actions](response-actions.md)
|
||||
##### [Take response actions on a machine](respond-machine-alerts.md)
|
||||
###### [Collect investigation package](respond-machine-alerts.md#collect-investigation-package-from-machines)
|
||||
###### [Run antivirus scan](respond-machine-alerts.md#run-windows-defender-antivirus-scan-on-machines)
|
||||
###### [Restrict app execution](respond-machine-alerts.md#restrict-app-execution)
|
||||
###### [Remove app restriction](respond-machine-alerts.md#remove-app-restriction)
|
||||
###### [Isolate machines from the network](respond-machine-alerts.md#isolate-machines-from-the-network)
|
||||
###### [Release machine from isolation](respond-machine-alerts.md#release-machine-from-isolation)
|
||||
###### [Check activity details in Action center](respond-machine-alerts.md#check-activity-details-in-action-center)
|
||||
|
||||
##### [Take response actions on a file](respond-file-alerts-windows-defender-advanced-threat-protection.md)
|
||||
###### [Stop and quarantine files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network)
|
||||
###### [Remove file from quarantine](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine)
|
||||
###### [Block files in your network](respond-file-alerts-windows-defender-advanced-threat-protection.md#block-files-in-your-network)
|
||||
###### [Remove file from blocked list](respond-file-alerts-windows-defender-advanced-threat-protection.md#remove-file-from-blocked-list)
|
||||
###### [Check activity details in Action center](respond-file-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
|
||||
###### [Deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#deep-analysis)
|
||||
###### [Submit files for analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#submit-files-for-analysis)
|
||||
###### [View deep analysis reports](respond-file-alerts-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports)
|
||||
###### [Troubleshoot deep analysis](respond-file-alerts-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis)
|
||||
##### [Take response actions on a file](respond-file-alerts.md)
|
||||
###### [Stop and quarantine files in your network](respond-file-alerts.md#stop-and-quarantine-files-in-your-network)
|
||||
###### [Remove file from quarantine](respond-file-alerts.md#remove-file-from-quarantine)
|
||||
###### [Block files in your network](respond-file-alerts.md#block-files-in-your-network)
|
||||
###### [Remove file from blocked list](respond-file-alerts.md#remove-file-from-blocked-list)
|
||||
###### [Check activity details in Action center](respond-file-alerts.md#check-activity-details-in-action-center)
|
||||
###### [Deep analysis](respond-file-alerts.md#deep-analysis)
|
||||
###### [Submit files for analysis](respond-file-alerts.md#submit-files-for-analysis)
|
||||
###### [View deep analysis reports](respond-file-alerts.md#view-deep-analysis-reports)
|
||||
###### [Troubleshoot deep analysis](respond-file-alerts.md#troubleshoot-deep-analysis)
|
||||
|
||||
### [Automated investigation and remediation](automated-investigations-windows-defender-advanced-threat-protection.md)
|
||||
#### [Learn about the automated investigation and remediation dashboard](manage-auto-investigation-windows-defender-advanced-threat-protection.md)
|
||||
### [Automated investigation and remediation](automated-investigations.md)
|
||||
#### [Learn about the automated investigation and remediation dashboard](manage-auto-investigation.md)
|
||||
|
||||
|
||||
### [Secure score](overview-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
### [Secure score](overview-secure-score.md)
|
||||
### [Threat analytics](threat-analytics.md)
|
||||
|
||||
|
||||
|
||||
### [Advanced hunting](overview-hunting-windows-defender-advanced-threat-protection.md)
|
||||
#### [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
##### [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
|
||||
##### [Advanced hunting query language best practices](advanced-hunting-best-practices-windows-defender-advanced-threat-protection.md)
|
||||
### [Advanced hunting](overview-hunting.md)
|
||||
#### [Query data using Advanced hunting](advanced-hunting.md)
|
||||
##### [Advanced hunting reference](advanced-hunting-reference.md)
|
||||
##### [Advanced hunting query language best practices](advanced-hunting-best-practices.md)
|
||||
#### [Custom detections](overview-custom-detections.md)
|
||||
#####[Create custom detections rules](custom-detection-rules.md)
|
||||
|
||||
|
||||
### [Management and APIs](management-apis.md)
|
||||
#### [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
|
||||
#### [Windows Defender ATP APIs](apis-intro.md)
|
||||
#### [Managed security service provider support](mssp-support-windows-defender-advanced-threat-protection.md)
|
||||
#### [Understand threat intelligence concepts](threat-indicator-concepts.md)
|
||||
#### [Microsoft Defender ATP APIs](apis-intro.md)
|
||||
#### [Managed security service provider support](mssp-support.md)
|
||||
|
||||
|
||||
### [Microsoft Threat Protection](threat-protection-integration.md)
|
||||
#### [Protect users, data, and devices with conditional access](conditional-access-windows-defender-advanced-threat-protection.md)
|
||||
#### [Protect users, data, and devices with conditional access](conditional-access.md)
|
||||
#### [Microsoft Cloud App Security in Windows overview](microsoft-cloud-app-security-integration.md)
|
||||
#### [Information protection in Windows overview](information-protection-in-windows-overview.md)
|
||||
|
||||
@ -98,18 +98,18 @@
|
||||
### [Microsoft Threat Experts](microsoft-threat-experts.md)
|
||||
|
||||
|
||||
### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md)
|
||||
### [Portal overview](portal-overview.md)
|
||||
|
||||
|
||||
## [Get started](get-started.md)
|
||||
### [What's new in Windows Defender ATP](whats-new-in-windows-defender-atp.md)
|
||||
### [Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md)
|
||||
### [Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md)
|
||||
### [Preview features](preview-windows-defender-advanced-threat-protection.md)
|
||||
### [Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md)
|
||||
### [Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md)
|
||||
### [What's new in Microsoft Defender ATP](whats-new-in-microsoft-defender-atp.md)
|
||||
### [Minimum requirements](minimum-requirements.md)
|
||||
### [Validate licensing and complete setup](licensing.md)
|
||||
### [Preview features](preview.md)
|
||||
### [Data storage and privacy](data-storage-privacy.md)
|
||||
### [Assign user access to the portal](assign-portal-access.md)
|
||||
|
||||
### [Evaluate Windows Defender ATP](evaluate-atp.md)
|
||||
### [Evaluate Microsoft Defender ATP](evaluate-atp.md)
|
||||
####Evaluate attack surface reduction
|
||||
##### [Hardware-based isolation](../windows-defender-application-guard/test-scenarios-wd-app-guard.md)
|
||||
##### [Application control](../windows-defender-application-control/audit-windows-defender-application-control-policies.md)
|
||||
@ -120,7 +120,7 @@
|
||||
##### [Network firewall](../windows-firewall/evaluating-windows-firewall-with-advanced-security-design-examples.md)
|
||||
#### [Evaluate next generation protection](../windows-defender-antivirus/evaluate-windows-defender-antivirus.md)
|
||||
|
||||
### [Access the Windows Defender Security Center Community Center](community-windows-defender-advanced-threat-protection.md)
|
||||
### [Access the Windows Defender Security Center Community Center](community.md)
|
||||
|
||||
## [Configure and manage capabilities](onboard.md)
|
||||
### [Configure attack surface reduction](configure-attack-surface-reduction.md)
|
||||
@ -210,29 +210,29 @@
|
||||
##### [Use the mpcmdrun.exe command line tool to manage next generation protection](../windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md)
|
||||
|
||||
|
||||
### [Configure Secure score dashboard security controls](secure-score-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
### [Configure Secure score dashboard security controls](secure-score-dashboard.md)
|
||||
|
||||
### Management and API support
|
||||
#### [Onboard machines](onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard previous versions of Windows](onboard-downlevel-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
####### [Onboard machines using Microsoft Intune](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-machines-using-microsoft-intune)
|
||||
###### [Onboard machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
##### [Run a detection test on a newly onboarded machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
##### [Run simulated attacks on machines](attack-simulations-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
##### [Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
###### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages-windows-defender-advanced-threat-protection.md)
|
||||
#### [Onboard machines](onboard-configure.md)
|
||||
##### [Onboard previous versions of Windows](onboard-downlevel.md)
|
||||
##### [Onboard Windows 10 machines](configure-endpoints.md)
|
||||
###### [Onboard machines using Group Policy](configure-endpoints-gp.md)
|
||||
###### [Onboard machines using System Center Configuration Manager](configure-endpoints-sccm.md)
|
||||
###### [Onboard machines using Mobile Device Management tools](configure-endpoints-mdm.md)
|
||||
####### [Onboard machines using Microsoft Intune](configure-endpoints-mdm.md#onboard-machines-using-microsoft-intune)
|
||||
###### [Onboard machines using a local script](configure-endpoints-script.md)
|
||||
###### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi.md)
|
||||
##### [Onboard servers](configure-server-endpoints.md)
|
||||
##### [Onboard non-Windows machines](configure-endpoints-non-windows.md)
|
||||
##### [Run a detection test on a newly onboarded machine](run-detection-test.md)
|
||||
##### [Run simulated attacks on machines](attack-simulations.md)
|
||||
##### [Configure proxy and Internet connectivity settings](configure-proxy-internet.md)
|
||||
##### [Troubleshoot onboarding issues](troubleshoot-onboarding.md)
|
||||
###### [Troubleshoot subscription and portal access issues](troubleshoot-onboarding-error-messages.md)
|
||||
|
||||
|
||||
#### [Windows Defender ATP API](use-apis.md)
|
||||
##### [Get started with Windows Defender ATP APIs](apis-intro.md)
|
||||
#### [Microsoft Defender ATP API](use-apis.md)
|
||||
##### [Get started with Microsoft Defender ATP APIs](apis-intro.md)
|
||||
###### [Hello World](api-hello-world.md)
|
||||
###### [Get access with application context](exposed-apis-create-app-webapp.md)
|
||||
###### [Get access with user context](exposed-apis-create-app-nativeapp.md)
|
||||
@ -240,65 +240,65 @@
|
||||
|
||||
###### [Advanced Hunting](run-advanced-query-api.md)
|
||||
|
||||
###### [Alert](alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [List alerts](get-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Create alert](create-alert-by-reference-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Update Alert](update-alert-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert information by ID](get-alert-info-by-id-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert related domains information](get-alert-related-domain-info-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert related file information](get-alert-related-files-info-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert related IPs information](get-alert-related-ip-info-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert related machine information](get-alert-related-machine-info-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get alert related user information](get-alert-related-user-info-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [Alert](alerts.md)
|
||||
####### [List alerts](get-alerts.md)
|
||||
####### [Create alert](create-alert-by-reference.md)
|
||||
####### [Update Alert](update-alert.md)
|
||||
####### [Get alert information by ID](get-alert-info-by-id.md)
|
||||
####### [Get alert related domains information](get-alert-related-domain-info.md)
|
||||
####### [Get alert related file information](get-alert-related-files-info.md)
|
||||
####### [Get alert related IPs information](get-alert-related-ip-info.md)
|
||||
####### [Get alert related machine information](get-alert-related-machine-info.md)
|
||||
####### [Get alert related user information](get-alert-related-user-info.md)
|
||||
|
||||
###### [Machine](machine-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [List machines](get-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get machine by ID](get-machine-by-id-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get machine log on users](get-machine-log-on-users-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get machine related alerts](get-machine-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Add or Remove machine tags](add-or-remove-machine-tags-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Find machines by IP](find-machines-by-ip-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [Machine](machine.md)
|
||||
####### [List machines](get-machines.md)
|
||||
####### [Get machine by ID](get-machine-by-id.md)
|
||||
####### [Get machine log on users](get-machine-log-on-users.md)
|
||||
####### [Get machine related alerts](get-machine-related-alerts.md)
|
||||
####### [Add or Remove machine tags](add-or-remove-machine-tags.md)
|
||||
####### [Find machines by IP](find-machines-by-ip.md)
|
||||
|
||||
###### [Machine Action](machineaction-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [List Machine Actions](get-machineactions-collection-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get Machine Action](get-machineaction-object-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Collect investigation package](collect-investigation-package-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get investigation package SAS URI](get-package-sas-uri-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Isolate machine](isolate-machine-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Release machine from isolation](unisolate-machine-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Restrict app execution](restrict-code-execution-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Remove app restriction](unrestrict-code-execution-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Run antivirus scan](run-av-scan-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Offboard machine](offboard-machine-api-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Stop and quarantine file](stop-and-quarantine-file-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Initiate investigation (preview)](initiate-autoir-investigation-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [Machine Action](machineaction.md)
|
||||
####### [List Machine Actions](get-machineactions-collection.md)
|
||||
####### [Get Machine Action](get-machineaction-object.md)
|
||||
####### [Collect investigation package](collect-investigation-package.md)
|
||||
####### [Get investigation package SAS URI](get-package-sas-uri.md)
|
||||
####### [Isolate machine](isolate-machine.md)
|
||||
####### [Release machine from isolation](unisolate-machine.md)
|
||||
####### [Restrict app execution](restrict-code-execution.md)
|
||||
####### [Remove app restriction](unrestrict-code-execution.md)
|
||||
####### [Run antivirus scan](run-av-scan.md)
|
||||
####### [Offboard machine](offboard-machine-api.md)
|
||||
####### [Stop and quarantine file](stop-and-quarantine-file.md)
|
||||
####### [Initiate investigation (preview)](initiate-autoir-investigation.md)
|
||||
|
||||
###### [Indicators (preview)](ti-indicator-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Submit Indicator](post-ti-indicator-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [List Indicators](get-ti-indicators-collection-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Delete Indicator](delete-ti-indicator-by-id-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [Indicators (preview)](ti-indicator.md)
|
||||
####### [Submit Indicator](post-ti-indicator.md)
|
||||
####### [List Indicators](get-ti-indicators-collection.md)
|
||||
####### [Delete Indicator](delete-ti-indicator-by-id.md)
|
||||
|
||||
###### Domain
|
||||
####### [Get domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get domain related machines](get-domain-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get domain statistics](get-domain-statistics-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Is domain seen in organization](is-domain-seen-in-org-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get domain related alerts](get-domain-related-alerts.md)
|
||||
####### [Get domain related machines](get-domain-related-machines.md)
|
||||
####### [Get domain statistics](get-domain-statistics.md)
|
||||
####### [Is domain seen in organization](is-domain-seen-in-org.md)
|
||||
|
||||
###### [File](files-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get file information](get-file-information-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get file related alerts](get-file-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get file related machines](get-file-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get file statistics](get-file-statistics-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [File](files.md)
|
||||
####### [Get file information](get-file-information.md)
|
||||
####### [Get file related alerts](get-file-related-alerts.md)
|
||||
####### [Get file related machines](get-file-related-machines.md)
|
||||
####### [Get file statistics](get-file-statistics.md)
|
||||
|
||||
###### IP
|
||||
####### [Get IP related alerts](get-ip-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get IP related machines](get-ip-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get IP statistics](get-ip-statistics-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Is IP seen in organization](is-ip-seen-org-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get IP related alerts](get-ip-related-alerts.md)
|
||||
####### [Get IP related machines](get-ip-related-machines.md)
|
||||
####### [Get IP statistics](get-ip-statistics.md)
|
||||
####### [Is IP seen in organization](is-ip-seen-org.md)
|
||||
|
||||
###### [User](user-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get user related alerts](get-user-related-alerts-windows-defender-advanced-threat-protection-new.md)
|
||||
####### [Get user related machines](get-user-related-machines-windows-defender-advanced-threat-protection-new.md)
|
||||
###### [User](user.md)
|
||||
####### [Get user related alerts](get-user-related-alerts.md)
|
||||
####### [Get user related machines](get-user-related-machines.md)
|
||||
|
||||
##### How to use APIs - Samples
|
||||
###### Advanced Hunting API
|
||||
@ -312,36 +312,36 @@
|
||||
|
||||
|
||||
#### API for custom alerts
|
||||
##### [Enable the custom threat intelligence application](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Use the threat intelligence API to create custom alerts](use-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Create custom threat intelligence alerts](custom-ti-api-windows-defender-advanced-threat-protection.md)
|
||||
##### [PowerShell code examples](powershell-example-code-windows-defender-advanced-threat-protection.md)
|
||||
##### [Python code examples](python-example-code-windows-defender-advanced-threat-protection.md)
|
||||
##### [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable the custom threat intelligence application](enable-custom-ti.md)
|
||||
##### [Use the threat intelligence API to create custom alerts](use-custom-ti.md)
|
||||
##### [Create custom threat intelligence alerts](custom-ti-api.md)
|
||||
##### [PowerShell code examples](powershell-example-code.md)
|
||||
##### [Python code examples](python-example-code.md)
|
||||
##### [Experiment with custom threat intelligence alerts](experiment-custom-ti.md)
|
||||
##### [Troubleshoot custom threat intelligence issues](troubleshoot-custom-ti.md)
|
||||
|
||||
|
||||
#### [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure Splunk to pull alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure HP ArcSight to pull alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
##### [Windows Defender ATP SIEM alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md)
|
||||
##### [Pull alerts using SIEM REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
##### [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md)
|
||||
#### [Pull alerts to your SIEM tools](configure-siem.md)
|
||||
##### [Enable SIEM integration](enable-siem-integration.md)
|
||||
##### [Configure Splunk to pull alerts](configure-splunk.md)
|
||||
##### [Configure HP ArcSight to pull alerts](configure-arcsight.md)
|
||||
##### [Microsoft Defender ATP SIEM alert API fields](api-portal-mapping.md)
|
||||
##### [Pull alerts using SIEM REST API](pull-alerts-using-rest-api.md)
|
||||
##### [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||
|
||||
|
||||
#### Reporting
|
||||
##### [Create and build Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Threat protection reports](threat-protection-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Machine health and compliance reports](machine-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Create and build Power BI reports using Microsoft Defender ATP data](powerbi-reports.md)
|
||||
##### [Threat protection reports](threat-protection-reports.md)
|
||||
##### [Machine health and compliance reports](machine-reports.md)
|
||||
|
||||
#### Role-based access control
|
||||
##### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
|
||||
###### [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md)
|
||||
###### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md)
|
||||
####### [Create and manage machine tags](machine-tags-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage portal access using RBAC](rbac.md)
|
||||
###### [Create and manage roles](user-roles.md)
|
||||
###### [Create and manage machine groups](machine-groups.md)
|
||||
####### [Create and manage machine tags](machine-tags.md)
|
||||
|
||||
#### [Configure managed security service provider (MSSP) support](configure-mssp-support-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure managed security service provider (MSSP) support](configure-mssp-support.md)
|
||||
|
||||
|
||||
|
||||
@ -349,56 +349,56 @@
|
||||
### [Configure and manage Microsoft Threat Experts capabilities](configure-microsoft-threat-experts.md)
|
||||
|
||||
### Configure Microsoft Threat Protection integration
|
||||
#### [Configure conditional access](configure-conditional-access-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure conditional access](configure-conditional-access.md)
|
||||
#### [Configure Microsoft Cloud App Security in Windows](microsoft-cloud-app-security-config.md)
|
||||
####[Configure information protection in Windows](information-protection-in-windows-config.md)
|
||||
|
||||
|
||||
### [Configure Windows Defender Security Center settings](preferences-setup-windows-defender-advanced-threat-protection.md)
|
||||
### [Configure Windows Defender Security Center settings](preferences-setup.md)
|
||||
#### General
|
||||
##### [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable and create Power BI reports using Windows Security app data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable Secure score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md)
|
||||
##### [Update data retention settings](data-retention-settings.md)
|
||||
##### [Configure alert notifications](configure-email-notifications.md)
|
||||
##### [Enable and create Power BI reports using Windows Security app data](powerbi-reports.md)
|
||||
##### [Enable Secure score security controls](enable-secure-score.md)
|
||||
##### [Configure advanced features](advanced-features.md)
|
||||
|
||||
#### Permissions
|
||||
##### [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md)
|
||||
###### [Create and manage roles](user-roles-windows-defender-advanced-threat-protection.md)
|
||||
###### [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md)
|
||||
####### [Create and manage machine tags](machine-tags-windows-defender-advanced-threat-protection.md)
|
||||
##### [Use basic permissions to access the portal](basic-permissions.md)
|
||||
##### [Manage portal access using RBAC](rbac.md)
|
||||
###### [Create and manage roles](user-roles.md)
|
||||
###### [Create and manage machine groups](machine-groups.md)
|
||||
####### [Create and manage machine tags](machine-tags.md)
|
||||
|
||||
#### APIs
|
||||
##### [Enable Threat intel](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable SIEM integration](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable Threat intel](enable-custom-ti.md)
|
||||
##### [Enable SIEM integration](enable-siem-integration.md)
|
||||
|
||||
####Rules
|
||||
##### [Manage suppression rules](manage-suppression-rules-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage allowed/blocked lists](manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation file uploads](manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation folder exclusions](manage-automation-folder-exclusions-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage suppression rules](manage-suppression-rules.md)
|
||||
##### [Manage automation allowed/blocked lists](manage-automation-allowed-blocked-list.md)
|
||||
##### [Manage allowed/blocked lists](manage-allowed-blocked-list.md)
|
||||
##### [Manage automation file uploads](manage-automation-file-uploads.md)
|
||||
##### [Manage automation folder exclusions](manage-automation-folder-exclusions.md)
|
||||
|
||||
####Machine management
|
||||
##### [Onboarding machines](onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
##### [Offboarding machines](offboard-machines-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboarding machines](onboard-configure.md)
|
||||
##### [Offboarding machines](offboard-machines.md)
|
||||
|
||||
#### [Configure Windows Security app time zone settings](time-settings-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure Windows Security app time zone settings](time-settings.md)
|
||||
|
||||
|
||||
|
||||
|
||||
## [Troubleshoot Windows Defender ATP](troubleshoot-wdatp.md)
|
||||
## [Troubleshoot Microsoft Defender ATP](troubleshoot-overview.md)
|
||||
###Troubleshoot sensor state
|
||||
#### [Check sensor state](check-sensor-status-windows-defender-advanced-threat-protection.md)
|
||||
#### [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
#### [Inactive machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines)
|
||||
#### [Misconfigured machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines)
|
||||
#### [Review sensor events and errors on machines with Event Viewer](event-error-codes-windows-defender-advanced-threat-protection.md)
|
||||
#### [Check sensor state](check-sensor-status.md)
|
||||
#### [Fix unhealthy sensors](fix-unhealhty-sensors.md)
|
||||
#### [Inactive machines](fix-unhealhty-sensors.md#inactive-machines)
|
||||
#### [Misconfigured machines](fix-unhealhty-sensors.md#misconfigured-machines)
|
||||
#### [Review sensor events and errors on machines with Event Viewer](event-error-codes.md)
|
||||
|
||||
### [Troubleshoot Windows Defender ATP service issues](troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
#### [Check service health](service-status-windows-defender-advanced-threat-protection.md)
|
||||
### [Troubleshoot Microsoft Defender ATP service issues](troubleshoot.md)
|
||||
#### [Check service health](service-status.md)
|
||||
|
||||
###Troubleshoot attack surface reduction
|
||||
#### [Network protection](../windows-defender-exploit-guard/troubleshoot-np.md)
|
||||
|
||||
@ -20,14 +20,14 @@ ms.topic: article
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
- Adds or remove tag to a specific machine.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure advanced features in Windows Defender ATP
|
||||
description: Turn on advanced features such as block file in Windows Defender Advanced Threat Protection.
|
||||
title: Configure advanced features in Microsoft Defender ATP
|
||||
description: Turn on advanced features such as block file in Microsoft Defender Advanced Threat Protection.
|
||||
keywords: advanced features, settings, block file, automated investigation, auto-resolve, skype, azure atp, office 365, azure information protection, intune
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -17,14 +17,14 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Configure advanced features in Windows Defender ATP
|
||||
# Configure advanced features in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink)
|
||||
|
||||
Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Windows Defender ATP with.
|
||||
Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Microsoft Defender ATP with.
|
||||
|
||||
Use the following advanced features to get better protected from potentially malicious files and gain better insight during security investigations:
|
||||
|
||||
@ -69,7 +69,7 @@ The integration with Azure Advanced Threat Protection allows you to pivot direct
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
### Enable the Windows Defender ATP integration from the Azure ATP portal
|
||||
### Enable the Microsoft Defender ATP integration from the Azure ATP portal
|
||||
To receive contextual machine integration in Azure ATP, you'll also need to enable the feature in the Azure ATP portal.
|
||||
|
||||
1. Login to the [Azure portal](https://portal.atp.azure.com/) with a Global Administrator or Security Administrator role.
|
||||
@ -88,10 +88,10 @@ When you enable this feature, you'll be able to incorporate data from Office 365
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
To receive contextual machine integration in Office 365 Threat Intelligence, you'll need to enable the Windows Defender ATP settings in the Security & Compliance dashboard. For more information, see [Office 365 Threat Intelligence overview](https://support.office.com/en-us/article/Office-365-Threat-Intelligence-overview-32405DA5-BEE1-4A4B-82E5-8399DF94C512).
|
||||
To receive contextual machine integration in Office 365 Threat Intelligence, you'll need to enable the Microsoft Defender ATP settings in the Security & Compliance dashboard. For more information, see [Office 365 Threat Intelligence overview](https://support.office.com/en-us/article/Office-365-Threat-Intelligence-overview-32405DA5-BEE1-4A4B-82E5-8399DF94C512).
|
||||
|
||||
## Microsoft Threat Experts
|
||||
This feature is currently on public preview. When you enable this feature, you'll receive targeted attack notifications from Microsoft Threat Experts through your Windows Defender ATP portal's alerts dashboard and via email if you configure it.
|
||||
This feature is currently on public preview. When you enable this feature, you'll receive targeted attack notifications from Microsoft Threat Experts through your Microsoft Defender ATP portal's alerts dashboard and via email if you configure it.
|
||||
|
||||
>[!NOTE]
|
||||
>This feature will be available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10 version 1809 or later.
|
||||
@ -99,7 +99,7 @@ This feature is currently on public preview. When you enable this feature, you'l
|
||||
|
||||
|
||||
## Microsoft Cloud App Security
|
||||
Enabling this setting forwards Windows Defender ATP signals to Microsoft Cloud App Security to provide deeper visibility into cloud application usage. Forwarded data is stored and processed in the same location as your Cloud App Security data.
|
||||
Enabling this setting forwards Microsoft Defender ATP signals to Microsoft Cloud App Security to provide deeper visibility into cloud application usage. Forwarded data is stored and processed in the same location as your Cloud App Security data.
|
||||
|
||||
>[!NOTE]
|
||||
>This feature is available with an E5 license for [Enterprise Mobility + Security](https://www.microsoft.com/cloud-platform/enterprise-mobility-security) on machines running Windows 10 version 1809 or later.
|
||||
@ -111,14 +111,14 @@ Turning this setting on forwards signals to Azure Information Protection, giving
|
||||
## Microsoft Intune connection
|
||||
This feature is only available if you have an active Microsoft Intune (Intune) license.
|
||||
|
||||
When you enable this feature, you'll be able to share Windows Defender ATP device information to Intune and enhance policy enforcement.
|
||||
When you enable this feature, you'll be able to share Microsoft Defender ATP device information to Intune and enhance policy enforcement.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to enable the integration on both Intune and Windows Defender ATP to use this feature.
|
||||
>You'll need to enable the integration on both Intune and Microsoft Defender ATP to use this feature.
|
||||
|
||||
|
||||
## Preview features
|
||||
Learn about new features in the Windows Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience.
|
||||
Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience.
|
||||
|
||||
You'll have access to upcoming features which you can provide feedback on to help improve the overall experience before features are generally available.
|
||||
|
||||
@ -130,5 +130,5 @@ You'll have access to upcoming features which you can provide feedback on to hel
|
||||
## Related topics
|
||||
- [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure alert notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable and create Power BI reports using Microsoft Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable Secure Score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Advanced hunting best practices in Windows Defender ATP
|
||||
title: Advanced hunting best practices in Microsoft Defender ATP
|
||||
description: Learn about Advanced hunting best practices such as what filters and keywords to use to effectively query data.
|
||||
keywords: advanced hunting, best practices, keyword, filters, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,16 +18,16 @@ ms.topic: conceptual
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
# Advanced hunting query best practices Windows Defender ATP
|
||||
# Advanced hunting query best practices Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-abovefoldlink)
|
||||
|
||||
## Performance best practices
|
||||
The following best practices serve as a guideline of query performance best practices and for you to get faster results and be able to run complex queries.
|
||||
@ -42,7 +42,7 @@ The following best practices serve as a guideline of query performance best prac
|
||||
|
||||
### Unique Process IDs
|
||||
Process IDs are recycled in Windows and reused for new processes and therefore can't serve as a unique identifier for a specific process.
|
||||
To address this issue, Windows Defender ATP created the time process. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time.
|
||||
To address this issue, Microsoft Defender ATP created the time process. To get a unique identifier for a process on a specific machine, use the process ID together with the process creation time.
|
||||
|
||||
|
||||
So, when you join data based on a specific process or summarize data for each process, you'll need to use a machine identifier (either MachineId or ComputerName), a process ID (ProcessId or InitiatingProcessId) and the process creation time (ProcessCreationTime or InitiatingProcessCreationTime)
|
||||
@ -92,7 +92,7 @@ ProcessCreationEvents
|
||||
| where CanonicalCommandLine contains "stop" and CanonicalCommandLine contains "MpsSvc"
|
||||
```
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-bestpractices-belowfoldlink)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Advanced hunting reference in Windows Defender ATP
|
||||
title: Advanced hunting reference in Microsoft Defender ATP
|
||||
description: Learn about Advanced hunting table reference such as column name, data type, and description
|
||||
keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics, column name, data type, description
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,16 +18,16 @@ ms.topic: article
|
||||
ms.date: 06/01/2018
|
||||
---
|
||||
|
||||
# Advanced hunting reference in Windows Defender ATP
|
||||
# Advanced hunting reference in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
## Advanced hunting column reference
|
||||
@ -99,7 +99,7 @@ To effectively build queries that span multiple tables, you need to understand t
|
||||
| ProcessIntegrityLevel | string | Integrity level of the newly created process. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet downloaded. These integrity levels influence permissions to resources. |
|
||||
| ProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the newly created process |
|
||||
| Protocol | string | IP protocol used, whether TCP or UDP |
|
||||
| PublicIP | string | Public IP address used by the onboarded machine to connect to the Windows Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy. |
|
||||
| PublicIP | string | Public IP address used by the onboarded machine to connect to the Microsoft Defender ATP service. This could be the IP address of the machine itself, a NAT device, or a proxy. |
|
||||
| RegistryKey | string | Registry key that the recorded action was applied to |
|
||||
| RegistryValueData | string | Data of the registry value that the recorded action was applied to |
|
||||
| RegistryValueName | string | Name of the registry value that the recorded action was applied to |
|
||||
@ -115,7 +115,7 @@ To effectively build queries that span multiple tables, you need to understand t
|
||||
| Table | string | Table that contains the details of the event |
|
||||
| TunnelingType | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH |
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-belowfoldlink)
|
||||
|
||||
## Related topic
|
||||
- [Query data using Advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Query data using Advanced hunting in Windows Defender ATP
|
||||
description: Learn about Advanced hunting in Windows Defender ATP and how to query ATP data.
|
||||
title: Query data using Advanced hunting in Microsoft Defender ATP
|
||||
description: Learn about Advanced hunting in Microsoft Defender ATP and how to query ATP data.
|
||||
keywords: advanced hunting, atp query, query atp data, intellisense, atp telemetry, events, events telemetry, azure log analytics
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,9 +18,9 @@ ms.topic: article
|
||||
ms.date: 08/15/2018
|
||||
---
|
||||
|
||||
# Query data using Advanced hunting in Windows Defender ATP
|
||||
# Query data using Advanced hunting in Microsoft Defender ATP
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
To get you started in querying your data, you can use the basic or Advanced query examples that have some preloaded queries for you to understand the basic query syntax.
|
||||
@ -33,7 +33,7 @@ A typical query starts with a table name followed by a series of operators separ
|
||||
|
||||
In the following example, we start with the table name **ProcessCreationEvents** and add piped elements as needed.
|
||||
|
||||
|
||||
|
||||
|
||||
First, we define a time filter to review only records from the previous seven days.
|
||||
|
||||
@ -127,7 +127,7 @@ The result set has several capabilities to provide you with effective investigat
|
||||
- Columns that return entity-related objects, such as Machine name, Machine ID, File name, SHA1, User, IP, and URL, are linked to their entity pages in Windows Defender Security Center.
|
||||
- You can right-click on a cell in the result set and add a filter to your written query. The current filtering options are **include**, **exclude** or **advanced filter**, which provides additional filtering options on the cell value. These cell values are part of the row set.
|
||||
|
||||
|
||||
|
||||
|
||||
## Filter results in Advanced hunting
|
||||
In Advanced hunting, you can use the advanced filter on the output result set of the query.
|
||||
@ -146,7 +146,7 @@ The filter selections will resolve as an additional query term and the results w
|
||||
Check out the [Advanced hunting repository](https://github.com/Microsoft/WindowsDefenderATP-Hunting-Queries). Contribute and use example queries shared by our customers.
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhunting-belowfoldlink)
|
||||
|
||||
## Related topic
|
||||
- [Advanced hunting reference](advanced-hunting-reference-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: View and organize the Windows Defender ATP Alerts queue
|
||||
description: Learn about how the Windows Defender ATP alerts queues work, and how to sort and filter lists of alerts.
|
||||
title: View and organize the Microsoft Defender ATP Alerts queue
|
||||
description: Learn about how the Microsoft Defender ATP alerts queues work, and how to sort and filter lists of alerts.
|
||||
keywords: alerts, queues, alerts queue, sort, order, filter, manage alerts, new, in progress, resolved, newest, time in queue, severity, time period, microsoft threat experts alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,14 +18,14 @@ ms.topic: article
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
# View and organize the Windows Defender Advanced Threat Protection Alerts queue
|
||||
# View and organize the Microsoft Defender Advanced Threat Protection Alerts queue
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-alertsq-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-alertsq-abovefoldlink)
|
||||
|
||||
The **Alerts queue** shows a list of alerts that were flagged from machines in your network. By default, the queue displays alerts seen in the last 30 days in a grouped view, with the most recent alerts showing at the top of the list, helping you see the most recent alerts first.
|
||||
|
||||
@ -55,14 +55,14 @@ Informational </br>(Grey) | Informational alerts are those that might not be con
|
||||
|
||||
|
||||
#### Understanding alert severity
|
||||
It is important to understand that the Windows Defender Antivirus (Windows Defender AV) and Windows Defender ATP alert severities are different because they represent different scopes.
|
||||
It is important to understand that the Windows Defender Antivirus (Windows Defender AV) and Microsoft Defender ATP alert severities are different because they represent different scopes.
|
||||
|
||||
The Windows Defender AV threat severity represents the absolute severity of the detected threat (malware), and is assigned based on the potential risk to the individual machine, if infected.
|
||||
|
||||
The Windows Defender ATP alert severity represents the severity of the detected behavior, the actual risk to the machine but more importantly the potential risk to the organization.
|
||||
The Microsoft Defender ATP alert severity represents the severity of the detected behavior, the actual risk to the machine but more importantly the potential risk to the organization.
|
||||
|
||||
So, for example:
|
||||
- The severity of a Windows Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage incurred.
|
||||
- The severity of a Microsoft Defender ATP alert about a Windows Defender AV detected threat that was completely prevented and did not infect the machine is categorized as "Informational" because there was no actual damage incurred.
|
||||
- An alert about a commercial malware was detected while executing, but blocked and remediated by Windows Defender AV, is categorized as "Low" because it may have caused some damage to the individual machine but poses no organizational threat.
|
||||
- An alert about malware detected while executing which can pose a threat not only to the individual machine but to the organization, regardless if it was eventually blocked, may be ranked as "Medium" or "High".
|
||||
- Suspicious behavioral alerts which were not blocked or remediated will be ranked "Low", "Medium" or "High" following the same organizational threat considerations.
|
||||
@ -94,11 +94,11 @@ Use this filter to focus on alerts that are related to high profile threats. You
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Microsoft Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
@ -18,11 +18,11 @@ ms.topic: article
|
||||
|
||||
# Alert resource type
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Represents an alert entity in Windows Defender ATP.
|
||||
Represents an alert entity in Microsoft Defender ATP.
|
||||
|
||||
# Methods
|
||||
Method|Return Type |Description
|
||||
|
||||
@ -16,12 +16,12 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Windows Defender ATP API - Hello World
|
||||
# Microsoft Defender ATP API - Hello World
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
## Get Alerts using a simple PowerShell script
|
||||
@ -50,7 +50,7 @@ For the App registration stage, you must have a Global administrator role in you
|
||||
|
||||
|
||||
|
||||
4. Allow your App to access Windows Defender ATP and assign it 'Read all alerts' permission:
|
||||
4. Allow your App to access Microsoft Defender ATP and assign it 'Read all alerts' permission:
|
||||
|
||||
- Click **Settings** > **Required permissions** > **Add**.
|
||||
|
||||
@ -184,6 +184,6 @@ You’re all done! You have just successfully:
|
||||
|
||||
|
||||
## Related topic
|
||||
- [Windows Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Windows Defender ATP with application context](exposed-apis-create-app-webapp.md)
|
||||
- [Access Windows Defender ATP with user context](exposed-apis-create-app-nativeapp.md)
|
||||
- [Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Microsoft Defender ATP with application context](exposed-apis-create-app-webapp.md)
|
||||
- [Access Microsoft Defender ATP with user context](exposed-apis-create-app-nativeapp.md)
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Windows Defender ATP alert API fields
|
||||
title: Microsoft Defender ATP alert API fields
|
||||
description: Understand how the alert API fields map to the values in Windows Defender Security Center
|
||||
keywords: alerts, alert fields, fields, api, fields, pull alerts, rest api, request, response
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,17 +18,17 @@ ms.topic: article
|
||||
ms.date: 10/16/2017
|
||||
---
|
||||
|
||||
# Windows Defender ATP SIEM alert API fields
|
||||
# Microsoft Defender ATP SIEM alert API fields
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink)
|
||||
|
||||
Understand what data fields are exposed as part of the alerts API and how they map to Windows Defender Security Center.
|
||||
|
||||
@ -37,7 +37,7 @@ Understand what data fields are exposed as part of the alerts API and how they m
|
||||
The following table lists the available fields exposed in the alerts API payload. It shows examples for the populated values and a reference on how data is reflected on the portal.
|
||||
|
||||
|
||||
The ArcSight field column contains the default mapping between the Windows Defender ATP fields and the built-in fields in ArcSight. You can download the mapping file from the portal when you enable the SIEM integration feature and you can modify it to match the needs of your organization. For more information, see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md).
|
||||
The ArcSight field column contains the default mapping between the Microsoft Defender ATP fields and the built-in fields in ArcSight. You can download the mapping file from the portal when you enable the SIEM integration feature and you can modify it to match the needs of your organization. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
Field numbers match the numbers in the images below.
|
||||
|
||||
@ -47,12 +47,12 @@ Field numbers match the numbers in the images below.
|
||||
| 1 | AlertTitle | name | A dll was unexpectedly loaded into a high integrity process without a UAC prompt | Value available for every alert. |
|
||||
| 2 | Severity | deviceSeverity | Medium | Value available for every alert. |
|
||||
| 3 | Category | deviceEventCategory | Privilege Escalation | Value available for every alert. |
|
||||
| 4 | Source | sourceServiceName | WindowsDefenderATP | Windows Defender Antivirus or Windows Defender ATP. Value available for every alert. |
|
||||
| 4 | Source | sourceServiceName | WindowsDefenderATP | Windows Defender Antivirus or Microsoft Defender ATP. Value available for every alert. |
|
||||
| 5 | MachineName | sourceHostName | liz-bean | Value available for every alert. |
|
||||
| 6 | FileName | fileName | Robocopy.exe | Available for alerts associated with a file or process. |
|
||||
| 7 | FilePath | filePath | C:\Windows\System32\Robocopy.exe | Available for alerts associated with a file or process. |
|
||||
| 8 | UserDomain | sourceNtDomain | contoso | The domain of the user context running the activity, available for Windows Defender ATP behavioral based alerts. |
|
||||
| 9 | UserName | sourceUserName | liz-bean | The user context running the activity, available for Windows Defender ATP behavioral based alerts. |
|
||||
| 8 | UserDomain | sourceNtDomain | contoso | The domain of the user context running the activity, available for Microsoft Defender ATP behavioral based alerts. |
|
||||
| 9 | UserName | sourceUserName | liz-bean | The user context running the activity, available for Microsoft Defender ATP behavioral based alerts. |
|
||||
| 10 | Sha1 | fileHash | 5b4b3985339529be3151d331395f667e1d5b7f35 | Available for alerts associated with a file or process. |
|
||||
| 11 | Md5 | deviceCustomString5 | 55394b85cb5edddff551f6f3faa9d8eb | Available for Windows Defender AV alerts. |
|
||||
| 12 | Sha256 | deviceCustomString6 | 9987474deb9f457ece2a9533a08ec173a0986fa3aa6ac355eeba5b622e4a43f5 | Available for Windows Defender AV alerts. |
|
||||
@ -72,7 +72,7 @@ Field numbers match the numbers in the images below.
|
||||
| | InternalIPv6List | No mapping | fd30:0000:0000:0001:ff4e:003e:0009:000e, FE80:CD00:0000:0CDE:1257:0000:211E:729C | List of IPV6 internal IPs for active network interfaces. |
|
||||
| Internal field | LastProcessedTimeUtc | No mapping | 2017-05-07T01:56:58.9936648Z | Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that alerts are retrieved. |
|
||||
| | Not part of the schema | deviceVendor | | Static value in the ArcSight mapping - 'Microsoft'. |
|
||||
| | Not part of the schema | deviceProduct | | Static value in the ArcSight mapping - 'Windows Defender ATP'. |
|
||||
| | Not part of the schema | deviceProduct | | Static value in the ArcSight mapping - 'Microsoft Defender ATP'. |
|
||||
| | Not part of the schema | deviceVersion | | Static value in the ArcSight mapping - '2.0', used to identify the mapping versions.
|
||||
|
||||
|
||||
@ -92,8 +92,8 @@ Field numbers match the numbers in the images below.
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Defender Advanced Threat Protection API overview
|
||||
description: Learn how you can use APIs to automate workflows and innovate based on Windows Defender ATP capabilities
|
||||
title: Microsoft Defender Advanced Threat Protection API overview
|
||||
description: Learn how you can use APIs to automate workflows and innovate based on Microsoft Defender ATP capabilities
|
||||
keywords: apis, api, wdatp, open api, windows defender atp api, public api, supported apis, alerts, machine, user, domain, ip, file, advanced hunting, query
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -16,33 +16,33 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Windows Defender ATP API overview
|
||||
# Microsoft Defender ATP API overview
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
Windows Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Windows Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
||||
Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate workflows and innovate based on Microsoft Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
||||
|
||||
In general, you’ll need to take the following steps to use the APIs:
|
||||
- Create an AAD application
|
||||
- Get an access token using this application
|
||||
- Use the token to access Windows Defender ATP API
|
||||
- Use the token to access Microsoft Defender ATP API
|
||||
|
||||
|
||||
You can access Windows Defender ATP API with **Application Context** or **User Context**.
|
||||
You can access Microsoft Defender ATP API with **Application Context** or **User Context**.
|
||||
|
||||
- **Application Context: (Recommended)** <br>
|
||||
Used by apps that run without a signed-in user present. for example, apps that run as background services or daemons.
|
||||
|
||||
Steps that need to be taken to access Windows Defender ATP API with application context:
|
||||
Steps that need to be taken to access Microsoft Defender ATP API with application context:
|
||||
|
||||
1. Create an AAD Web-Application.
|
||||
2. Assign the desired permission to the application, for example, 'Read Alerts', 'Isolate Machines'.
|
||||
3. Create a key for this Application.
|
||||
4. Get token using the application with its key.
|
||||
5. Use the token to access Windows Defender ATP API
|
||||
5. Use the token to access Microsoft Defender ATP API
|
||||
|
||||
For more information, see [Get access with application context](exposed-apis-create-app-webapp.md).
|
||||
|
||||
@ -50,16 +50,16 @@ You can access Windows Defender ATP API with **Application Context** or **User C
|
||||
- **User Context:** <br>
|
||||
Used to perform actions in the API on behalf of a user.
|
||||
|
||||
Steps that needs to be taken to access Windows Defender ATP API with application context:
|
||||
Steps that needs to be taken to access Microsoft Defender ATP API with application context:
|
||||
1. Create AAD Native-Application.
|
||||
2. Assign the desired permission to the application, e.g 'Read Alerts', 'Isolate Machines' etc.
|
||||
3. Get token using the application with user credentials.
|
||||
4. Use the token to access Windows Defender ATP API
|
||||
4. Use the token to access Microsoft Defender ATP API
|
||||
|
||||
For more information, see [Get access with user context](exposed-apis-create-app-nativeapp.md).
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Windows Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Windows Defender ATP with application context](exposed-apis-create-app-webapp.md)
|
||||
- [Access Windows Defender ATP with user context](exposed-apis-create-app-nativeapp.md)
|
||||
- [Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Microsoft Defender ATP with application context](exposed-apis-create-app-webapp.md)
|
||||
- [Access Microsoft Defender ATP with user context](exposed-apis-create-app-nativeapp.md)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Assign user access to Windows Defender Security Center
|
||||
description: Assign read and write or read only access to the Windows Defender Advanced Threat Protection portal.
|
||||
description: Assign read and write or read only access to the Microsoft Defender Advanced Threat Protection portal.
|
||||
keywords: assign user roles, assign read and write access, assign read only access, user, user roles, roles
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -23,11 +23,11 @@ ms.date: 11/28/2018
|
||||
**Applies to:**
|
||||
- Azure Active Directory
|
||||
- Office 365
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-assignaccess-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-assignaccess-abovefoldlink)
|
||||
|
||||
Windows Defender ATP supports two ways to manage permissions:
|
||||
Microsoft Defender ATP supports two ways to manage permissions:
|
||||
|
||||
- **Basic permissions management**: Set permissions to either full access or read-only.
|
||||
- **Role-based access control (RBAC)**: Set granular permissions by defining roles, assigning Azure AD user groups to the roles, and granting the user groups access to machine groups. For more information on RBAC, see [Manage portal access using role-based access control](rbac-windows-defender-advanced-threat-protection.md).
|
||||
@ -35,13 +35,13 @@ Windows Defender ATP supports two ways to manage permissions:
|
||||
> [!NOTE]
|
||||
>If you have already assigned basic permissions, you may switch to RBAC anytime. Consider the following before making the switch:
|
||||
|
||||
>- Users with full access (users that are assigned the Global Administrator or Security Administrator directory role in Azure AD), are automatically assigned the default Windows Defender ATP administrator role, which also has full access. Additional Azure AD user groups can be assigned to the Windows Defender ATP administrator role after switching to RBAC. Only users assigned to the Windows Defender ATP administrator role can manage permissions using RBAC.
|
||||
>- Users with full access (users that are assigned the Global Administrator or Security Administrator directory role in Azure AD), are automatically assigned the default Microsoft Defender ATP administrator role, which also has full access. Additional Azure AD user groups can be assigned to the Microsoft Defender ATP administrator role after switching to RBAC. Only users assigned to the Microsoft Defender ATP administrator role can manage permissions using RBAC.
|
||||
>- Users that have read-only access (Security Readers) will lose access to the portal until they are assigned a role. Note that only Azure AD user groups can be assigned a role under RBAC.
|
||||
>- After switching to RBAC, you will not be able to switch back to using basic permissions management.
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-portalaccess-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-portalaccess-belowfoldlink)
|
||||
|
||||
## Related topic
|
||||
- [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Experience Windows Defender ATP through simulated attacks
|
||||
description: Run the provided attack scenario simulations to experience how Windows Defender ATP can detect, investigate, and respond to breaches.
|
||||
title: Experience Microsoft Defender ATP through simulated attacks
|
||||
description: Run the provided attack scenario simulations to experience how Microsoft Defender ATP can detect, investigate, and respond to breaches.
|
||||
keywords: wdatp, test, scenario, attack, simulation, simulated, diy, windows defender advanced threat protection
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,23 +18,23 @@ ms.topic: article
|
||||
ms.date: 11/20/2018
|
||||
---
|
||||
|
||||
# Experience Windows Defender ATP through simulated attacks
|
||||
# Experience Microsoft Defender ATP through simulated attacks
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink)
|
||||
|
||||
>[!TIP]
|
||||
>- Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
|
||||
>- Windows Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
|
||||
>- Learn about the latest enhancements in Microsoft Defender ATP: [What's new in Microsoft Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
|
||||
>- Microsoft Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
|
||||
|
||||
|
||||
You might want to experience Windows Defender ATP before you onboard more than a few machines to the service. To do this, you can run controlled attack simulations on a few test machines. After running the simulated attacks, you can review how Windows Defender ATP surfaces malicious activity and explore how it enables an efficient response.
|
||||
You might want to experience Microsoft Defender ATP before you onboard more than a few machines to the service. To do this, you can run controlled attack simulations on a few test machines. After running the simulated attacks, you can review how Microsoft Defender ATP surfaces malicious activity and explore how it enables an efficient response.
|
||||
|
||||
## Before you begin
|
||||
|
||||
@ -62,7 +62,7 @@ Read the walkthrough document provided with each attack scenario. Each document
|
||||
>Simulation files or scripts mimic attack activity but are actually benign and will not harm or compromise the test machine.
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-attacksimulations-belowfoldlink)
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -20,12 +20,12 @@ ms.date: 12/04/2018
|
||||
|
||||
# Overview of Automated investigations
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink)
|
||||
|
||||
The Windows Defender ATP service has a wide breadth of visibility on multiple machines. With this kind of optics, the service generates a multitude of alerts. The volume of alerts generated can be challenging for a typical security operations team to individually address.
|
||||
The Microsoft Defender ATP service has a wide breadth of visibility on multiple machines. With this kind of optics, the service generates a multitude of alerts. The volume of alerts generated can be challenging for a typical security operations team to individually address.
|
||||
|
||||
|
||||
To address this challenge, Windows Defender ATP uses Automated investigations to significantly reduce the volume of alerts that need to be investigated individually. The Automated investigation feature leverages various inspection algorithms, and processes used by analysts (such as playbooks) to examine alerts and take immediate remediation action to resolve breaches. This significantly reduces alert volume, allowing security operations experts to focus on more sophisticated threats and other high value initiatives.
|
||||
To address this challenge, Microsoft Defender ATP uses Automated investigations to significantly reduce the volume of alerts that need to be investigated individually. The Automated investigation feature leverages various inspection algorithms, and processes used by analysts (such as playbooks) to examine alerts and take immediate remediation action to resolve breaches. This significantly reduces alert volume, allowing security operations experts to focus on more sophisticated threats and other high value initiatives.
|
||||
|
||||
The Automated investigations list shows all the investigations that have been initiated automatically and shows other details such as its status, detection source, and the date for when the investigation was initiated.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Use basic permissions to access Windows Defender Security Center
|
||||
description: Assign read and write or read only access to the Windows Defender Advanced Threat Protection portal.
|
||||
description: Assign read and write or read only access to the Microsoft Defender Advanced Threat Protection portal.
|
||||
keywords: assign user roles, assign read and write access, assign read only access, user, user roles, roles
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -21,9 +21,9 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
|
||||
- Azure Active Directory
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-basicaccess-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-basicaccess-abovefoldlink)
|
||||
|
||||
Refer to the instructions below to use basic permissions management.
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Check the health state of the sensor in Windows Defender ATP
|
||||
title: Check the health state of the sensor in Microsoft Defender ATP
|
||||
description: Check the sensor health on machines to identify which ones are misconfigured, inactive, or are not reporting sensor data.
|
||||
keywords: sensor, sensor health, misconfigured, inactive, no sensor data, sensor data, impaired communications, communication
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,21 +18,21 @@ ms.topic: article
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
# Check sensor health state in Windows Defender ATP
|
||||
# Check sensor health state in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-checksensor-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-checksensor-abovefoldlink)
|
||||
|
||||
The sensor health tile provides information on the individual machine’s ability to provide sensor data and communicate with the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues.
|
||||
The sensor health tile provides information on the individual machine’s ability to provide sensor data and communicate with the Microsoft Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues.
|
||||
|
||||
|
||||
There are two status indicators on the tile that provide information on the number of machines that are not reporting properly to the service:
|
||||
- **Misconfigured** - These machines might partially be reporting sensor data to the Windows Defender ATP service and might have configuration errors that need to be corrected.
|
||||
- **Inactive** - Machines that have stopped reporting to the Windows Defender ATP service for more than seven days in the past month.
|
||||
- **Misconfigured** - These machines might partially be reporting sensor data to the Microsoft Defender ATP service and might have configuration errors that need to be corrected.
|
||||
- **Inactive** - Machines that have stopped reporting to the Microsoft Defender ATP service for more than seven days in the past month.
|
||||
|
||||
|
||||
Clicking any of the groups directs you to Machines list, filtered according to your choice.
|
||||
@ -40,16 +40,16 @@ Clicking any of the groups directs you to Machines list, filtered according to y
|
||||
You can also download the entire list in CSV format using the **Export to CSV** feature. For more information on filters, see [View and organize the Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
You can filter the health state list by the following status:
|
||||
- **Active** - Machines that are actively reporting to the Windows Defender ATP service.
|
||||
- **Misconfigured** - These machines might partially be reporting sensor data to the Windows Defender ATP service but have configuration errors that need to be corrected. Misconfigured machines can have either one or a combination of the following issues:
|
||||
- **Active** - Machines that are actively reporting to the Microsoft Defender ATP service.
|
||||
- **Misconfigured** - These machines might partially be reporting sensor data to the Microsoft Defender ATP service but have configuration errors that need to be corrected. Misconfigured machines can have either one or a combination of the following issues:
|
||||
- **No sensor data** - Machines has stopped sending sensor data. Limited alerts can be triggered from the machine.
|
||||
- **Impaired communications** - Ability to communicate with machine is impaired. Sending files for deep analysis, blocking files, isolating machine from network and other actions that require communication with the machine may not work.
|
||||
- **Inactive** - Machines that have stopped reporting to the Windows Defender ATP service.
|
||||
- **Inactive** - Machines that have stopped reporting to the Microsoft Defender ATP service.
|
||||
|
||||
|
||||
You can view the machine details when you click on a misconfigured or inactive machine. You’ll see more specific machine information when you click the information icon.
|
||||
|
||||
|
||||
|
||||
|
||||
In the **Machines list**, you can download a full list of all the machines in your organization in a CSV format.
|
||||
|
||||
@ -57,4 +57,4 @@ In the **Machines list**, you can download a full list of all the machines in yo
|
||||
>Export the list in CSV format to display the unfiltered data. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself and can take a significant amount of time to download, depending on how large your organization is.
|
||||
|
||||
## Related topic
|
||||
- [Fix unhealthy sensors in Windows Defender ATP](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
- [Fix unhealthy sensors in Microsoft Defender ATP](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 12/08/2017
|
||||
|
||||
# Collect investigation package API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -28,7 +28,7 @@ Collect investigation package from a machine.
|
||||
[!include[Machine actions note](machineactionsnote.md)]
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Access the Windows Defender ATP Community Center
|
||||
description: Access the Windows Defender ATP Community Center to share experiences, engange, and learn about the product.
|
||||
title: Access the Microsoft Defender ATP Community Center
|
||||
description: Access the Microsoft Defender ATP Community Center to share experiences, engange, and learn about the product.
|
||||
keywords: community, community center, tech community, conversation, announcements
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -19,14 +19,14 @@ ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
|
||||
# Access the Windows Defender ATP Community Center
|
||||
# Access the Microsoft Defender ATP Community Center
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
The Windows Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product.
|
||||
The Microsoft Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product.
|
||||
|
||||
There are several spaces you can explore to learn about specific information:
|
||||
- Announcements
|
||||
@ -35,8 +35,8 @@ There are several spaces you can explore to learn about specific information:
|
||||
|
||||
|
||||
There are several ways you can access the Community Center:
|
||||
- In the Windows Defender Security Center navigation pane, select **Community center**. A new browser tab opens and takes you to the Windows Defender ATP Tech Community page.
|
||||
- Access the community through the [Windows Defender Advanced Threat Protection Tech Community](https://techcommunity.microsoft.com/t5/Windows-Defender-Advanced-Threat/ct-p/WindowsDefenderAdvanced) page
|
||||
- In the Windows Defender Security Center navigation pane, select **Community center**. A new browser tab opens and takes you to the Microsoft Defender ATP Tech Community page.
|
||||
- Access the community through the [Microsoft Defender Advanced Threat Protection Tech Community](https://techcommunity.microsoft.com/t5/Windows-Defender-Advanced-Threat/ct-p/WindowsDefenderAdvanced) page
|
||||
|
||||
|
||||
You can instantly view and read conversations that have been posted in the community.
|
||||
|
||||
@ -20,11 +20,11 @@ ms.topic: article
|
||||
# Enable conditional access to better protect users, devices, and data
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-abovefoldlink)
|
||||
|
||||
Conditional access is a capability that helps you better protect your users and enterprise information by making sure that only secure devices have access to applications.
|
||||
|
||||
@ -32,7 +32,7 @@ With conditional access, you can control access to enterprise information based
|
||||
|
||||
You can define security conditions under which devices and applications can run and access information from your network by enforcing policies to stop applications from running until a device returns to a compliant state.
|
||||
|
||||
The implementation of conditional access in Windows Defender ATP is based on Microsoft Intune (Intune) device compliance policies and Azure Active Directory (Azure AD) conditional access policies.
|
||||
The implementation of conditional access in Microsoft Defender ATP is based on Microsoft Intune (Intune) device compliance policies and Azure Active Directory (Azure AD) conditional access policies.
|
||||
|
||||
The compliance policy is used with conditional access to allow only devices that fulfill one or more device compliance policy rules to access applications.
|
||||
|
||||
@ -62,15 +62,15 @@ When the risk is removed either through manual or automated remediation, the dev
|
||||
|
||||
The following example sequence of events explains conditional access in action:
|
||||
|
||||
1. A user opens a malicious file and Windows Defender ATP flags the device as high risk.
|
||||
1. A user opens a malicious file and Microsoft Defender ATP flags the device as high risk.
|
||||
2. The high risk assessment is passed along to Intune. In parallel, an automated investigation is initiated to remediate the identified threat. A manual remediation can also be done to remediate the identified threat.
|
||||
3. Based on the policy created in Intune, the device is marked as not compliant. The assessment is then communicated to Azure AD by the Intune conditional access policy. In Azure AD, the corresponding policy is applied to block access to applications.
|
||||
4. The manual or automated investigation and remediation is completed and the threat is removed. Windows Defender ATP sees that there is no risk on the device and Intune assesses the device to be in a compliant state. Azure AD applies the policy which allows access to applications.
|
||||
4. The manual or automated investigation and remediation is completed and the threat is removed. Microsoft Defender ATP sees that there is no risk on the device and Intune assesses the device to be in a compliant state. Azure AD applies the policy which allows access to applications.
|
||||
5. Users can now access applications.
|
||||
|
||||
|
||||
## Related topic
|
||||
- [Configure conditional access in Windows Defender ATP](configure-conditional-access-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure conditional access in Microsoft Defender ATP](configure-conditional-access-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure HP ArcSight to pull Windows Defender ATP alerts
|
||||
title: Configure HP ArcSight to pull Microsoft Defender ATP alerts
|
||||
description: Configure HP ArcSight to receive and pull alerts from Windows Defender Security Center
|
||||
keywords: configure hp arcsight, security information and events management tools, arcsight
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,25 +18,25 @@ ms.topic: article
|
||||
ms.date: 12/20/2018
|
||||
---
|
||||
|
||||
# Configure HP ArcSight to pull Windows Defender ATP alerts
|
||||
# Configure HP ArcSight to pull Microsoft Defender ATP alerts
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configurearcsight-abovefoldlink)
|
||||
|
||||
You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Windows Defender ATP alerts.
|
||||
You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Microsoft Defender ATP alerts.
|
||||
|
||||
## Before you begin
|
||||
Configuring the HP ArcSight Connector tool requires several configuration files for it to pull and parse alerts from your Azure Active Directory (AAD) application.
|
||||
|
||||
This section guides you in getting the necessary information to set and use the required configuration files correctly.
|
||||
|
||||
- Make sure you have enabled the SIEM integration feature from the **Settings** menu. For more information, see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md).
|
||||
- Make sure you have enabled the SIEM integration feature from the **Settings** menu. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
- Have the file you saved from enabling the SIEM integration feature ready. You'll need to get the following values:
|
||||
- OAuth 2.0 Token refresh URL
|
||||
@ -107,7 +107,7 @@ The following steps assume that you have completed all the required steps in [Be
|
||||
<td>Browse to the location of the *wdatp-connector.properties* file. The name must match the file provided in the .zip that you downloaded.</td>
|
||||
<tr>
|
||||
<td>Refresh Token</td>
|
||||
<td>You can obtain a refresh token in two ways: by generating a refresh token from the **SIEM settings** page or using the restutil tool. <br><br> For more information on generating a refresh token from the **Preferences setup** , see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md). </br> </br>**Get your refresh token using the restutil tool:** </br> a. Open a command prompt. Navigate to C:\\*folder_location*\current\bin where *folder_location* represents the location where you installed the tool. </br></br> b. Type: `arcsight restutil token -config` from the bin directory.For example: **arcsight restutil boxtoken -proxy proxy.location.hp.com:8080** A Web browser window will open. </br> </br>c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials. </br> </br>d. A refresh token is shown in the command prompt. </br></br> e. Copy and paste it into the **Refresh Token** field.
|
||||
<td>You can obtain a refresh token in two ways: by generating a refresh token from the **SIEM settings** page or using the restutil tool. <br><br> For more information on generating a refresh token from the **Preferences setup** , see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md). </br> </br>**Get your refresh token using the restutil tool:** </br> a. Open a command prompt. Navigate to C:\\*folder_location*\current\bin where *folder_location* represents the location where you installed the tool. </br></br> b. Type: `arcsight restutil token -config` from the bin directory.For example: **arcsight restutil boxtoken -proxy proxy.location.hp.com:8080** A Web browser window will open. </br> </br>c. Type in your credentials then click on the password field to let the page redirect. In the login prompt, enter your credentials. </br> </br>d. A refresh token is shown in the command prompt. </br></br> e. Copy and paste it into the **Refresh Token** field.
|
||||
</td>
|
||||
</tr>
|
||||
</tr>
|
||||
@ -160,11 +160,11 @@ If the `redirect_uri` is a https URL, you'll be redirected to a URL on the local
|
||||
|
||||
9. Navigate to **Active channel set** > **New Condition** > **Device** > **Device Product**.
|
||||
|
||||
10. Set **Device Product = Windows Defender ATP**. When you've verified that events are flowing to the tool, stop the process again and go to Windows Services and start the ArcSight FlexConnector REST.
|
||||
10. Set **Device Product = Microsoft Defender ATP**. When you've verified that events are flowing to the tool, stop the process again and go to Windows Services and start the ArcSight FlexConnector REST.
|
||||
|
||||
You can now run queries in the HP ArcSight console.
|
||||
|
||||
Windows Defender ATP alerts will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name.
|
||||
Microsoft Defender ATP alerts will appear as discrete events, with "Microsoft” as the vendor and “Windows Defender ATP” as the device name.
|
||||
|
||||
|
||||
## Troubleshooting HP ArcSight connection
|
||||
@ -187,7 +187,7 @@ Windows Defender ATP alerts will appear as discrete events, with "Microsoft” a
|
||||
> Verify that the connector is running by stopping the process again. Then start the connector again, and no browser window should appear.
|
||||
|
||||
## Related topics
|
||||
- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure conditional access in Windows Defender ATP
|
||||
title: Configure conditional access in Microsoft Defender ATP
|
||||
description:
|
||||
keywords:
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,9 +18,9 @@ ms.topic: article
|
||||
ms.date: 09/03/2018
|
||||
---
|
||||
|
||||
# Configure conditional access in Windows Defender ATP
|
||||
# Configure conditional access in Microsoft Defender ATP
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
This section guides you through all the steps you need to take to properly implement conditional access.
|
||||
|
||||
@ -45,7 +45,7 @@ There are steps you'll need to take in Windows Defender Security Center, the Int
|
||||
|
||||
Take the following steps to enable conditional access:
|
||||
- Step 1: Turn on the Microsoft Intune connection from Windows Defender Security Center
|
||||
- Step 2: Turn on the Windows Defender ATP integration in Intune
|
||||
- Step 2: Turn on the Microsoft Defender ATP integration in Intune
|
||||
- Step 3: Create the compliance policy in Intune
|
||||
- Step 4: Assign the policy
|
||||
- Step 5: Create an Azure AD conditional access policy
|
||||
@ -57,10 +57,10 @@ Take the following steps to enable conditional access:
|
||||
3. Click **Save preferences**.
|
||||
|
||||
|
||||
### Step 2: Turn on the Windows Defender ATP integration in Intune
|
||||
### Step 2: Turn on the Microsoft Defender ATP integration in Intune
|
||||
1. Sign in to the [Azure portal](https://portal.azure.com).
|
||||
2. Select **Device compliance** > **Windows Defender ATP**.
|
||||
3. Set **Connect Windows 10.0.15063+ devices to Windows Defender Advanced Threat Protection** to **On**.
|
||||
2. Select **Device compliance** > **Microsoft Defender ATP**.
|
||||
3. Set **Connect Windows 10.0.15063+ devices to Microsoft Defender Advanced Threat Protection** to **On**.
|
||||
4. Click **Save**.
|
||||
|
||||
|
||||
@ -80,7 +80,7 @@ Take the following steps to enable conditional access:
|
||||
|
||||
### Step 4: Assign the policy
|
||||
1. In the [Azure portal](https://portal.azure.com), select **All services**, filter on **Intune**, and select **Microsoft Intune**.
|
||||
2. Select **Device compliance** > **Policies**> select your Windows Defender ATP compliance policy.
|
||||
2. Select **Device compliance** > **Policies**> select your Microsoft Defender ATP compliance policy.
|
||||
3. Select **Assignments**.
|
||||
4. Include or exclude your Azure AD groups to assign them the policy.
|
||||
5. To deploy the policy to the groups, select **Save**. The user devices targeted by the policy are evaluated for compliance.
|
||||
@ -96,6 +96,6 @@ Take the following steps to enable conditional access:
|
||||
|
||||
6. Select **Enable policy**, and then **Create** to save your changes.
|
||||
|
||||
For more information, see [Enable Windows Defender ATP with conditional access in Intune](https://docs.microsoft.com/intune/advanced-threat-protection).
|
||||
For more information, see [Enable Microsoft Defender ATP with conditional access in Intune](https://docs.microsoft.com/intune/advanced-threat-protection).
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-conditionalaccess-belowfoldlink)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure alert notifications in Windows Defender ATP
|
||||
description: Send email notifications to specified recipients to receive new alerts based on severity with Windows Defender ATP on Windows 10 Enterprise, Pro, and Education editions.
|
||||
title: Configure alert notifications in Microsoft Defender ATP
|
||||
description: Send email notifications to specified recipients to receive new alerts based on severity with Microsoft Defender ATP on Windows 10 Enterprise, Pro, and Education editions.
|
||||
keywords: email notifications, configure alert notifications, windows defender atp notifications, windows defender atp alerts, windows 10 enterprise, windows 10 education
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,15 +18,15 @@ ms.topic: article
|
||||
ms.date: 10/08/2018
|
||||
---
|
||||
|
||||
# Configure alert notifications in Windows Defender ATP
|
||||
# Configure alert notifications in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-emailconfig-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-emailconfig-abovefoldlink)
|
||||
|
||||
You can configure Windows Defender ATP to send email notifications to specified recipients for new alerts. This feature enables you to identify a group of individuals who will immediately be informed and can act on alerts based on their severity.
|
||||
You can configure Microsoft Defender ATP to send email notifications to specified recipients for new alerts. This feature enables you to identify a group of individuals who will immediately be informed and can act on alerts based on their severity.
|
||||
|
||||
> [!NOTE]
|
||||
> Only users with 'Manage security settings' permissions can configure email notifications. If you've chosen to use basic permissions management, users with Security Administrator or Global Administrator roles can configure email notifications.
|
||||
@ -55,7 +55,7 @@ You can create rules that determine the machines and alert severities to send em
|
||||
- **Include machine information** - Includes the machine name in the email alert body.
|
||||
|
||||
>[!NOTE]
|
||||
> This information might be processed by recipient mail servers that ar not in the geographic location you have selected for your Windows Defender ATP data.
|
||||
> This information might be processed by recipient mail servers that ar not in the geographic location you have selected for your Microsoft Defender ATP data.
|
||||
|
||||
- **Machines** - Choose whether to notify recipients for alerts on all machines (Global administrator role only) or on selected machine groups. For more information, see [Create and manage machine groups](machine-groups-windows-defender-advanced-threat-protection.md).
|
||||
- **Alert severity** - Choose the alert severity level.
|
||||
@ -94,12 +94,12 @@ This section lists various issues that you may encounter when using email notifi
|
||||
|
||||
**Solution:** Make sure that the notifications are not blocked by email filters:
|
||||
|
||||
1. Check that the Windows Defender ATP email notifications are not sent to the Junk Email folder. Mark them as Not junk.
|
||||
2. Check that your email security product is not blocking the email notifications from Windows Defender ATP.
|
||||
3. Check your email application rules that might be catching and moving your Windows Defender ATP email notifications.
|
||||
1. Check that the Microsoft Defender ATP email notifications are not sent to the Junk Email folder. Mark them as Not junk.
|
||||
2. Check that your email security product is not blocking the email notifications from Microsoft Defender ATP.
|
||||
3. Check your email application rules that might be catching and moving your Microsoft Defender ATP email notifications.
|
||||
|
||||
## Related topics
|
||||
- [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable and create Power BI reports using Microsoft Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable Secure Score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard Windows 10 machines using Group Policy to Windows Defender ATP
|
||||
title: Onboard Windows 10 machines using Group Policy to Microsoft Defender ATP
|
||||
description: Use Group Policy to deploy the configuration package on Windows 10 machines so that they are onboarded to the service.
|
||||
keywords: configure machines using group policy, machine management, configure Windows ATP machines, onboard Windows Defender Advanced Threat Protection machines, group policy
|
||||
keywords: configure machines using group policy, machine management, configure Windows ATP machines, onboard Microsoft Defender Advanced Threat Protection machines, group policy
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -24,12 +24,12 @@ ms.date: 04/24/2018
|
||||
|
||||
- Group Policy
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsgp-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsgp-abovefoldlink)
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
@ -63,9 +63,9 @@ ms.date: 04/24/2018
|
||||
9. Click **OK** and close any open GPMC windows.
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that the machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that the machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
## Additional Windows Defender ATP configuration settings
|
||||
## Additional Microsoft Defender ATP configuration settings
|
||||
For each machine, you can state whether samples can be collected from the machine when a request is made through Windows Defender Security Center to submit a file for deep analysis.
|
||||
|
||||
You can use Group Policy (GP) to configure settings, such as settings for the sample sharing used in the deep analysis feature.
|
||||
@ -84,7 +84,7 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa
|
||||
|
||||
4. Click **Policies**, then **Administrative templates**.
|
||||
|
||||
5. Click **Windows components** and then **Windows Defender ATP**.
|
||||
5. Click **Windows components** and then **Microsoft Defender ATP**.
|
||||
|
||||
6. Choose to enable or disable sample sharing from your machines.
|
||||
|
||||
@ -145,5 +145,5 @@ With Group Policy there isn’t an option to monitor deployment of policies on t
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machines](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Microsoft Defender ATP machines](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard Windows 10 machines using Mobile Device Management tools
|
||||
description: Use Mobile Device Management tools to deploy the configuration package on machines so that they are onboarded to the service.
|
||||
keywords: onboard machines using mdm, machine management, onboard Windows ATP machines, onboard Windows Defender Advanced Threat Protection machines, mdm
|
||||
keywords: onboard machines using mdm, machine management, onboard Windows ATP machines, onboard Microsoft Defender Advanced Threat Protection machines, mdm
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -23,13 +23,13 @@ ms.date: 12/06/2018
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink)
|
||||
|
||||
You can use mobile device management (MDM) solutions to configure machines. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage machines.
|
||||
You can use mobile device management (MDM) solutions to configure machines. Microsoft Defender ATP supports MDMs by providing OMA-URIs to create policies to manage machines.
|
||||
|
||||
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
For more information on using Microsoft Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
|
||||
## Before you begin
|
||||
If you're using Microsoft Intune, you must have the device MDM Enrolled. Otherwise, settings will not be applied successfully.
|
||||
@ -40,7 +40,7 @@ For more information on enabling MDM with Microsoft Intune, see [Setup Windows D
|
||||
|
||||
Follow the instructions from [Intune](https://docs.microsoft.com/intune/advanced-threat-protection).
|
||||
|
||||
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
For more information on using Microsoft Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
@ -49,7 +49,7 @@ For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThre
|
||||
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that a machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that a machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
## Offboard and monitor machines using Mobile Device Management tools
|
||||
For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to a machine will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
@ -83,5 +83,5 @@ For security reasons, the package used to Offboard machines will expire 30 days
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard non-Windows machines to the Windows Defender ATP service
|
||||
description: Configure non-Winodws machines so that they can send sensor data to the Windows Defender ATP service.
|
||||
keywords: onboard non-Windows machines, macos, linux, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines
|
||||
title: Onboard non-Windows machines to the Microsoft Defender ATP service
|
||||
description: Configure non-Winodws machines so that they can send sensor data to the Microsoft Defender ATP service.
|
||||
keywords: onboard non-Windows machines, macos, linux, machine management, configure Windows ATP machines, configure Microsoft Defender Advanced Threat Protection machines
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -22,15 +22,15 @@ ms.topic: article
|
||||
|
||||
- macOS
|
||||
- Linux
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-nonwindows-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-nonwindows-abovefoldlink)
|
||||
|
||||
|
||||
|
||||
Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Windows Defender Security Center and better protect your organization's network. This experience leverages on a third-party security products’ sensor data.
|
||||
Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Windows Defender Security Center and better protect your organization's network. This experience leverages on a third-party security products’ sensor data.
|
||||
|
||||
You'll need to know the exact Linux distros and macOS versions that are compatible with Windows Defender ATP for the integration to work.
|
||||
You'll need to know the exact Linux distros and macOS versions that are compatible with Microsoft Defender ATP for the integration to work.
|
||||
|
||||
You'll need to take the following steps to onboard non-Windows machines:
|
||||
1. Turn on third-party integration
|
||||
@ -55,7 +55,7 @@ You'll need to take the following steps to onboard non-Windows machines:
|
||||
### Run detection test
|
||||
Create an EICAR test file by saving the string displayed on the portal in an empty text file. Then, introduce the test file to a machine running the third-party antivirus solution.
|
||||
|
||||
The file should trigger a detection and a corresponding alert on Windows Defender ATP.
|
||||
The file should trigger a detection and a corresponding alert on Microsoft Defender ATP.
|
||||
|
||||
## Offboard non-Windows machines
|
||||
To effectively offboard the machine from the service, you'll need to disable the data push on the third-party portal first then switch the toggle to off in Windows Defender Security Center. The toggle in the portal only blocks the data inbound flow.
|
||||
@ -74,4 +74,4 @@ To effectively offboard the machine from the service, you'll need to disable the
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshooting Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshooting Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard Windows 10 machines using System Center Configuration Manager
|
||||
description: Use System Center Configuration Manager to deploy the configuration package on machines so that they are onboarded to the service.
|
||||
keywords: onboard machines using sccm, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines, sccm
|
||||
keywords: onboard machines using sccm, machine management, configure Windows ATP machines, configure Microsoft Defender Advanced Threat Protection machines, sccm
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -23,16 +23,16 @@ ms.date: 12/11/2018
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- System Center 2012 Configuration Manager or later versions
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointssccm-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointssccm-abovefoldlink)
|
||||
|
||||
<span id="sccm1606"/>
|
||||
## Onboard Windows 10 machines using System Center Configuration Manager (current branch) version 1606
|
||||
System Center Configuration Manager (SCCM) (current branch) version 1606, has UI integrated support for configuring and managing Windows Defender ATP on machines. For more information, see [Support for Windows Defender Advanced Threat Protection service](https://go.microsoft.com/fwlink/p/?linkid=823682).
|
||||
System Center Configuration Manager (SCCM) (current branch) version 1606, has UI integrated support for configuring and managing Microsoft Defender ATP on machines. For more information, see [Support for Microsoft Defender Advanced Threat Protection service](https://go.microsoft.com/fwlink/p/?linkid=823682).
|
||||
|
||||
>[!NOTE]
|
||||
> If you’re using SCCM client version 1606 with server version 1610 or above, you must upgrade the client version to match the server version.
|
||||
@ -66,10 +66,10 @@ You can use existing System Center Configuration Manager functionality to create
|
||||
a. Choose a predefined device collection to deploy the package to.
|
||||
|
||||
> [!NOTE]
|
||||
> Windows Defender ATP doesn't support onboarding during the [Out-Of-Box Experience (OOBE)](https://answers.microsoft.com/en-us/windows/wiki/windows_10/how-to-complete-the-windows-10-out-of-box/47e3f943-f000-45e3-8c5c-9d85a1a0cf87) phase. Make sure users complete OOBE after running Windows installation or upgrading.
|
||||
> Microsoft Defender ATP doesn't support onboarding during the [Out-Of-Box Experience (OOBE)](https://answers.microsoft.com/en-us/windows/wiki/windows_10/how-to-complete-the-windows-10-out-of-box/47e3f943-f000-45e3-8c5c-9d85a1a0cf87) phase. Make sure users complete OOBE after running Windows installation or upgrading.
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
### Configure sample collection settings
|
||||
For each machine, you can set a configuration value to state whether samples can be collected from the machine when a request is made through Windows Defender Security Center to submit a file for deep analysis.
|
||||
@ -128,7 +128,7 @@ Monitoring with SCCM consists of two parts:
|
||||
|
||||
1. Confirming the configuration package has been correctly deployed and is running (or has successfully run) on the machines in your network.
|
||||
|
||||
2. Checking that the machines are compliant with the Windows Defender ATP service (this ensures the machine can complete the onboarding process and can continue to report data to the service).
|
||||
2. Checking that the machines are compliant with the Microsoft Defender ATP service (this ensures the machine can complete the onboarding process and can continue to report data to the service).
|
||||
|
||||
**To confirm the configuration package has been correctly deployed:**
|
||||
|
||||
@ -140,11 +140,11 @@ Monitoring with SCCM consists of two parts:
|
||||
|
||||
4. Review the status indicators under **Completion Statistics** and **Content Status**.
|
||||
|
||||
If there are failed deployments (machines with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the machines. For more information see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
|
||||
If there are failed deployments (machines with **Error**, **Requirements Not Met**, or **Failed statuses**), you may need to troubleshoot the machines. For more information see, [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
|
||||
|
||||
**Check that the machines are compliant with the Windows Defender ATP service:**<br>
|
||||
**Check that the machines are compliant with the Microsoft Defender ATP service:**<br>
|
||||
You can set a compliance rule for configuration item in System Center Configuration Manager to monitor your deployment.
|
||||
|
||||
This rule should be a *non-remediating* compliance rule configuration item that monitors the value of a registry key on targeted machines.
|
||||
@ -162,5 +162,5 @@ For more information about System Center Configuration Manager Compliance see [G
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard Windows 10 machines using a local script
|
||||
description: Use a local script to deploy the configuration package on machines so that they are onboarded to the service.
|
||||
keywords: configure machines using a local script, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines
|
||||
keywords: configure machines using a local script, machine management, configure Windows ATP machines, configure Microsoft Defender Advanced Threat Protection machines
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -22,14 +22,14 @@ ms.topic: article
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink)
|
||||
|
||||
You can also manually onboard individual machines to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all machines in your network.
|
||||
You can also manually onboard individual machines to Microsoft Defender ATP. You might want to do this first when testing the service before you commit to onboarding all machines in your network.
|
||||
|
||||
> [!NOTE]
|
||||
> The script has been optimized to be used on a limited number of machines (1-10 machines). To deploy to scale, use other deployment options. For more information on using other deployment options, see [Onboard Window 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
|
||||
@ -60,11 +60,11 @@ You can also manually onboard individual machines to Windows Defender ATP. You m
|
||||
|
||||
5. Press the **Enter** key or click **OK**.
|
||||
|
||||
For information on how you can manually validate that the machine is compliant and correctly reports sensor data see, [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
|
||||
For information on how you can manually validate that the machine is compliant and correctly reports sensor data see, [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that an machine is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
## Configure sample collection settings
|
||||
For each machine, you can set a configuration value to state whether samples can be collected from the machine when a request is made through Windows Defender Security Center to submit a file for deep analysis.
|
||||
@ -139,5 +139,5 @@ Monitoring can also be done directly on the portal, or by using the different de
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
description: Deploy the configuration package on virtual desktop infrastructure (VDI) machine so that they are onboarded to Windows Defender ATP the service.
|
||||
keywords: configure virtual desktop infrastructure (VDI) machine, vdi, machine management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
|
||||
description: Deploy the configuration package on virtual desktop infrastructure (VDI) machine so that they are onboarded to Microsoft Defender ATP the service.
|
||||
keywords: configure virtual desktop infrastructure (VDI) machine, vdi, machine management, configure Windows ATP endpoints, configure Microsoft Defender Advanced Threat Protection endpoints
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -25,15 +25,15 @@ ms.date: 04/24/2018
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configvdi-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configvdi-abovefoldlink)
|
||||
|
||||
## Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
|
||||
Windows Defender ATP supports non-persistent VDI session onboarding. There might be associated challenges when onboarding VDIs. The following are typical challenges for this scenario:
|
||||
Microsoft Defender ATP supports non-persistent VDI session onboarding. There might be associated challenges when onboarding VDIs. The following are typical challenges for this scenario:
|
||||
|
||||
|
||||
- Instant early onboarding of a short living session
|
||||
- A session should be onboarded to Windows Defender ATP prior to the actual provisioning.
|
||||
- A session should be onboarded to Microsoft Defender ATP prior to the actual provisioning.
|
||||
|
||||
- Machine name persistence
|
||||
- The machine names are typically reused for new sessions. One may ask to have them as a single machine entry while others may prefer to have multiple entries per machine name.
|
||||
@ -41,7 +41,7 @@ Windows Defender ATP supports non-persistent VDI session onboarding. There might
|
||||
You can onboard VDI machines using a single entry or multiple entries for each machine. The following steps will guide you through onboarding VDI machines and will highlight steps for single and multiple entries.
|
||||
|
||||
>[!WARNING]
|
||||
> For environments where there are low resource configurations, the VDI boot proceedure might slow the Windows Defender ATP sensor onboarding.
|
||||
> For environments where there are low resource configurations, the VDI boot proceedure might slow the Microsoft Defender ATP sensor onboarding.
|
||||
|
||||
1. Open the VDI configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from [Windows Defender Security Center](https://securitycenter.windows.com/):
|
||||
|
||||
@ -95,6 +95,6 @@ You can onboard VDI machines using a single entry or multiple entries for each m
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Onboard Windows 10 machines on Windows Defender ATP
|
||||
description: Onboard Windows 10 machines so that they can send sensor data to the Windows Defender ATP sensor
|
||||
title: Onboard Windows 10 machines on Microsoft Defender ATP
|
||||
description: Onboard Windows 10 machines so that they can send sensor data to the Microsoft Defender ATP sensor
|
||||
keywords: Onboard Windows 10 machines, group policy, system center configuration manager, mobile device management, local script, gp, sccm, mdm, intune
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -23,11 +23,11 @@ ms.date: 07/12/2018
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
Machines in your organization must be configured so that the Windows Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the machines in your organization.
|
||||
Machines in your organization must be configured so that the Microsoft Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the machines in your organization.
|
||||
|
||||
The following deployment tools and methods are supported:
|
||||
|
||||
@ -46,4 +46,4 @@ Topic | Description
|
||||
[Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) | Learn how to use the configuration package to configure VDI machines.
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpoints-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpoints-belowfoldlink)
|
||||
@ -21,18 +21,18 @@ ms.date: 02/28/2019
|
||||
# Configure and manage Microsoft Threat Experts capabilities
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease<73>information](prerelease.md)]
|
||||
|
||||
## Before you begin
|
||||
To experience the full Microsoft Threat Experts preview capability in Windows Defender ATP, you need to have a valid Premier customer service and support account. However, Premier charges will not be incurred during the preview.
|
||||
To experience the full Microsoft Threat Experts preview capability in Microsoft Defender ATP, you need to have a valid Premier customer service and support account. However, Premier charges will not be incurred during the preview.
|
||||
|
||||
You also need to ensure that you have Windows Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up.
|
||||
You also need to ensure that you have Microsoft Defender ATP deployed in your environment with machines enrolled, and not just on a laboratory set-up.
|
||||
|
||||
|
||||
## Register to Microsoft Threat Experts preview
|
||||
If you're already a Windows Defender ATP customer, you can apply for preview through the Windows Defender ATP portal.
|
||||
If you're already a Microsoft Defender ATP customer, you can apply for preview through the Microsoft Defender ATP portal.
|
||||
|
||||
1. From the navigation pane, go to **Settings > General > Advanced features > Threat Experts**.
|
||||
|
||||
@ -50,7 +50,7 @@ If you're already a Windows Defender ATP customer, you can apply for preview thr
|
||||
|
||||
## Receive targeted attack notification from Microsoft Threat Experts
|
||||
You can receive targeted attack notification from Microsoft Threat Experts through the following:
|
||||
- The Windows Defender ATP portal's **Alerts** dashboard
|
||||
- The Microsoft Defender ATP portal's **Alerts** dashboard
|
||||
- Your email, if you choose to configure it
|
||||
|
||||
To receive targeted attack notifications through email, you need to create an email notification rule.
|
||||
@ -83,13 +83,13 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w
|
||||
|
||||
**Step 2: Open a support ticket**
|
||||
>[!NOTE]
|
||||
>To experience the full Microsoft Threat Experts preview capability in Windows Defender ATP, you need to have a Premier customer service and support account. However, you will not be charged for the Experts-on-demand service during the preview.
|
||||
>To experience the full Microsoft Threat Experts preview capability in Microsoft Defender ATP, you need to have a Premier customer service and support account. However, you will not be charged for the Experts-on-demand service during the preview.
|
||||
|
||||
a. In the **New support request** customer support page, select the following from the dropdown menu and then click **Next**: <br>
|
||||
|
||||
**Select the product family**: **Security**<br>
|
||||
**Select a product**: **Microsoft Threat Experts**<br>
|
||||
**Select a category that best describes the issue**: **Windows Defender ATP**<br>
|
||||
**Select a category that best describes the issue**: **Microsoft Defender ATP**<br>
|
||||
**Select a problem that best describes the issue**: Choose according to your inquiry category<br>
|
||||
|
||||
b. Fill out the fields with the necessary information about the issue and use the auto-generated ID when you open a Customer Services and Support (CSS) ticket. Then, click **Next**. <br>
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure managed security service provider support
|
||||
description: Take the necessary steps to configure the MSSP integration with Windows Defender ATP
|
||||
description: Take the necessary steps to configure the MSSP integration with Microsoft Defender ATP
|
||||
keywords: managed security service provider, mssp, configure, integration
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -21,9 +21,9 @@ ms.date: 09/03/2018
|
||||
# Configure managed security service provider integration
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -39,7 +39,7 @@ The integration will allow MSSPs to take the following actions:
|
||||
- Get email notifications, and
|
||||
- Fetch alerts through security information and event management (SIEM) tools
|
||||
|
||||
Before MSSPs can take these actions, the MSSP customer will need to grant access to their Windows Defender ATP tenant so that the MSSP can access the portal.
|
||||
Before MSSPs can take these actions, the MSSP customer will need to grant access to their Microsoft Defender ATP tenant so that the MSSP can access the portal.
|
||||
|
||||
Typically, MSSP customers take the initial configuration steps to grant MSSPs access to their Windows Defender Security Central tenant. After access is granted, other configuration steps can be done by either the MSSP customer or the MSSP.
|
||||
|
||||
@ -47,7 +47,7 @@ Typically, MSSP customers take the initial configuration steps to grant MSSPs ac
|
||||
In general, the following configuration steps need to be taken:
|
||||
|
||||
- **Grant the MSSP access to Windows Defender Security Center** <br>
|
||||
This action needs to be done by the MSSP customer. It grants the MSSP access to the MSSP customer's Windows Defender ATP tenant.
|
||||
This action needs to be done by the MSSP customer. It grants the MSSP access to the MSSP customer's Microsoft Defender ATP tenant.
|
||||
|
||||
- **Configure alert notifications sent to MSSPs** <br>
|
||||
This action can be taken by either the MSSP customer or MSSP. This lets the MSSPs know what alerts they need to address for the MSSP customer.
|
||||
@ -85,7 +85,7 @@ Granting access to guest user is done the same way as granting access to a user
|
||||
|
||||
If you're using basic permissions to access the portal, the guest user must be assigned a Security Administrator role in **your** tenant. For more information, see [Use basic permissions to access the portal](basic-permissions-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
If you're using role-based access control (RBAC), the guest user must be to added to the appropriate group or groups in **your** tenant. Fore more information on RBAC in Windows Defender ATP, see [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md).
|
||||
If you're using role-based access control (RBAC), the guest user must be to added to the appropriate group or groups in **your** tenant. Fore more information on RBAC in Microsoft Defender ATP, see [Manage portal access using RBAC](rbac-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
>[!NOTE]
|
||||
>There is no difference between the Member user and Guest user roles from RBAC perspective.
|
||||
@ -147,7 +147,7 @@ Step 3: Whitelist your application on Windows Defender Security Center
|
||||
|
||||
|
||||
### Step 1: Create an application in Azure Active Directory (Azure AD)
|
||||
You'll need to create an application and grant it permissions to fetch alerts from your customer's Windows Defender ATP tenant.
|
||||
You'll need to create an application and grant it permissions to fetch alerts from your customer's Microsoft Defender ATP tenant.
|
||||
|
||||
1. Sign in to the [Azure AD portal](https://aad.portal.azure.com/).
|
||||
|
||||
@ -272,7 +272,7 @@ You'll need to have **Manage portal system settings** permission to whitelist th
|
||||
|
||||
5. Click **Authorize application**.
|
||||
|
||||
You can now download the relevant configuration file for your SIEM and connect to the Windows Defender ATP API. For more information see, [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md).
|
||||
You can now download the relevant configuration file for your SIEM and connect to the Microsoft Defender ATP API. For more information see, [Pull alerts to your SIEM tools](configure-siem-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
- In the ArcSight configuration file / Splunk Authentication Properties file you will have to write your application key manually by settings the secret value.
|
||||
- Instead of acquiring a refresh token in the portal, use the script from the previous step to acquire a refresh token (or acquire it by other means).
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure machine proxy and Internet connection settings
|
||||
description: Configure the Windows Defender ATP proxy and internet settings to enable communication with the cloud service.
|
||||
description: Configure the Microsoft Defender ATP proxy and internet settings to enable communication with the cloud service.
|
||||
keywords: configure, proxy, internet, internet connectivity, settings, proxy settings, netsh, winhttp, proxy server
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -21,15 +21,15 @@ ms.topic: article
|
||||
# Configure machine proxy and Internet connectivity settings
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink)
|
||||
|
||||
The Windows Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
The Microsoft Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Microsoft Defender ATP service.
|
||||
|
||||
The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service.
|
||||
The embedded Microsoft Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Microsoft Defender ATP cloud service.
|
||||
|
||||
The WinHTTP configuration setting is independent of the Windows Internet (WinINet) internet browsing proxy settings and can only discover a proxy server by using the following discovery methods:
|
||||
|
||||
@ -38,7 +38,7 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe
|
||||
- Web Proxy Auto-discovery Protocol (WPAD)
|
||||
|
||||
> [!NOTE]
|
||||
> If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Windows Defender ATP URL exclusions in the proxy, see [Enable access to Windows Defender ATP service URLs in the proxy server](#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server).
|
||||
> If you're using Transparent proxy or WPAD in your network topology, you don't need special configuration settings. For more information on Microsoft Defender ATP URL exclusions in the proxy, see [Enable access to Microsoft Defender ATP service URLs in the proxy server](#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server).
|
||||
|
||||
|
||||
- Manual static proxy configuration:
|
||||
@ -46,7 +46,7 @@ The WinHTTP configuration setting is independent of the Windows Internet (WinINe
|
||||
- WinHTTP configured using netsh command – Suitable only for desktops in a stable topology (for example: a desktop in a corporate network behind the same proxy)
|
||||
|
||||
## Configure the proxy server manually using a registry-based static proxy
|
||||
Configure a registry-based static proxy to allow only Windows Defender ATP sensor to report diagnostic data and communicate with Windows Defender ATP services if a computer is not be permitted to connect to the Internet.
|
||||
Configure a registry-based static proxy to allow only Microsoft Defender ATP sensor to report diagnostic data and communicate with Microsoft Defender ATP services if a computer is not be permitted to connect to the Internet.
|
||||
|
||||
The static proxy is configurable through Group Policy (GP). The group policy can be found under:
|
||||
- Administrative Templates > Windows Components > Data Collection and Preview Builds > Configure Authenticated Proxy usage for the Connected User Experience and Telemetry Service
|
||||
@ -87,8 +87,8 @@ netsh winhttp set proxy <proxy>:<port>
|
||||
```
|
||||
For example: netsh winhttp set proxy 10.0.0.6:8080
|
||||
|
||||
## Enable access to Windows Defender ATP service URLs in the proxy server
|
||||
If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are not blocked by default. Do not disable security monitoring or inspection of these URLs, but allow them as you would other internet traffic. They permit communication with Windows Defender ATP service in port 80 and 443:
|
||||
## Enable access to Microsoft Defender ATP service URLs in the proxy server
|
||||
If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are not blocked by default. Do not disable security monitoring or inspection of these URLs, but allow them as you would other internet traffic. They permit communication with Microsoft Defender ATP service in port 80 and 443:
|
||||
|
||||
>[!NOTE]
|
||||
> URLs that include v20 in them are only needed if you have Windows 10, version 1803 or later machines. For example, ```us-v20.events.data.microsoft.com``` is only needed if the machine is on Windows 10, version 1803 or later.
|
||||
@ -102,12 +102,12 @@ United States | ```us.vortex-win.data.microsoft.com```<br> ```us-v20.events.data
|
||||
|
||||
|
||||
|
||||
If a proxy or firewall is blocking anonymous traffic, as Windows Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs.
|
||||
If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the previously listed URLs.
|
||||
|
||||
## Windows Defender ATP service backend IP range
|
||||
## Microsoft Defender ATP service backend IP range
|
||||
If you network devices don't support the URLs white-listed in the prior section, you can use the following information.
|
||||
|
||||
Windows Defender ATP is built on Azure cloud, deployed in the following regions:
|
||||
Microsoft Defender ATP is built on Azure cloud, deployed in the following regions:
|
||||
|
||||
- \+\<Region Name="uswestcentral">
|
||||
- \+\<Region Name="useast2">
|
||||
@ -124,11 +124,11 @@ You can find the Azure IP range on [Microsoft Azure Datacenter IP Ranges](https:
|
||||
> As a cloud-based solution, the IP range can change. It's recommended you move to DNS resolving setting.
|
||||
|
||||
|
||||
## Verify client connectivity to Windows Defender ATP service URLs
|
||||
## Verify client connectivity to Microsoft Defender ATP service URLs
|
||||
|
||||
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs.
|
||||
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Microsoft Defender ATP service URLs.
|
||||
|
||||
1. Download the [connectivity verification tool](https://go.microsoft.com/fwlink/p/?linkid=823683) to the PC where Windows Defender ATP sensor is running on.
|
||||
1. Download the [connectivity verification tool](https://go.microsoft.com/fwlink/p/?linkid=823683) to the PC where Microsoft Defender ATP sensor is running on.
|
||||
|
||||
2. Extract the contents of WDATPConnectivityAnalyzer on the machine.
|
||||
|
||||
@ -151,7 +151,7 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover
|
||||
5. Extract the *WDATPConnectivityAnalyzerResult.zip* file created by tool in the folder used in the *HardDrivePath*.
|
||||
|
||||
6. Open *WDATPConnectivityAnalyzer.txt* and verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs. <br><br>
|
||||
The tool checks the connectivity of Windows Defender ATP service URLs that Windows Defender ATP client is configured to interact with. It then prints the results into the *WDATPConnectivityAnalyzer.txt* file for each URL that can potentially be used to communicate with the Windows Defender ATP services. For example:
|
||||
The tool checks the connectivity of Microsoft Defender ATP service URLs that Microsoft Defender ATP client is configured to interact with. It then prints the results into the *WDATPConnectivityAnalyzer.txt* file for each URL that can potentially be used to communicate with the Microsoft Defender ATP services. For example:
|
||||
```text
|
||||
Testing URL : https://xxx.microsoft.com/xxx
|
||||
1 - Default proxy: Succeeded (200)
|
||||
@ -161,13 +161,13 @@ The tool checks the connectivity of Windows Defender ATP service URLs that Windo
|
||||
5 - Command line proxy: Doesn't exist
|
||||
```
|
||||
|
||||
If at least one of the connectivity options returns a (200) status, then the Windows Defender ATP client can communicate with the tested URL properly using this connectivity method. <br><br>
|
||||
If at least one of the connectivity options returns a (200) status, then the Microsoft Defender ATP client can communicate with the tested URL properly using this connectivity method. <br><br>
|
||||
|
||||
However, if the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Windows Defender ATP service URLs in the proxy server](#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server). The URLs you'll use will depend on the region selected during the onboarding procedure.
|
||||
However, if the connectivity check results indicate a failure, an HTTP error is displayed (see HTTP Status Codes). You can then use the URLs in the table shown in [Enable access to Microsoft Defender ATP service URLs in the proxy server](#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server). The URLs you'll use will depend on the region selected during the onboarding procedure.
|
||||
|
||||
> [!NOTE]
|
||||
> When the TelemetryProxyServer is set, in Registry or via Group Policy, Windows Defender ATP will fall back to direct if it can't access the defined proxy.
|
||||
> When the TelemetryProxyServer is set, in Registry or via Group Policy, Microsoft Defender ATP will fall back to direct if it can't access the defined proxy.
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard servers to the Windows Defender ATP service
|
||||
description: Onboard servers so that they can send sensor data to the Windows Defender ATP sensor.
|
||||
keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, machine management, configure Windows ATP servers, onboard Windows Defender Advanced Threat Protection servers
|
||||
title: Onboard servers to the Microsoft Defender ATP service
|
||||
description: Onboard servers so that they can send sensor data to the Microsoft Defender ATP sensor.
|
||||
keywords: onboard server, server, 2012r2, 2016, 2019, server onboarding, machine management, configure Windows ATP servers, onboard Microsoft Defender Advanced Threat Protection servers
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -16,7 +16,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Onboard servers to the Windows Defender ATP service
|
||||
# Onboard servers to the Microsoft Defender ATP service
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -24,14 +24,14 @@ ms.topic: article
|
||||
- Windows Server 2016
|
||||
- Windows Server, version 1803
|
||||
- Windows Server, 2019
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
|
||||
|
||||
Windows Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console.
|
||||
Microsoft Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console.
|
||||
|
||||
The service supports the onboarding of the following servers:
|
||||
- Windows Server 2012 R2
|
||||
@ -40,11 +40,11 @@ The service supports the onboarding of the following servers:
|
||||
- Windows Server 2019
|
||||
|
||||
|
||||
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Windows Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
|
||||
For a practical guidance on what needs to be in place for licensing and infrastructure, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/What-s-New/Protecting-Windows-Server-with-Windows-Defender-ATP/m-p/267114#M128).
|
||||
|
||||
## Windows Server 2012 R2 and Windows Server 2016
|
||||
|
||||
There are two options to onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP:
|
||||
There are two options to onboard Windows Server 2012 R2 and Windows Server 2016 to Microsoft Defender ATP:
|
||||
|
||||
- **Option 1**: Onboard through Azure Security Center
|
||||
- **Option 2**: Onboard through Windows Defender Security Center
|
||||
@ -56,7 +56,7 @@ There are two options to onboard Windows Server 2012 R2 and Windows Server 2016
|
||||
|
||||
3. Click **Onboard Servers in Azure Security Center**.
|
||||
|
||||
4. Follow the onboarding instructions in [Windows Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
4. Follow the onboarding instructions in [Microsoft Defender Advanced Threat Protection with Azure Security Center](https://docs.microsoft.com/azure/security-center/security-center-wdatp).
|
||||
|
||||
### Option 2: Onboard servers through Windows Defender Security Center
|
||||
You'll need to tak the following steps if you choose to onboard servers through Windows Defender Security Center.
|
||||
@ -67,16 +67,16 @@ You'll need to tak the following steps if you choose to onboard servers through
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
- Turn on server monitoring from Windows Defender Security Center.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through Multi Homing support. Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Azure Monitor (formerly known as Operations Management Suite (OMS)), simply attach the Microsoft Monitoring Agent (MMA) to report to your Microsoft Defender ATP workspace through Multi Homing support. Otherwise, install and configure MMA to report sensor data to Microsoft Defender ATP as instructed below. For more information, see [Collect log data with Azure Log Analytics agent](https://docs.microsoft.com/azure/azure-monitor/platform/log-analytics-agent).
|
||||
|
||||
>[!TIP]
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
> After onboarding the machine, you can choose to run a detection test to verify that it is properly onboarded to the service. For more information, see [Run a detection test on a newly onboarded Microsoft Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
### Configure and update System Center Endpoint Protection clients
|
||||
>[!IMPORTANT]
|
||||
>This step is required only if your organization uses System Center Endpoint Protection (SCEP) and you're onboarding Windows Server 2012 R2.
|
||||
|
||||
Windows Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
Microsoft Defender ATP integrates with System Center Endpoint Protection to provide visibility to malware detections and to stop propagation of an attack in your organization by banning potentially malicious files or suspected malware.
|
||||
|
||||
The following steps are required to enable this integration:
|
||||
- Install the [January 2017 anti-malware platform update for Endpoint Protection clients](https://support.microsoft.com/help/3209361/january-2017-anti-malware-platform-update-for-endpoint-protection-clie)
|
||||
@ -92,7 +92,7 @@ The following steps are required to enable this integration:
|
||||
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
|
||||
<span id="server-mma"/>
|
||||
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP
|
||||
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Microsoft Defender ATP
|
||||
|
||||
1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603).
|
||||
|
||||
@ -109,7 +109,7 @@ Once completed, you should see onboarded servers in the portal within an hour.
|
||||
### Configure server proxy and Internet connectivity settings
|
||||
|
||||
- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the [OMS Gateway](https://docs.microsoft.com/azure/log-analytics/log-analytics-oms-gateway).
|
||||
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service:
|
||||
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Microsoft Defender ATP service:
|
||||
|
||||
Agent Resource | Ports
|
||||
:---|:---
|
||||
@ -137,7 +137,7 @@ Supported tools include:
|
||||
|
||||
For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md). Support for Windows Server, version 1803 and Windows 2019 provides deeper insight into activities happening on the server, coverage for kernel and memory attack detection, and enables response actions on Windows Server endpoint as well.
|
||||
|
||||
1. Configure Windows Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
|
||||
1. Configure Microsoft Defender ATP onboarding settings on the server. For more information, see [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
2. If you’re running a third party antimalware solution, you'll need to apply the following Windows Defender AV passive mode settings and verify it was configured correctly:
|
||||
|
||||
@ -162,23 +162,23 @@ Supported tools include:
|
||||
|
||||
|
||||
## Integration with Azure Security Center
|
||||
Windows Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Windows Defender ATP to provide improved threat detection for Windows Servers.
|
||||
Microsoft Defender ATP integrates with Azure Security Center to provide a comprehensive server protection solution. With this integration Azure Security Center can leverage the power of Microsoft Defender ATP to provide improved threat detection for Windows Servers.
|
||||
|
||||
>[!NOTE]
|
||||
>You'll need to have the appropriate license to enable this feature.
|
||||
|
||||
The following capabilities are included in this integration:
|
||||
- Automated onboarding - Windows Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
|
||||
- Automated onboarding - Microsoft Defender ATP sensor is automatically enabled on Windows Servers that are onboarded to Azure Security Center. For more information on Azure Security Center onboarding, see [Onboarding to Azure Security Center Standard for enhanced security](https://docs.microsoft.com/azure/security-center/security-center-onboarding).
|
||||
|
||||
>[!NOTE]
|
||||
> Automated onboarding is only applicable for Windows Server 2012 R2 and Windows Server 2016.
|
||||
|
||||
- Servers monitored by Azure Security Center will also be available in Windows Defender ATP - Azure Security Center seamlessly connects to the Windows Defender ATP tenant, providing a single view across clients and servers. In addition, Windows Defender ATP alerts will be available in the Azure Security Center console.
|
||||
- Servers monitored by Azure Security Center will also be available in Microsoft Defender ATP - Azure Security Center seamlessly connects to the Microsoft Defender ATP tenant, providing a single view across clients and servers. In addition, Microsoft Defender ATP alerts will be available in the Azure Security Center console.
|
||||
- Server investigation - Azure Security Center customers can access Windows Defender Security Center to perform detailed investigation to uncover the scope of a potential breach
|
||||
|
||||
>[!IMPORTANT]
|
||||
>- When you use Azure Security Center to monitor servers, a Windows Defender ATP tenant is automatically created. The Windows Defender ATP data is stored in Europe by default.
|
||||
>- If you use Windows Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
|
||||
>- When you use Azure Security Center to monitor servers, a Microsoft Defender ATP tenant is automatically created. The Microsoft Defender ATP data is stored in Europe by default.
|
||||
>- If you use Microsoft Defender ATP before using Azure Security Center, your data will be stored in the location you specified when you created your tenant even if you integrate with Azure Security Center at a later time.
|
||||
|
||||
|
||||
|
||||
@ -187,26 +187,26 @@ You can offboard Windows Server, version 1803 and Windows 2019 in the same metho
|
||||
|
||||
For other server versions, you have two options to offboard servers from the service:
|
||||
- Uninstall the MMA agent
|
||||
- Remove the Windows Defender ATP workspace configuration
|
||||
- Remove the Microsoft Defender ATP workspace configuration
|
||||
|
||||
>[!NOTE]
|
||||
>Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
|
||||
### Uninstall servers by uinstalling the MMA agent
|
||||
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Windows Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Windows Defender ATP.
|
||||
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Microsoft Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Microsoft Defender ATP.
|
||||
For more information, see [To disable an agent](https://docs.microsoft.com/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).
|
||||
|
||||
### Remove the Windows Defender ATP workspace configuration
|
||||
### Remove the Microsoft Defender ATP workspace configuration
|
||||
To offboard the server, you can use either of the following methods:
|
||||
|
||||
- Remove the Windows Defender ATP workspace configuration from the MMA agent
|
||||
- Remove the Microsoft Defender ATP workspace configuration from the MMA agent
|
||||
- Run a PowerShell command to remove the configuration
|
||||
|
||||
#### Remove the Windows Defender ATP workspace configuration from the MMA agent
|
||||
#### Remove the Microsoft Defender ATP workspace configuration from the MMA agent
|
||||
|
||||
1. In the **Microsoft Monitoring Agent Properties**, select the **Azure Log Analytics (OMS)** tab.
|
||||
|
||||
2. Select the Windows Defender ATP workspace, and click **Remove**.
|
||||
2. Select the Microsoft Defender ATP workspace, and click **Remove**.
|
||||
|
||||
|
||||
|
||||
@ -234,5 +234,5 @@ To offboard the server, you can use either of the following methods:
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshooting Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Microsoft Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshooting Microsoft Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Pull alerts to your SIEM tools from Windows Defender Advanced Threat Protection
|
||||
title: Pull alerts to your SIEM tools from Microsoft Defender Advanced Threat Protection
|
||||
description: Learn how to use REST API and configure supported security information and events management tools to receive and pull alerts.
|
||||
keywords: configure siem, security information and events management tools, splunk, arcsight, custom indicators, rest api, alert definitions, indicators of compromise
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -22,42 +22,42 @@ ms.date: 10/16/2017
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
||||
|
||||
## Pull alerts using security information and events management (SIEM) tools
|
||||
Windows Defender ATP supports (SIEM) tools to pull alerts. Windows Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
|
||||
Microsoft Defender ATP supports (SIEM) tools to pull alerts. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
|
||||
|
||||
|
||||
Windows Defender ATP currently supports the following SIEM tools:
|
||||
Microsoft Defender ATP currently supports the following SIEM tools:
|
||||
|
||||
- Splunk
|
||||
- HP ArcSight
|
||||
|
||||
To use either of these supported SIEM tools you'll need to:
|
||||
|
||||
- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- Configure the supported SIEM tool:
|
||||
- [Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure HP ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
For more information on the list of fields exposed in the alerts API see, [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md).
|
||||
For more information on the list of fields exposed in the alerts API see, [Microsoft Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
|
||||
## Pull Windows Defender ATP alerts using REST API
|
||||
Windows Defender ATP supports the OAuth 2.0 protocol to pull alerts using REST API.
|
||||
## Pull Microsoft Defender ATP alerts using REST API
|
||||
Microsoft Defender ATP supports the OAuth 2.0 protocol to pull alerts using REST API.
|
||||
|
||||
For more information, see [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md).
|
||||
For more information, see [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
|
||||
## In this section
|
||||
|
||||
Topic | Description
|
||||
:---|:---
|
||||
[Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)| Learn about enabling the SIEM integration feature in the **Settings** page in the portal so that you can use and generate the required information to configure supported SIEM tools.
|
||||
[Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)| Learn about installing the REST API Modular Input app and other configuration settings to enable Splunk to pull Windows Defender ATP alerts.
|
||||
[Configure HP ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)| Learn about installing the HP ArcSight REST FlexConnector package and the files you need to configure ArcSight to pull Windows Defender ATP alerts.
|
||||
[Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) | Understand what data fields are exposed as part of the alerts API and how they map to Windows Defender Security Center.
|
||||
[Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) | Use the Client credentials OAuth 2.0 flow to pull alerts from Windows Defender ATP using REST API.
|
||||
[Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)| Learn about enabling the SIEM integration feature in the **Settings** page in the portal so that you can use and generate the required information to configure supported SIEM tools.
|
||||
[Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)| Learn about installing the REST API Modular Input app and other configuration settings to enable Splunk to pull Microsoft Defender ATP alerts.
|
||||
[Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)| Learn about installing the HP ArcSight REST FlexConnector package and the files you need to configure ArcSight to pull Microsoft Defender ATP alerts.
|
||||
[Microsoft Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md) | Understand what data fields are exposed as part of the alerts API and how they map to Windows Defender Security Center.
|
||||
[Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md) | Use the Client credentials OAuth 2.0 flow to pull alerts from Microsoft Defender ATP using REST API.
|
||||
[Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md) | Address issues you might encounter when using the SIEM integration feature.
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure Splunk to pull Windows Defender ATP alerts
|
||||
title: Configure Splunk to pull Microsoft Defender ATP alerts
|
||||
description: Configure Splunk to receive and pull alerts from Windows Defender Security Center.
|
||||
keywords: configure splunk, security information and events management tools, splunk
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,23 +18,23 @@ ms.topic: article
|
||||
ms.date: 10/16/2017
|
||||
---
|
||||
|
||||
# Configure Splunk to pull Windows Defender ATP alerts
|
||||
# Configure Splunk to pull Microsoft Defender ATP alerts
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresplunk-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configuresplunk-abovefoldlink)
|
||||
|
||||
You'll need to configure Splunk so that it can pull Windows Defender ATP alerts.
|
||||
You'll need to configure Splunk so that it can pull Microsoft Defender ATP alerts.
|
||||
|
||||
## Before you begin
|
||||
|
||||
- Install the [REST API Modular Input app](https://splunkbase.splunk.com/app/1546/) in Splunk.
|
||||
- Make sure you have enabled the **SIEM integration** feature from the **Settings** menu. For more information, see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- Make sure you have enabled the **SIEM integration** feature from the **Settings** menu. For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
- Have the details file you saved from enabling the **SIEM integration** feature ready. You'll need to get the following values:
|
||||
- OAuth 2 Token refresh URL
|
||||
@ -107,7 +107,7 @@ You'll need to configure Splunk so that it can pull Windows Defender ATP alerts.
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Polling Interval</td>
|
||||
<td>Number of seconds that Splunk will ping the Windows Defender ATP machine. Accepted values are in seconds.</td>
|
||||
<td>Number of seconds that Splunk will ping the Microsoft Defender ATP machine. Accepted values are in seconds.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Set sourcetype</td>
|
||||
@ -146,8 +146,8 @@ Use the solution explorer to view alerts in Splunk.
|
||||
>```source="rest://windows atp alerts" | spath | dedup _raw | table *```
|
||||
|
||||
## Related topics
|
||||
- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
- [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
- [Microsoft Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 12/08/2017
|
||||
# Create alert from event API
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
@ -29,7 +29,7 @@ ms.date: 12/08/2017
|
||||
Enables using event data, as obtained from the [Advanced Hunting](run-advanced-query-api.md) for creating a new alert entity.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Create custom detection rules in Windows Defender ATP
|
||||
title: Create custom detection rules in Microsoft Defender ATP
|
||||
description: Learn how to create custom detections rules based on advanced hunting queries
|
||||
keywords: create custom detections, detections, advanced hunting, hunt, detect, query
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -20,7 +20,7 @@ ms.topic: article
|
||||
|
||||
# Create custom detections rules
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
1. In the navigation pane, select **Advanced hunting**.
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Create custom alerts using the threat intelligence API
|
||||
description: Create your custom alert definitions and indicators of compromise in Windows Defender ATP using the available APIs in Windows Enterprise, Education, and Pro editions.
|
||||
description: Create your custom alert definitions and indicators of compromise in Microsoft Defender ATP using the available APIs in Windows Enterprise, Education, and Pro editions.
|
||||
keywords: alert definitions, indicators of compromise, threat intelligence, custom threat intelligence, rest api, api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -23,11 +23,11 @@ ms.date: 04/24/2018
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-customti-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-customti-abovefoldlink)
|
||||
|
||||
You can define custom alert definitions and indicators of compromise (IOC) using the threat intelligence API. Creating custom threat intelligence alerts allows you to generate specific alerts that are applicable to your organization.
|
||||
|
||||
@ -61,7 +61,7 @@ For this URL:
|
||||
Each tenant has a defined quota that limits the number of possible alert definitions, IOCs and another quota for IOCs of Action different than “equals” in the system. If you upload data beyond this quota, you'll encounter an HTTP error status code 507 (Insufficient Storage).
|
||||
|
||||
## Request an access token from the token issuing endpoint
|
||||
Windows Defender ATP Threat Intelligence API uses OAuth 2.0. In the context of Windows Defender ATP, the alert definitions are a protected resource. To issue tokens for ad-hoc, non-automatic operations you can use the **Settings** page and click the **Generate Token** button. However, if you’d like to create an automated client, you need to use the “Client Credentials Grant” flow. For more information, see the [OAuth 2.0 authorization framework](https://tools.ietf.org/html/rfc6749#section-4.4).
|
||||
Microsoft Defender ATP Threat Intelligence API uses OAuth 2.0. In the context of Microsoft Defender ATP, the alert definitions are a protected resource. To issue tokens for ad-hoc, non-automatic operations you can use the **Settings** page and click the **Generate Token** button. However, if you’d like to create an automated client, you need to use the “Client Credentials Grant” flow. For more information, see the [OAuth 2.0 authorization framework](https://tools.ietf.org/html/rfc6749#section-4.4).
|
||||
|
||||
For more information about the authorization flow, see [OAuth 2.0 authorization flow](https://docs.microsoft.com/azure/active-directory/develop/active-directory-protocols-oauth-code#oauth-20-authorization-flow).
|
||||
|
||||
@ -387,8 +387,8 @@ Upon a successful request the response will be HTTP 204.
|
||||
> As with all OData actions, this action is sending an HTTP POST request not DELETE.
|
||||
|
||||
|
||||
## Windows Defender ATP optional query parameters
|
||||
The Windows Defender ATP threat intelligence API provides several optional query parameters that you can use to specify and control the amount of data returned in a response. The threat intelligence API supports the following query options:
|
||||
## Microsoft Defender ATP optional query parameters
|
||||
The Microsoft Defender ATP threat intelligence API provides several optional query parameters that you can use to specify and control the amount of data returned in a response. The threat intelligence API supports the following query options:
|
||||
|
||||
Name | Value | Description
|
||||
:---|:---|:--
|
||||
@ -411,7 +411,7 @@ The following articles provide detailed code examples that demonstrate how to us
|
||||
|
||||
## Related topics
|
||||
- [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable the custom threat intelligence API in Microsoft Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md)
|
||||
- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md)
|
||||
- [Experiment with custom threat intelligence alerts](experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Update data retention settings for Windows Defender Advanced Threat Protection
|
||||
title: Update data retention settings for Microsoft Defender Advanced Threat Protection
|
||||
description: Update data retention settings by selecting between 30 days to 180 days.
|
||||
keywords: data, storage, settings, retention, update
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -17,18 +17,18 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
# Update data retention settings for Windows Defender ATP
|
||||
# Update data retention settings for Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-gensettings-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-gensettings-abovefoldlink)
|
||||
|
||||
During the onboarding process, a wizard takes you through the general settings of Windows Defender ATP. After onboarding, you might want to update the data retention settings.
|
||||
During the onboarding process, a wizard takes you through the general settings of Microsoft Defender ATP. After onboarding, you might want to update the data retention settings.
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Data rention**.
|
||||
|
||||
@ -42,7 +42,7 @@ During the onboarding process, a wizard takes you through the general settings o
|
||||
|
||||
## Related topics
|
||||
- [Update data retention settings](data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure alert notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure alert notifications in Microsoft Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable and create Power BI reports using Microsoft Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable Secure Score security controls](enable-secure-score-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Windows Defender ATP data storage and privacy
|
||||
description: Learn about how Windows Defender ATP handles privacy and data that it collects.
|
||||
keywords: Windows Defender ATP data storage and privacy, storage, privacy, licensing, geolocation, data retention, data
|
||||
title: Microsoft Defender ATP data storage and privacy
|
||||
description: Learn about how Microsoft Defender ATP handles privacy and data that it collects.
|
||||
keywords: Microsoft Defender ATP data storage and privacy, storage, privacy, licensing, geolocation, data retention, data
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -17,20 +17,20 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Windows Defender ATP data storage and privacy
|
||||
# Microsoft Defender ATP data storage and privacy
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
|
||||
|
||||
|
||||
|
||||
This section covers some of the most frequently asked questions regarding privacy and data handling for Windows Defender ATP.
|
||||
This section covers some of the most frequently asked questions regarding privacy and data handling for Microsoft Defender ATP.
|
||||
> [!NOTE]
|
||||
> This document explains the data storage and privacy details related to Windows Defender ATP. For more information related to Windows Defender ATP and other products and services like Windows Defender Antivirus and Windows 10, see [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=827576). See also [Windows 10 privacy FAQ](https://go.microsoft.com/fwlink/?linkid=827577) for more information.
|
||||
> This document explains the data storage and privacy details related to Microsoft Defender ATP. For more information related to Microsoft Defender ATP and other products and services like Windows Defender Antivirus and Windows 10, see [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=827576). See also [Windows 10 privacy FAQ](https://go.microsoft.com/fwlink/?linkid=827577) for more information.
|
||||
|
||||
## What data does Windows Defender ATP collect?
|
||||
## What data does Microsoft Defender ATP collect?
|
||||
|
||||
Windows Defender ATP will collect and store information from your configured machines in a customer dedicated and segregated tenant specific to the service for administration, tracking, and reporting purposes.
|
||||
Microsoft Defender ATP will collect and store information from your configured machines in a customer dedicated and segregated tenant specific to the service for administration, tracking, and reporting purposes.
|
||||
|
||||
Information collected includes file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as machine identifiers, names, and the operating system version).
|
||||
|
||||
@ -44,10 +44,10 @@ Microsoft uses this data to:
|
||||
Microsoft does not use your data for advertising or for any other purpose other than providing you the service.
|
||||
|
||||
## Data protection and encryption
|
||||
The Windows Defender ATP service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure.
|
||||
The Microsoft Defender ATP service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure.
|
||||
|
||||
|
||||
There are various aspects relevant to data protection that our service takes care of. Encryption is one of the most critical and it includes data encryption at rest, encryption in flight, and key management with Key Vault. For more information on other technologies used by the Windows Defender ATP service, see [Azure encryption overview](https://docs.microsoft.com/azure/security/security-azure-encryption-overview).
|
||||
There are various aspects relevant to data protection that our service takes care of. Encryption is one of the most critical and it includes data encryption at rest, encryption in flight, and key management with Key Vault. For more information on other technologies used by the Microsoft Defender ATP service, see [Azure encryption overview](https://docs.microsoft.com/azure/security/security-azure-encryption-overview).
|
||||
|
||||
In all scenarios, data is encrypted using 256-bit [AES encyption](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard) at the minimum.
|
||||
|
||||
@ -84,12 +84,12 @@ Your data will be kept and will be available to you while the licence is under g
|
||||
|
||||
|
||||
## Can Microsoft help us maintain regulatory compliance?
|
||||
Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Windows Defender ATP services against their own legal and regulatory requirements. Windows Defender ATP is ISO 27001 certified and has a roadmap for obtaining national, regional and industry-specific certifications.
|
||||
Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Microsoft Defender ATP services against their own legal and regulatory requirements. Microsoft Defender ATP is ISO 27001 certified and has a roadmap for obtaining national, regional and industry-specific certifications.
|
||||
|
||||
Windows Defender ATP for Government (soon to be in preview) is currently undergoing audit for achieving FedRAMP High accreditation as well as Provisional Authorization (PA) at Impact Levels 4 and 5.
|
||||
Microsoft Defender ATP for Government (soon to be in preview) is currently undergoing audit for achieving FedRAMP High accreditation as well as Provisional Authorization (PA) at Impact Levels 4 and 5.
|
||||
|
||||
By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run.
|
||||
|
||||
For more information on the Windows Defender ATP ISO certification reports, see [Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/compliance/iso-iec-27001).
|
||||
For more information on the Microsoft Defender ATP ISO certification reports, see [Microsoft Trust Center](https://www.microsoft.com/en-us/trustcenter/compliance/iso-iec-27001).
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-datastorage-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-datastorage-belowfoldlink)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Windows Defender Antivirus compatibility with Windows Defender ATP
|
||||
description: Learn about how Windows Defender works with Windows Defender ATP and how it functions when a third-party antimalware client is used.
|
||||
title: Windows Defender Antivirus compatibility with Microsoft Defender ATP
|
||||
description: Learn about how Windows Defender works with Microsoft Defender ATP and how it functions when a third-party antimalware client is used.
|
||||
keywords: windows defender compatibility, defender, windows defender atp
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,24 +18,24 @@ ms.topic: conceptual
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
# Windows Defender Antivirus compatibility with Windows Defender ATP
|
||||
# Windows Defender Antivirus compatibility with Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- Windows Defender
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-defendercompat-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-defendercompat-abovefoldlink)
|
||||
|
||||
The Windows Defender Advanced Threat Protection agent depends on Windows Defender Antivirus for some capabilities such as file scanning.
|
||||
The Microsoft Defender Advanced Threat Protection agent depends on Windows Defender Antivirus for some capabilities such as file scanning.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>Windows Defender ATP does not adhere to the Windows Defender Antivirus Exclusions settings.
|
||||
>Microsoft Defender ATP does not adhere to the Windows Defender Antivirus Exclusions settings.
|
||||
|
||||
You must configure Security intelligence updates on the Windows Defender ATP machines whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md).
|
||||
You must configure Security intelligence updates on the Microsoft Defender ATP machines whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md).
|
||||
|
||||
If an onboarded machine is protected by a third-party antimalware client, Windows Defender Antivirus on that endpoint will enter into passive mode.
|
||||
|
||||
@ -43,4 +43,4 @@ Windows Defender Antivirus will continue to receive updates, and the *mspeng.exe
|
||||
|
||||
The Windows Defender Antivirus interface will be disabled, and users on the machine will not be able to use Windows Defender Antivirus to perform on-demand scans or configure most options.
|
||||
|
||||
For more information, see the [Windows Defender Antivirus and Windows Defender ATP compatibility topic](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
|
||||
For more information, see the [Windows Defender Antivirus and Microsoft Defender ATP compatibility topic](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
|
||||
|
||||
@ -19,7 +19,7 @@ ms.topic: article
|
||||
# Delete Indicator API
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
|
||||
@ -4,4 +4,4 @@ ms.date: 10/17/2018
|
||||
>[!WARNING]
|
||||
|
||||
|
||||
> This page documents a feature that will soon be deprecated. For the updated and supported version, see [Use the Windows Defender ATP APIs](use-apis.md).
|
||||
> This page documents a feature that will soon be deprecated. For the updated and supported version, see [Use the Microsoft Defender ATP APIs](use-apis.md).
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Enable the custom threat intelligence API in Windows Defender ATP
|
||||
description: Learn how to setup the custom threat intelligence application in Windows Defender ATP to create custom threat intelligence (TI).
|
||||
title: Enable the custom threat intelligence API in Microsoft Defender ATP
|
||||
description: Learn how to setup the custom threat intelligence application in Microsoft Defender ATP to create custom threat intelligence (TI).
|
||||
keywords: enable custom threat intelligence application, custom ti application, application name, client id, authorization url, resource, client secret, access tokens
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,16 +18,16 @@ ms.topic: article
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
# Enable the custom threat intelligence API in Windows Defender ATP
|
||||
# Enable the custom threat intelligence API in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-enablecustomti-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-enablecustomti-abovefoldlink)
|
||||
|
||||
Before you can create custom threat intelligence (TI) using REST API, you'll need to set up the custom threat intelligence application through Windows Defender Security Center.
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Enable Secure Score in Windows Defender ATP
|
||||
title: Enable Secure Score in Microsoft Defender ATP
|
||||
description: Set the baselines for calculating the score of Windows Defender security controls on the Secure Score dashboard.
|
||||
keywords: enable secure score, baseline, calculation, analytics, score, secure score dashboard, dashboard
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -23,7 +23,7 @@ ms.date: 04/24/2018
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
@ -40,7 +40,7 @@ Set the baselines for calculating the score of Windows Defender security control
|
||||
|
||||
## Related topics
|
||||
- [View the Secure Score dashboard](secure-score-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
- [Update data retention settings for Windows Defender ATP](data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure alert notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable and create Power BI reports using Windows Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure advanced features in Windows Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md)
|
||||
- [Update data retention settings for Microsoft Defender ATP](data-retention-settings-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure alert notifications in Microsoft Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable and create Power BI reports using Microsoft Defender ATP data](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure advanced features in Microsoft Defender ATP](advanced-features-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Enable SIEM integration in Windows Defender ATP
|
||||
title: Enable SIEM integration in Microsoft Defender ATP
|
||||
description: Enable SIEM integration to receive alerts in your security information and event management (SIEM) solution.
|
||||
keywords: enable siem connector, siem, connector, security information and events
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,13 +18,13 @@ ms.topic: article
|
||||
ms.date: 12/10/2018
|
||||
---
|
||||
|
||||
# Enable SIEM integration in Windows Defender ATP
|
||||
# Enable SIEM integration in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-enablesiem-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-enablesiem-abovefoldlink)
|
||||
|
||||
Enable security information and event management (SIEM) integration so you can pull alerts from Windows Defender Security Center using your SIEM solution or by connecting directly to the alerts REST API.
|
||||
|
||||
@ -66,12 +66,12 @@ Enable security information and event management (SIEM) integration so you can p
|
||||
|
||||
You can now proceed with configuring your SIEM solution or connecting to the alerts REST API through programmatic access. You'll need to use the tokens when configuring your SIEM solution to allow it to receive alerts from Windows Defender Security Center.
|
||||
|
||||
## Integrate Windows Defender ATP with IBM QRadar
|
||||
You can configure IBM QRadar to collect alerts from Windows Defender ATP. For more information, see [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/c_dsm_guide_MS_Win_Defender_ATP_overview.html?cp=SS42VS_7.3.1).
|
||||
## Integrate Microsoft Defender ATP with IBM QRadar
|
||||
You can configure IBM QRadar to collect alerts from Microsoft Defender ATP. For more information, see [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/c_dsm_guide_MS_Win_Defender_ATP_overview.html?cp=SS42VS_7.3.1).
|
||||
|
||||
## Related topics
|
||||
- [Configure Splunk to pull Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure HP ArcSight to pull Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
- [Windows Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull Windows Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure Splunk to pull Microsoft Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure HP ArcSight to pull Microsoft Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
|
||||
- [Microsoft Defender ATP alert API fields](api-portal-mapping-windows-defender-advanced-threat-protection.md)
|
||||
- [Pull Microsoft Defender ATP alerts using REST API](pull-alerts-using-rest-api-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Evaluate Windows Defender Advanced Threat Protection
|
||||
title: Evaluate Microsoft Defender Advanced Threat Protection
|
||||
description:
|
||||
keywords:
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,12 +18,12 @@ ms.topic: conceptual
|
||||
ms.date: 08/10/2018
|
||||
---
|
||||
|
||||
# Evaluate Windows Defender ATP
|
||||
[Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) is a unified platform for preventative protection, post-breach detection, automated investigation, and response.
|
||||
# Evaluate Microsoft Defender ATP
|
||||
[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) is a unified platform for preventative protection, post-breach detection, automated investigation, and response.
|
||||
|
||||
You can evaluate Windows Defender Advanced Threat Protection in your organization by [starting your free trial](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp).
|
||||
You can evaluate Microsoft Defender Advanced Threat Protection in your organization by [starting your free trial](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp).
|
||||
|
||||
You can also evaluate the different security capabilities in Windows Defender ATP by using the following instructions.
|
||||
You can also evaluate the different security capabilities in Microsoft Defender ATP by using the following instructions.
|
||||
|
||||
## Evaluate attack surface reduction
|
||||
These capabilities help prevent attacks and exploitations from infecting your organization.
|
||||
@ -40,4 +40,4 @@ Next gen protections help detect and block the latest threats.
|
||||
|
||||
|
||||
## See Also
|
||||
[Get started with Windows Defender Advanced Threat Protection](get-started.md)
|
||||
[Get started with Microsoft Defender Advanced Threat Protection](get-started.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Review events and errors using Event Viewer
|
||||
description: Get descriptions and further troubleshooting steps (if required) for all events reported by the Windows Defender ATP service.
|
||||
keywords: troubleshoot, event viewer, log summary, failure code, failed, Windows Defender Advanced Threat Protection service, cannot start, broken, can't start
|
||||
description: Get descriptions and further troubleshooting steps (if required) for all events reported by the Microsoft Defender ATP service.
|
||||
keywords: troubleshoot, event viewer, log summary, failure code, failed, Microsoft Defender Advanced Threat Protection service, cannot start, broken, can't start
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
@ -25,7 +25,7 @@ ms.date: 05/21/2018
|
||||
|
||||
- Event Viewer
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
@ -34,9 +34,9 @@ You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/librar
|
||||
For example, if machines are not appearing in the **Machines list**, you might need to look for event IDs on the machines. You can then use this table to determine further troubleshooting steps.
|
||||
|
||||
> [!NOTE]
|
||||
> It can take several days for machines to begin reporting to the Windows Defender ATP service.
|
||||
> It can take several days for machines to begin reporting to the Microsoft Defender ATP service.
|
||||
|
||||
**Open Event Viewer and find the Windows Defender ATP service event log:**
|
||||
**Open Event Viewer and find the Microsoft Defender ATP service event log:**
|
||||
|
||||
1. Click **Start** on the Windows menu, type **Event Viewer**, and press **Enter**.
|
||||
|
||||
@ -46,7 +46,7 @@ For example, if machines are not appearing in the **Machines list**, you might n
|
||||
a. You can also access the log by expanding **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE** and click on **Operational**.
|
||||
|
||||
> [!NOTE]
|
||||
> SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP.
|
||||
> SENSE is the internal name used to refer to the behavioral sensor that powers Microsoft Defender ATP.
|
||||
|
||||
3. Events recorded by the service will appear in the log. See the following table for a list of events recorded by the service.
|
||||
|
||||
@ -60,39 +60,39 @@ For example, if machines are not appearing in the **Machines list**, you might n
|
||||
</tr>
|
||||
<tr>
|
||||
<td>1</td>
|
||||
<td>Windows Defender Advanced Threat Protection service started (Version ```variable```).</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service started (Version ```variable```).</td>
|
||||
<td>Occurs during system start up, shut down, and during onbboarding.</td>
|
||||
<td>Normal operating notification; no action required.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>2</td>
|
||||
<td>Windows Defender Advanced Threat Protection service shutdown.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service shutdown.</td>
|
||||
<td>Occurs when the machine is shut down or offboarded.</td>
|
||||
<td>Normal operating notification; no action required.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>3</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to start. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to start. Failure code: ```variable```.</td>
|
||||
<td>Service did not start.</td>
|
||||
<td>Review other messages to determine possible cause and troubleshooting steps.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>4</td>
|
||||
<td>Windows Defender Advanced Threat Protection service contacted the server at ```variable```.</td>
|
||||
<td>Variable = URL of the Windows Defender ATP processing servers.<br>
|
||||
<td>Microsoft Defender Advanced Threat Protection service contacted the server at ```variable```.</td>
|
||||
<td>Variable = URL of the Microsoft Defender ATP processing servers.<br>
|
||||
This URL will match that seen in the Firewall or network activity.</td>
|
||||
<td>Normal operating notification; no action required.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>5</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to connect to the server at ```variable```.</td>
|
||||
<td>Variable = URL of the Windows Defender ATP processing servers.<br>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to connect to the server at ```variable```.</td>
|
||||
<td>Variable = URL of the Microsoft Defender ATP processing servers.<br>
|
||||
The service could not contact the external processing servers at that URL.</td>
|
||||
<td>Check the connection to the URL. See [Configure proxy and Internet connectivity](configure-proxy-internet-windows-defender-advanced-threat-protection.md).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>6</td>
|
||||
<td>Windows Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service is not onboarded and no onboarding parameters were found.</td>
|
||||
<td>The machine did not onboard correctly and will not be reporting to the portal.</td>
|
||||
<td>Onboarding must be run before starting the service.<br>
|
||||
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
@ -100,14 +100,14 @@ See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-
|
||||
</tr>
|
||||
<tr>
|
||||
<td>7</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to read the onboarding parameters. Failure: ```variable```.</td>
|
||||
<td>Variable = detailed error description. The machine did not onboard correctly and will not be reporting to the portal.</td>
|
||||
<td>Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>8</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to clean its configuration. Failure code: ```variable```.</td>
|
||||
<td>**During onboarding:** The service failed to clean its configuration during the onboarding. The onboarding process continues. <br><br> **During offboarding:** The service failed to clean its configuration during the offboarding. The offboarding process finished but the service keeps running.
|
||||
</td>
|
||||
<td>**Onboarding:** No action required. <br><br> **Offboarding:** Reboot the system.<br>
|
||||
@ -115,47 +115,47 @@ See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-
|
||||
</tr>
|
||||
<tr>
|
||||
<td>9</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to change its start type. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to change its start type. Failure code: ```variable```.</td>
|
||||
<td>**During onboarding:** The machine did not onboard correctly and will not be reporting to the portal. <br><br>**During offboarding:** Failed to change the service start type. The offboarding process continues. </td>
|
||||
<td>Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>10</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to persist the onboarding information. Failure code: ```variable```.</td>
|
||||
<td>The machine did not onboard correctly and will not be reporting to the portal.</td>
|
||||
<td>Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>11</td>
|
||||
<td>Onboarding or re-onboarding of Windows Defender Advanced Threat Protection service completed.</td>
|
||||
<td>Onboarding or re-onboarding of Microsoft Defender Advanced Threat Protection service completed.</td>
|
||||
<td>The machine onboarded correctly.</td>
|
||||
<td>Normal operating notification; no action required.<br>
|
||||
It may take several hours for the machine to appear in the portal.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>12</td>
|
||||
<td>Windows Defender Advanced Threat Protection failed to apply the default configuration.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection failed to apply the default configuration.</td>
|
||||
<td>Service was unable to apply the default configuration.</td>
|
||||
<td>This error should resolve after a short period of time.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>13</td>
|
||||
<td>Windows Defender Advanced Threat Protection machine ID calculated: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection machine ID calculated: ```variable```.</td>
|
||||
<td>Normal operating process.</td>
|
||||
<td>Normal operating notification; no action required.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>15</td>
|
||||
<td>Windows Defender Advanced Threat Protection cannot start command channel with URL: ```variable```.</td>
|
||||
<td>Variable = URL of the Windows Defender ATP processing servers.<br>
|
||||
<td>Microsoft Defender Advanced Threat Protection cannot start command channel with URL: ```variable```.</td>
|
||||
<td>Variable = URL of the Microsoft Defender ATP processing servers.<br>
|
||||
The service could not contact the external processing servers at that URL.</td>
|
||||
<td>Check the connection to the URL. See [Configure proxy and Internet connectivity](configure-proxy-internet-windows-defender-advanced-threat-protection.md).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>17</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to change the Connected User Experiences and Telemetry service location. Failure code: ```variable```.</td>
|
||||
<td>An error occurred with the Windows telemetry service.</td>
|
||||
<td>[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostics-service-is-enabled).<br>
|
||||
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
@ -182,7 +182,7 @@ If this error persists after a system restart, ensure all Windows updates have f
|
||||
</tr>
|
||||
<tr>
|
||||
<td>25</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to reset health status in the registry. Failure code: ```variable```.</td>
|
||||
<td>The machine did not onboard correctly.
|
||||
It will report to the portal, however the service may not appear as registered in SCCM or the registry.</td>
|
||||
<td>Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
@ -190,7 +190,7 @@ See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-
|
||||
</tr>
|
||||
<tr>
|
||||
<td>26</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to set the onboarding status in the registry. Failure code: ```variable```.</td>
|
||||
<td>The machine did not onboard correctly.<br>
|
||||
It will report to the portal, however the service may not appear as registered in SCCM or the registry.</td>
|
||||
<td>Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
@ -198,15 +198,15 @@ See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-
|
||||
</tr>
|
||||
<tr>
|
||||
<td>27</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender Antivirus. Onboarding process failed. Failure code: ```variable```.</td>
|
||||
<td>Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the machine, and the machine is reporting to Windows Defender ATP.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to enable SENSE aware mode in Windows Defender Antivirus. Onboarding process failed. Failure code: ```variable```.</td>
|
||||
<td>Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the machine, and the machine is reporting to Microsoft Defender ATP.</td>
|
||||
<td>Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md).<br>
|
||||
Ensure real-time antimalware protection is running properly.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>28</td>
|
||||
<td>Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration failed. Failure code: ```variable```.</td>
|
||||
<td>An error occurred with the Windows telemetry service.</td>
|
||||
<td>[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostic-data-service-is-enabled).<br>
|
||||
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
@ -220,34 +220,34 @@ See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-
|
||||
</tr>
|
||||
<tr>
|
||||
<td>30</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender Antivirus. Failure code: ```variable```.</td>
|
||||
<td>Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the machine, and the machine is reporting to Windows Defender ATP.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to disable SENSE aware mode in Windows Defender Antivirus. Failure code: ```variable```.</td>
|
||||
<td>Normally, Windows Defender Antivirus will enter a special passive state if another real-time antimalware product is running properly on the machine, and the machine is reporting to Microsoft Defender ATP.</td>
|
||||
<td>Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)<br>
|
||||
Ensure real-time antimalware protection is running properly.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>31</td>
|
||||
<td>Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection Connected User Experiences and Telemetry service unregistration failed. Failure code: ```variable```.</td>
|
||||
<td>An error occurred with the Windows telemetry service during onboarding. The offboarding process continues.</td>
|
||||
<td>[Check for errors with the Windows telemetry service](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostic-data-service-is-enabled).</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>32</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: %1</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to request to stop itself after offboarding process. Failure code: %1</td>
|
||||
<td>An error occurred during offboarding.</td>
|
||||
<td>Reboot the machine.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>33</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to persist SENSE GUID. Failure code: ```variable```.</td>
|
||||
<td>A unique identifier is used to represent each machine that is reporting to the portal.<br>
|
||||
If the identifier does not persist, the same machine might appear twice in the portal.</td>
|
||||
<td>Check registry permissions on the machine to ensure the service can update the registry.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>34</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to add itself as a dependency on the Connected User Experiences and Telemetry service, causing onboarding process to fail. Failure code: ```variable```.</td>
|
||||
<td>An error occurred with the Windows telemetry service.</td>
|
||||
<td>[Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostic-data-service-is-enabled).<br>
|
||||
Check that the onboarding settings and scripts were deployed properly. Try to redeploy the configuration packages.<br>
|
||||
@ -255,62 +255,62 @@ See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-
|
||||
</tr>
|
||||
<tr>
|
||||
<td>35</td>
|
||||
<td>Windows Defender Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection service failed to remove itself as a dependency on the Connected User Experiences and Telemetry service. Failure code: ```variable```.</td>
|
||||
<td>An error occurred with the Windows telemetry service during offboarding. The offboarding process continues.
|
||||
</td>
|
||||
<td>Check for errors with the Windows diagnostic data service.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>36</td>
|
||||
<td>Windows Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration succeeded. Completion code: ```variable```.</td>
|
||||
<td>Registering Windows Defender Advanced Threat Protection with the Connected User Experiences and Telemetry service completed successfully.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection Connected User Experiences and Telemetry service registration succeeded. Completion code: ```variable```.</td>
|
||||
<td>Registering Microsoft Defender Advanced Threat Protection with the Connected User Experiences and Telemetry service completed successfully.</td>
|
||||
<td>Normal operating notification; no action required.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>37</td>
|
||||
<td>Windows Defender Advanced Threat Protection A module is about to exceed its quota. Module: %1, Quota: {%2} {%3}, Percentage of quota utilization: %4.</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection A module is about to exceed its quota. Module: %1, Quota: {%2} {%3}, Percentage of quota utilization: %4.</td>
|
||||
<td>The machine has almost used its allocated quota of the current 24-hour window. It’s about to be throttled.</td>
|
||||
<td>Normal operating notification; no action required.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>38</td>
|
||||
<td>Network connection is identified as low. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4.</td>
|
||||
<td>Network connection is identified as low. Microsoft Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4.</td>
|
||||
<td>The machine is using a metered/paid network and will be contacting the server less frequently.</td>
|
||||
<td>Normal operating notification; no action required.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>39</td>
|
||||
<td>Network connection is identified as normal. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4.</td>
|
||||
<td>Network connection is identified as normal. Microsoft Defender Advanced Threat Protection will contact the server every %1 minutes. Metered connection: %2, internet available: %3, free network available: %4.</td>
|
||||
<td>The machine is not using a metered/paid connection and will contact the server as usual.</td>
|
||||
<td>Normal operating notification; no action required.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>40</td>
|
||||
<td>Battery state is identified as low. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2.</td>
|
||||
<td>Battery state is identified as low. Microsoft Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2.</td>
|
||||
<td>The machine has low battery level and will contact the server less frequently.</td>
|
||||
<td>Normal operating notification; no action required.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>41</td>
|
||||
<td>Battery state is identified as normal. Windows Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2.</td>
|
||||
<td>Battery state is identified as normal. Microsoft Defender Advanced Threat Protection will contact the server every %1 minutes. Battery state: %2.</td>
|
||||
<td>The machine doesn’t have low battery level and will contact the server as usual.</td>
|
||||
<td>Normal operating notification; no action required.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>42</td>
|
||||
<td>Windows Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception message: %4</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception message: %4</td>
|
||||
<td>Internal error. The service failed to start.</td>
|
||||
<td>If this error persists, contact Support.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>43</td>
|
||||
<td>Windows Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception Error: %4, Exception message: %5</td>
|
||||
<td>Microsoft Defender Advanced Threat Protection WDATP component failed to perform action. Component: %1, Action: %2, Exception Type: %3, Exception Error: %4, Exception message: %5</td>
|
||||
<td>Internal error. The service failed to start.</td>
|
||||
<td>If this error persists, contact Support.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>44</td>
|
||||
<td>Offboarding of Windows Defender Advanced Threat Protection service completed.</td>
|
||||
<td>Offboarding of Microsoft Defender Advanced Threat Protection service completed.</td>
|
||||
<td>The service was offboarded.</td>
|
||||
<td>Normal operating notification; no action required.</td>
|
||||
</tr>
|
||||
@ -342,9 +342,9 @@ See [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-eventerrorcodes-belowfoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-eventerrorcodes-belowfoldlink)
|
||||
|
||||
## Related topics
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure machine proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender ATP](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Microsoft Defender ATP](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Experiment with custom threat intelligence alerts
|
||||
description: Use this end-to-end guide to start using the Windows Defender ATP threat intelligence API.
|
||||
description: Use this end-to-end guide to start using the Microsoft Defender ATP threat intelligence API.
|
||||
keywords: alert definitions, indicators of compromise, threat intelligence, custom threat intelligence, rest api, api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -23,13 +23,13 @@ ms.date: 11/09/2017
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-experimentcustomti-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-experimentcustomti-abovefoldlink)
|
||||
|
||||
With the Windows Defender ATP threat intelligence API, you can create custom threat intelligence alerts that can help you keep track of possible attack activities in your organization.
|
||||
With the Microsoft Defender ATP threat intelligence API, you can create custom threat intelligence alerts that can help you keep track of possible attack activities in your organization.
|
||||
|
||||
For more information about threat intelligence concepts, see [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
@ -47,7 +47,7 @@ This step will guide you in creating an alert definition and an IOC for a malici
|
||||
|
||||
1. Open a Windows PowerShell ISE.
|
||||
|
||||
2. Copy and paste the following PowerShell script. This script will upload a sample alert definition and IOC to Windows Defender ATP which you can use to generate an alert.
|
||||
2. Copy and paste the following PowerShell script. This script will upload a sample alert definition and IOC to Microsoft Defender ATP which you can use to generate an alert.
|
||||
|
||||
NOTE:
|
||||
Make sure you replace the authUrl, clientId, and clientSecret values with your details which you saved in when you enabled the threat intelligence application.
|
||||
@ -80,7 +80,7 @@ This step will guide you in creating an alert definition and an IOC for a malici
|
||||
$alertDefinitionPayload = @{
|
||||
"Name" = "Test Alert"
|
||||
"Severity" = "Medium"
|
||||
"InternalDescription" = "A test alert used to demonstrate the Windows Defender ATP TI API feature"
|
||||
"InternalDescription" = "A test alert used to demonstrate the Microsoft Defender ATP TI API feature"
|
||||
"Title" = "Test alert."
|
||||
"UxDescription" = "This is a test alert based on a sample custom alert definition. This alert was triggered manually using a provided test command. It indicates that the Threat Intelligence API has been properly enabled."
|
||||
"RecommendedAction" = "No recommended action for this test alert."
|
||||
@ -130,9 +130,9 @@ This step will guide you in creating an alert definition and an IOC for a malici
|
||||
~~~~
|
||||
|
||||
## Step 3: Simulate a custom TI alert
|
||||
This step will guide you in simulating an event in connection to a malicious IP that will trigger the Windows Defender ATP custom TI alert.
|
||||
This step will guide you in simulating an event in connection to a malicious IP that will trigger the Microsoft Defender ATP custom TI alert.
|
||||
|
||||
1. Open a Windows PowerShell ISE in the machine you onboarded to Windows Defender ATP.
|
||||
1. Open a Windows PowerShell ISE in the machine you onboarded to Microsoft Defender ATP.
|
||||
|
||||
2. Type `Invoke-WebRequest 52.184.197.12` in the editor and click **Run**. This call will generate a network communication event to a Microsoft's dedicated demo server that will raise an alert based on the custom alert definition.
|
||||
|
||||
@ -143,7 +143,7 @@ This step will guide you in exploring the custom alert in the portal.
|
||||
|
||||
1. Open [Windows Defender Security Center](http://securitycenter.windows.com/) on a browser.
|
||||
|
||||
2. Log in with your Windows Defender ATP credentials.
|
||||
2. Log in with your Microsoft Defender ATP credentials.
|
||||
|
||||
3. The dashboard should display the custom TI alert for the victim machine resulting from the simulated attack.
|
||||
|
||||
@ -154,7 +154,7 @@ This step will guide you in exploring the custom alert in the portal.
|
||||
|
||||
## Related topics
|
||||
- [Understand threat intelligence concepts](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable the custom threat intelligence API in Microsoft Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
- [Create custom alerts using the threat intelligence API](custom-ti-api-windows-defender-advanced-threat-protection.md)
|
||||
- [PowerShell code examples for the custom threat intelligence API](powershell-example-code-windows-defender-advanced-threat-protection.md)
|
||||
- [Python code examples for the custom threat intelligence API](python-example-code-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Use Windows Defender Advanced Threat Protection APIs
|
||||
title: Use Microsoft Defender Advanced Threat Protection APIs
|
||||
description: Use the exposed data and actions using a set of progammatic APIs that are part of the Microsoft Intelligence Security Graph.
|
||||
keywords: apis, graph api, supported apis, actor, alerts, machine, user, domain, ip, file, advanced hunting, query
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -17,33 +17,33 @@ ms.topic: article
|
||||
ms.date: 09/03/2018
|
||||
---
|
||||
|
||||
# Use Windows Defender ATP APIs
|
||||
# Use Microsoft Defender ATP APIs
|
||||
|
||||
**Applies to:** [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
|
||||
|
||||
> Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
|
||||
This page describes how to create an application to get programmatic access to Windows Defender ATP on behalf of a user.
|
||||
This page describes how to create an application to get programmatic access to Microsoft Defender ATP on behalf of a user.
|
||||
|
||||
If you need programmatic access Windows Defender ATP without a user, refer to [Access Windows Defender ATP with application context](exposed-apis-create-app-webapp.md).
|
||||
If you need programmatic access Microsoft Defender ATP without a user, refer to [Access Microsoft Defender ATP with application context](exposed-apis-create-app-webapp.md).
|
||||
|
||||
If you are not sure which access you need, read the [Introduction page](apis-intro.md).
|
||||
|
||||
Windows Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate work flows and innovate based on Windows Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
||||
Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will enable you to automate work flows and innovate based on Microsoft Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
||||
|
||||
In general, you’ll need to take the following steps to use the APIs:
|
||||
- Create an AAD application
|
||||
- Get an access token using this application
|
||||
- Use the token to access Windows Defender ATP API
|
||||
- Use the token to access Microsoft Defender ATP API
|
||||
|
||||
This page explains how to create an AAD application, get an access token to Windows Defender ATP and validate the token.
|
||||
This page explains how to create an AAD application, get an access token to Microsoft Defender ATP and validate the token.
|
||||
|
||||
>[!NOTE]
|
||||
> When accessing Windows Defender ATP API on behalf of a user, you will need the correct App permission and user permission.
|
||||
> If you are not familiar with user permissions on Windows Defender ATP, see [Manage portal access using role-based access control](rbac-windows-defender-advanced-threat-protection.md).
|
||||
> When accessing Microsoft Defender ATP API on behalf of a user, you will need the correct App permission and user permission.
|
||||
> If you are not familiar with user permissions on Microsoft Defender ATP, see [Manage portal access using role-based access control](rbac-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
>[!TIP]
|
||||
> If you have the permission to perform an action in the portal, you have the permission to perform the action in the API.
|
||||
@ -162,9 +162,9 @@ Sanity check to make sure you got a correct token:
|
||||
|
||||
|
||||
|
||||
## Use the token to access Windows Defender ATP API
|
||||
## Use the token to access Microsoft Defender ATP API
|
||||
|
||||
- Choose the API you want to use - [Supported Windows Defender ATP APIs](exposed-apis-list.md)
|
||||
- Choose the API you want to use - [Supported Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||
- Set the Authorization header in the HTTP request you send to "Bearer {token}" (Bearer is the Authorization scheme)
|
||||
- The Expiration time of the token is 1 hour (you can send more then one request with the same token)
|
||||
|
||||
@ -182,5 +182,5 @@ Sanity check to make sure you got a correct token:
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Windows Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Windows Defender ATP with application context](exposed-apis-create-app-webapp.md)
|
||||
- [Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Microsoft Defender ATP with application context](exposed-apis-create-app-webapp.md)
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Create an app to access Windows Defender ATP without a user
|
||||
title: Create an app to access Microsoft Defender ATP without a user
|
||||
description: Use the exposed data and actions using a set of progammatic APIs that are part of the Microsoft Intelligence Security Graph.
|
||||
keywords: apis, graph api, supported apis, actor, alerts, machine, user, domain, ip, file, advanced hunting, query
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -17,28 +17,28 @@ ms.topic: article
|
||||
ms.date: 09/03/2018
|
||||
---
|
||||
|
||||
# Create an app to access Windows Defender ATP without a user
|
||||
# Create an app to access Microsoft Defender ATP without a user
|
||||
|
||||
**Applies to:** [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
|
||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
|
||||
|
||||
> Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
This page describes how to create an application to get programmatic access to Windows Defender ATP without a user.
|
||||
This page describes how to create an application to get programmatic access to Microsoft Defender ATP without a user.
|
||||
|
||||
If you need programmatic access Windows Defender ATP on behalf of a user, see [Get access wtih user context](exposed-apis-create-app-nativeapp.md)
|
||||
If you need programmatic access Microsoft Defender ATP on behalf of a user, see [Get access wtih user context](exposed-apis-create-app-nativeapp.md)
|
||||
|
||||
If you are not sure which access you need, see [Get started](apis-intro.md).
|
||||
|
||||
Windows Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will help you automate workflows and innovate based on Windows Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
||||
Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will help you automate workflows and innovate based on Microsoft Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
||||
|
||||
In general, you’ll need to take the following steps to use the APIs:
|
||||
- Create an AAD application
|
||||
- Get an access token using this application
|
||||
- Use the token to access Windows Defender ATP API
|
||||
- Use the token to access Microsoft Defender ATP API
|
||||
|
||||
This page explains how to create an AAD application, get an access token to Windows Defender ATP and validate the token.
|
||||
This page explains how to create an AAD application, get an access token to Microsoft Defender ATP and validate the token.
|
||||
|
||||
## Create an app
|
||||
|
||||
@ -101,7 +101,7 @@ This page explains how to create an AAD application, get an access token to Wind
|
||||
|
||||
|
||||
|
||||
11. **For Windows Defender ATP Partners only** - Set your application to be multi-tenanted
|
||||
11. **For Microsoft Defender ATP Partners only** - Set your application to be multi-tenanted
|
||||
|
||||
This is **required** for 3rd party apps (for example, if you create an application that is intended to run in multiple customers tenant).
|
||||
|
||||
@ -113,7 +113,7 @@ This page explains how to create an AAD application, get an access token to Wind
|
||||
|
||||
- Application consent for your multi-tenant App:
|
||||
|
||||
You need your application to be approved in each tenant where you intend to use it. This is because your application interacts with Windows Defender ATP application on behalf of your customer.
|
||||
You need your application to be approved in each tenant where you intend to use it. This is because your application interacts with Microsoft Defender ATP application on behalf of your customer.
|
||||
|
||||
You (or your customer if you are writing a 3rd party application) need to click the consent link and approve your application. The consent should be done with a user who has admin privileges in the active directory.
|
||||
|
||||
@ -199,7 +199,7 @@ Refer to [Get token using Python](run-advanced-query-sample-python.md#get-token)
|
||||
- Open a command window
|
||||
- Set CLIENT_ID to your Azure application ID
|
||||
- Set CLIENT_SECRET to your Azure application secret
|
||||
- Set TENANT_ID to the Azure tenant ID of the customer that wants to use your application to access Windows Defender ATP application
|
||||
- Set TENANT_ID to the Azure tenant ID of the customer that wants to use your application to access Microsoft Defender ATP application
|
||||
- Run the below command:
|
||||
|
||||
```
|
||||
@ -217,13 +217,13 @@ You will get an answer of the form:
|
||||
Sanity check to make sure you got a correct token:
|
||||
- Copy/paste into [JWT](https://jwt.ms) the token you get in the previous step in order to decode it
|
||||
- Validate you get a 'roles' claim with the desired permissions
|
||||
- In the screenshot below you can see a decoded token acquired from an app with permissions to all of Windows Defender ATP's roles:
|
||||
- In the screenshot below you can see a decoded token acquired from an app with permissions to all of Microsoft Defender ATP's roles:
|
||||
|
||||
|
||||
|
||||
## Use the token to access Windows Defender ATP API
|
||||
## Use the token to access Microsoft Defender ATP API
|
||||
|
||||
- Choose the API you want to use, for more information, see [Supported Windows Defender ATP APIs](exposed-apis-list.md)
|
||||
- Choose the API you want to use, for more information, see [Supported Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||
- Set the Authorization header in the Http request you send to "Bearer {token}" (Bearer is the Authorization scheme)
|
||||
- The Expiration time of the token is 1 hour (you can send more then one request with the same token)
|
||||
|
||||
@ -241,5 +241,5 @@ Sanity check to make sure you got a correct token:
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [Supported Windows Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Windows Defender ATP on behalf of a user](exposed-apis-create-app-nativeapp.md)
|
||||
- [Supported Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||
- [Access Microsoft Defender ATP on behalf of a user](exposed-apis-create-app-nativeapp.md)
|
||||
@ -17,18 +17,18 @@ ms.topic: article
|
||||
ms.date: 09/24/2018
|
||||
---
|
||||
|
||||
# Windows Defender ATP APIs using PowerShell
|
||||
# Microsoft Defender ATP APIs using PowerShell
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
|
||||
Full scenario using multiple APIs from Windows Defender ATP.
|
||||
Full scenario using multiple APIs from Microsoft Defender ATP.
|
||||
|
||||
In this section we share PowerShell samples to
|
||||
- Retrieve a token
|
||||
- Use token to retrieve the latest alerts in Windows Defender ATP
|
||||
- Use token to retrieve the latest alerts in Microsoft Defender ATP
|
||||
- For each alert, if the alert has medium or high priority and is still in progress, check how many times the machine has connected to suspicious URL.
|
||||
|
||||
>**Prerequisite**: You first need to [create an app](apis-intro.md).
|
||||
@ -48,7 +48,7 @@ Set-ExecutionPolicy -ExecutionPolicy Bypass
|
||||
- Run the below
|
||||
|
||||
> - $tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant)
|
||||
> - $appId: ID of your AAD app (the app must have 'Run advanced queries' permission to Windows Defender ATP)
|
||||
> - $appId: ID of your AAD app (the app must have 'Run advanced queries' permission to Microsoft Defender ATP)
|
||||
> - $appSecret: Secret of your AAD app
|
||||
> - $suspiciousUrl: The URL
|
||||
|
||||
@ -116,7 +116,7 @@ $response
|
||||
|
||||
|
||||
## Related topic
|
||||
- [Windows Defender ATP APIs](apis-intro.md)
|
||||
- [Microsoft Defender ATP APIs](apis-intro.md)
|
||||
- [Advanced Hunting API](run-advanced-query-api.md)
|
||||
- [Advanced Hunting using Python](run-advanced-query-sample-python.md)
|
||||
- [Schedule Advanced Hunting](run-advanced-query-sample-ms-flow.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Supported Windows Defender Advanced Threat Protection query APIs
|
||||
description: Learn about the specific supported Windows Defender Advanced Threat Protection entities where you can create API calls to.
|
||||
title: Supported Microsoft Defender Advanced Threat Protection query APIs
|
||||
description: Learn about the specific supported Microsoft Defender Advanced Threat Protection entities where you can create API calls to.
|
||||
keywords: apis, supported apis, actor, alerts, machine, user, domain, ip, file, advanced queries, advanced hunting
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -16,14 +16,14 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Supported Windows Defender ATP query APIs
|
||||
# Supported Microsoft Defender ATP query APIs
|
||||
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-supportedapis-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-supportedapis-abovefoldlink)
|
||||
|
||||
## End Point URI and Versioning
|
||||
|
||||
@ -58,4 +58,4 @@ Machines | Run API calls such as find machine information by IP, get machines, g
|
||||
User | Run API calls such as get alert related user information, user information, user related alerts, and user related machines.
|
||||
|
||||
## Related topic
|
||||
- [Windows Defender ATP APIs](apis-intro.md)
|
||||
- [Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: OData queries with Windows Defender ATP
|
||||
description: OData queries with Windows Defender ATP
|
||||
title: OData queries with Microsoft Defender ATP
|
||||
description: OData queries with Microsoft Defender ATP
|
||||
keywords: apis, supported apis, odata, query
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -17,9 +17,9 @@ ms.topic: article
|
||||
ms.date: 11/15/2018
|
||||
---
|
||||
|
||||
# OData queries with Windows Defender ATP
|
||||
# OData queries with Microsoft Defender ATP
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -242,7 +242,7 @@ Content-type: application/json
|
||||
|
||||
### Example 6
|
||||
|
||||
- Get all the Anti-Virus scans that the user Analyst@examples.onmicrosoft.com created using Windows Defender ATP
|
||||
- Get all the Anti-Virus scans that the user Analyst@examples.onmicrosoft.com created using Microsoft Defender ATP
|
||||
|
||||
```
|
||||
HTTP GET https://api.securitycenter.windows.com/api/machineactions?$filter=requestor eq 'Analyst@WcdTestPrd.onmicrosoft.com' and type eq 'RunAntiVirusScan'
|
||||
@ -293,4 +293,4 @@ Content-type: application/json
|
||||
```
|
||||
|
||||
## Related topic
|
||||
- [Windows Defender ATP APIs](apis-intro.md)
|
||||
- [Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
@ -18,11 +18,11 @@ ms.topic: article
|
||||
|
||||
# File resource type
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Represent a file entity in Windows Defender ATP.
|
||||
Represent a file entity in Microsoft Defender ATP.
|
||||
|
||||
# Methods
|
||||
Method|Return Type |Description
|
||||
@ -50,5 +50,5 @@ fileProductName | String | Product name.
|
||||
signer | String | File signer.
|
||||
issuer | String | File issuer.
|
||||
signerHash | String | Hash of the signing certificate.
|
||||
isValidCertificate | Boolean | Was signing certificate successfully verified by Windows Defender ATP agent.
|
||||
isValidCertificate | Boolean | Was signing certificate successfully verified by Microsoft Defender ATP agent.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.date: 07/25/2018
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
|
||||
Find a machine by internal IP.
|
||||
@ -32,7 +32,7 @@ Find a machine by internal IP.
|
||||
>The timestamp must be within the last 30 days.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -21,7 +21,7 @@ ms.date: 12/08/2017
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -29,7 +29,7 @@ ms.date: 12/08/2017
|
||||
- The given timestamp must be in the past 30 days.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Fix unhealthy sensors in Windows Defender ATP
|
||||
title: Fix unhealthy sensors in Microsoft Defender ATP
|
||||
description: Fix machine sensors that are reporting as misconfigured or inactive so that the service receives data from the machine.
|
||||
keywords: misconfigured, inactive, fix sensor, sensor health, no sensor data, sensor data, impaired communications, communication
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,16 +18,16 @@ ms.topic: article
|
||||
ms.date: 10/23/2017
|
||||
---
|
||||
|
||||
# Fix unhealthy sensors in Windows Defender ATP
|
||||
# Fix unhealthy sensors in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-fixsensor-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-fixsensor-abovefoldlink)
|
||||
|
||||
Machines that are categorized as misconfigured or inactive can be flagged due to varying causes. This section provides some explanations as to what might have caused a machine to be categorized as inactive or misconfigured.
|
||||
|
||||
@ -39,14 +39,14 @@ An inactive machine is not necessarily flagged due to an issue. The following ac
|
||||
If the machine has not been in use for more than 7 days for any reason, it will remain in an ‘Inactive’ status in the portal.
|
||||
|
||||
**Machine was reinstalled or renamed**</br>
|
||||
A reinstalled or renamed machine will generate a new machine entity in Windows Defender Security Center. The previous machine entity will remain with an ‘Inactive’ status in the portal. If you reinstalled a machine and deployed the Windows Defender ATP package, search for the new machine name to verify that the machine is reporting normally.
|
||||
A reinstalled or renamed machine will generate a new machine entity in Windows Defender Security Center. The previous machine entity will remain with an ‘Inactive’ status in the portal. If you reinstalled a machine and deployed the Microsoft Defender ATP package, search for the new machine name to verify that the machine is reporting normally.
|
||||
|
||||
**Machine was offboarded**</br>
|
||||
If the machine was offboarded it will still appear in machines list. After 7 days, the machine health state should change to inactive.
|
||||
|
||||
|
||||
**Machine is not sending signals**
|
||||
If the machine is not sending any signals for more than 7 days to any of the Windows Defender ATP channels for any reason including conditions that fall under misconfigured machines classification, a machine can be considered inactive.
|
||||
If the machine is not sending any signals for more than 7 days to any of the Microsoft Defender ATP channels for any reason including conditions that fall under misconfigured machines classification, a machine can be considered inactive.
|
||||
|
||||
|
||||
Do you expect a machine to be in ‘Active’ status? [Open a support ticket ticket](https://support.microsoft.com/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636206786382823561).
|
||||
@ -62,10 +62,10 @@ This status indicates that there's limited communication between the machine and
|
||||
The following suggested actions can help fix issues related to a misconfigured machine with impaired communications:
|
||||
|
||||
- [Ensure the machine has Internet connection](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#troubleshoot-onboarding-issues-on-the-machine)</br>
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Microsoft Defender ATP service.
|
||||
|
||||
- [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls)</br>
|
||||
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs.
|
||||
- [Verify client connectivity to Microsoft Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls)</br>
|
||||
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Microsoft Defender ATP service URLs.
|
||||
|
||||
If you took corrective actions and the machine status is still misconfigured, [open a support ticket](https://go.microsoft.com/fwlink/?LinkID=761093&clcid=0x409).
|
||||
|
||||
@ -74,18 +74,18 @@ A misconfigured machine with status ‘No sensor data’ has communication with
|
||||
Follow theses actions to correct known issues related to a misconfigured machine with status ‘No sensor data’:
|
||||
|
||||
- [Ensure the machine has Internet connection](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#troubleshoot-onboarding-issues-on-the-machine)</br>
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Microsoft Defender ATP service.
|
||||
|
||||
- [Verify client connectivity to Windows Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls)</br>
|
||||
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Windows Defender ATP service URLs.
|
||||
- [Verify client connectivity to Microsoft Defender ATP service URLs](configure-proxy-internet-windows-defender-advanced-threat-protection.md#verify-client-connectivity-to-windows-defender-atp-service-urls)</br>
|
||||
Verify the proxy configuration completed successfully, that WinHTTP can discover and communicate through the proxy server in your environment, and that the proxy server allows traffic to the Microsoft Defender ATP service URLs.
|
||||
|
||||
- [Ensure the diagnostic data service is enabled](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-diagnostics-service-is-enabled)</br>
|
||||
If the machines aren't reporting correctly, you might need to check that the Windows 10 diagnostic data service is set to automatically start and is running on the endpoint.
|
||||
|
||||
- [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy)</br>
|
||||
If your machines are running a third-party antimalware client, the Windows Defender ATP agent needs the Windows Defender Antivirus Early Launch Antimalware (ELAM) driver to be enabled.
|
||||
If your machines are running a third-party antimalware client, the Microsoft Defender ATP agent needs the Windows Defender Antivirus Early Launch Antimalware (ELAM) driver to be enabled.
|
||||
|
||||
If you took corrective actions and the machine status is still misconfigured, [open a support ticket](https://go.microsoft.com/fwlink/?LinkID=761093&clcid=0x409).
|
||||
|
||||
## Related topic
|
||||
- [Check sensor health state in Windows Defender ATP](check-sensor-status-windows-defender-advanced-threat-protection.md)
|
||||
- [Check sensor health state in Microsoft Defender ATP](check-sensor-status-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -19,14 +19,14 @@ ms.date: 12/08/2017
|
||||
|
||||
# Get alert information by ID API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Retrieves an alert by its ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -19,14 +19,14 @@ ms.date: 12/08/2017
|
||||
|
||||
# Get alert related domain information API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Retrieves all domains related to a specific alert.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -19,14 +19,14 @@ ms.date: 12/08/2017
|
||||
|
||||
# Get alert related files information API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Retrieves all files related to a specific alert.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 12/08/2017
|
||||
|
||||
# Get alert related IP information API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -27,7 +27,7 @@ ms.date: 12/08/2017
|
||||
Retrieves all IPs related to a specific alert.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -20,14 +20,14 @@ ms.date: 12/08/2017
|
||||
# Get alert related machine information API
|
||||
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
- Retrieves machine that is related to a specific alert.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 12/08/2017
|
||||
|
||||
# Get alert related user information API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -27,7 +27,7 @@ ms.date: 12/08/2017
|
||||
Retrieves the user associated to a specific alert.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 12/08/2017
|
||||
|
||||
# List alerts API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
@ -28,10 +28,10 @@ ms.date: 12/08/2017
|
||||
- Retrieves a collection of Alerts.
|
||||
- Supports [OData V4 queries](https://www.odata.org/documentation/).
|
||||
- The OData's Filter query is supported on: "Id", "IncidentId", "AlertCreationTime", "Status", "Severity" and "Category".
|
||||
- See examples at [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md)
|
||||
- See examples at [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
@ -136,4 +136,4 @@ Here is an example of the response.
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md)
|
||||
- [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 10/07/2018
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Retrieves a map of CVE's to KB's and CVE details.
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 12/08/2017
|
||||
|
||||
# Get domain related alerts API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
@ -31,7 +31,7 @@ ms.date: 12/08/2017
|
||||
Retrieves a collection of alerts related to a given domain address.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -19,14 +19,14 @@ ms.date: 12/08/2017
|
||||
|
||||
# Get domain related machines API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Retrieves a collection of machines that have communicated to or from a given domain address.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 12/08/2017
|
||||
|
||||
# Get domain statistics API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
@ -27,7 +27,7 @@ ms.date: 12/08/2017
|
||||
Retrieves the prevalence for the given domain.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 12/08/2017
|
||||
# Get file information API
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -28,7 +28,7 @@ ms.date: 12/08/2017
|
||||
Retrieves a file by identifier Sha1, Sha256, or MD5.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 12/08/2017
|
||||
# Get file related alerts API
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
@ -29,7 +29,7 @@ ms.date: 12/08/2017
|
||||
Retrieves a collection of alerts related to a given file hash.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -21,14 +21,14 @@ ms.date: 12/08/2017
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
- Retrieves a collection of machines related to a given file hash.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 12/08/2017
|
||||
# Get file statistics API
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -31,7 +31,7 @@ ms.date: 12/08/2017
|
||||
Retrieves the prevalence for the given file.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -20,14 +20,14 @@ ms.date: 12/08/2017
|
||||
# Get IP related alerts API
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Retrieves a collection of alerts related to a given IP address.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -19,7 +19,7 @@ ms.date: 12/08/2017
|
||||
|
||||
# Get IP related machines API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -27,7 +27,7 @@ ms.date: 12/08/2017
|
||||
Retrieves a collection of machines that communicated with or from a particular IP.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -20,7 +20,7 @@ ms.date: 12/08/2017
|
||||
# Get IP statistics API
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
@ -29,7 +29,7 @@ ms.date: 12/08/2017
|
||||
Retrieves the prevalence for the given IP.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 10/07/2018
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Retrieves a collection of KB's and KB details.
|
||||
|
||||
|
||||
@ -21,14 +21,14 @@ ms.date: 12/08/2017
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
- Retrieves a machine entity by ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -23,11 +23,11 @@ ms.date: 12/08/2017
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
Retrieves a collection of logged on users.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -23,11 +23,11 @@ ms.date: 12/08/2017
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
Retrieves a collection of alerts related to a given machine ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -21,14 +21,14 @@ ms.date: 12/08/2017
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
- Get action performed on a machine.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -21,17 +21,17 @@ ms.date: 12/08/2017
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
- Gets collection of actions done on machines.
|
||||
- Get MachineAction collection API supports [OData V4 queries](https://www.odata.org/documentation/).
|
||||
- The OData's Filter query is supported on: "Id", "Status", "MachineId", "Type", "Requestor" and "CreationDateTimeUtc".
|
||||
- See examples at [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md)
|
||||
- See examples at [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
@ -175,4 +175,4 @@ Content-type: application/json
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md)
|
||||
- [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 10/07/2018
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Retrieves a collection of RBAC machine groups.
|
||||
|
||||
|
||||
@ -19,14 +19,14 @@ ms.topic: article
|
||||
# List machines API
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
- Retrieves a collection of machines that have communicated with Windows Defender ATP cloud on the last 30 days.
|
||||
- Retrieves a collection of machines that have communicated with Microsoft Defender ATP cloud on the last 30 days.
|
||||
- Get Machines collection API supports [OData V4 queries](https://www.odata.org/documentation/).
|
||||
- The OData's Filter query is supported on: "Id", "ComputerDnsName", "LastSeen", "LastIpAddress", "HealthStatus", "OsPlatform", "RiskScore", "MachineTags" and "RbacGroupId".
|
||||
- See examples at [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md)
|
||||
- See examples at [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)
|
||||
|
||||
## Permissions
|
||||
|
||||
@ -127,4 +127,4 @@ Content-type: application/json
|
||||
```
|
||||
|
||||
## Related topics
|
||||
- [OData queries with Windows Defender ATP](exposed-apis-odata-samples.md)
|
||||
- [OData queries with Microsoft Defender ATP](exposed-apis-odata-samples.md)
|
||||
|
||||
@ -22,7 +22,7 @@ ms.date: 10/07/2018
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
Retrieves a collection of machines security states.
|
||||
|
||||
|
||||
@ -19,14 +19,14 @@ ms.date: 12/08/2017
|
||||
|
||||
# Get package SAS URI API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Get a URI that allows downloading of an [investigation package](collect-investigation-package-windows-defender-advanced-threat-protection-new.md).
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get started with Windows Defender Advanced Threat Protection
|
||||
description: Learn about the minimum requirements and initial steps you need to take to get started with Windows Defender ATP.
|
||||
title: Get started with Microsoft Defender Advanced Threat Protection
|
||||
description: Learn about the minimum requirements and initial steps you need to take to get started with Microsoft Defender ATP.
|
||||
keywords: get started, minimum requirements, setup, subscription, features, data storage, privacy, user access
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -18,39 +18,39 @@ ms.topic: conceptual
|
||||
ms.date: 11/20/2018
|
||||
---
|
||||
|
||||
# Get started with Windows Defender Advanced Threat Protection
|
||||
# Get started with Microsoft Defender Advanced Threat Protection
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
>[!TIP]
|
||||
>- Learn about the latest enhancements in Windows Defender ATP: [What's new in Windows Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
|
||||
>- Windows Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
|
||||
>- Learn about the latest enhancements in Microsoft Defender ATP: [What's new in Microsoft Defender ATP](https://cloudblogs.microsoft.com/microsoftsecure/2018/11/15/whats-new-in-windows-defender-atp/).
|
||||
>- Microsoft Defender ATP demonstrated industry-leading optics and detection capabilities in the recent MITRE evaluation. Read: [Insights from the MITRE ATT&CK-based evaluation](https://cloudblogs.microsoft.com/microsoftsecure/2018/12/03/insights-from-the-mitre-attack-based-evaluation-of-windows-defender-atp/).
|
||||
|
||||
Learn about the minimum requirements and initial steps you need to take to get started with Windows Defender ATP.
|
||||
Learn about the minimum requirements and initial steps you need to take to get started with Microsoft Defender ATP.
|
||||
|
||||
The following capabilities are available across multiple products that make up the Windows Defender ATP platform.
|
||||
The following capabilities are available across multiple products that make up the Microsoft Defender ATP platform.
|
||||
|
||||
**Attack surface reduction**<br>
|
||||
The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations.
|
||||
|
||||
**Next generation protection**<br>
|
||||
To further reinforce the security perimeter of your network, Windows Defender ATP uses next generation protection designed to catch all types of emerging threats.
|
||||
To further reinforce the security perimeter of your network, Microsoft Defender ATP uses next generation protection designed to catch all types of emerging threats.
|
||||
|
||||
**Endpoint detection and response**<br>
|
||||
Endpoint detection and response capabilities are put in place to detect, investigate, and respond to advanced threats that may have made it past the first two security pillars.
|
||||
|
||||
**Auto investigation and remediation**<br>
|
||||
In conjunction with being able to quickly respond to advanced attacks, Windows Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
|
||||
In conjunction with being able to quickly respond to advanced attacks, Microsoft Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
|
||||
|
||||
**Secure score**<br>
|
||||
Windows Defender ATP provides a security posture capability to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security state of your network.
|
||||
Microsoft Defender ATP provides a security posture capability to help you dynamically assess the security state of your enterprise network, identify unprotected systems, and take recommended actions to improve the overall security state of your network.
|
||||
|
||||
**Advanced hunting**<br>
|
||||
Advanced hunting allows you to hunt for possible threats across your organization using a powerful search and query tool. You can also create custom detection rules based on the queries you created and surface alerts in Windows Defender Security Center.
|
||||
|
||||
**Management and APIs**<br>
|
||||
Integrate Windows Defender Advanced Threat Protection into your existing workflows.
|
||||
Integrate Microsoft Defender Advanced Threat Protection into your existing workflows.
|
||||
|
||||
**Microsoft threat protection**<br>
|
||||
Bring the power of Microsoft Threat Protection to your organization.
|
||||
@ -60,8 +60,8 @@ Topic | Description
|
||||
:---|:---
|
||||
[Minimum requirements](minimum-requirements-windows-defender-advanced-threat-protection.md) | Learn about the requirements for onboarding machines to the platform.
|
||||
[Validate licensing and complete setup](licensing-windows-defender-advanced-threat-protection.md) | Get guidance on how to check that licenses have been provisioned to your organization and how to access the portal for the first time.
|
||||
[Preview features](preview-windows-defender-advanced-threat-protection.md) | Learn about new features in the Windows Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience.
|
||||
[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) | Explains the data storage and privacy details related to Windows Defender ATP.
|
||||
[Preview features](preview-windows-defender-advanced-threat-protection.md) | Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience.
|
||||
[Data storage and privacy](data-storage-privacy-windows-defender-advanced-threat-protection.md) | Explains the data storage and privacy details related to Microsoft Defender ATP.
|
||||
[Assign user access to the portal](assign-portal-access-windows-defender-advanced-threat-protection.md) | Set permissions to manage who can access the portal. You can set basic permissions or set granular permissions using role-based access control (RBAC).
|
||||
[Evaluate Windows Defender ATP](evaluate-atp.md) | Evaluate the various capabilities in Windows Defender ATP and test features out.
|
||||
[Access the Windows Defender Security Center Community Center](community-windows-defender-advanced-threat-protection.md) | The Windows Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product.
|
||||
[Evaluate Microsoft Defender ATP](evaluate-atp.md) | Evaluate the various capabilities in Microsoft Defender ATP and test features out.
|
||||
[Access the Windows Defender Security Center Community Center](community-windows-defender-advanced-threat-protection.md) | The Microsoft Defender ATP Community Center is a place where community members can learn, collaborate, and share experiences about the product.
|
||||
@ -20,7 +20,7 @@ ms.date: 12/08/2017
|
||||
# List Indicators API
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
|
||||
@ -18,14 +18,14 @@ ms.topic: article
|
||||
|
||||
# Get user information API
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Retrieve a User entity by key (user name).
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -19,14 +19,14 @@ ms.date: 12/08/2017
|
||||
|
||||
# Get user related alerts API
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Retrieves a collection of alerts related to a given user ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -20,14 +20,14 @@ ms.date: 12/08/2017
|
||||
# Get user related machines API
|
||||
|
||||
**Applies to:**
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Retrieves a collection of machines related to a given user ID.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Incidents queue in Windows Defender ATP
|
||||
title: Incidents queue in Microsoft Defender ATP
|
||||
description:
|
||||
keywords: incidents, aggregate, investigations, queue, ttp
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -17,14 +17,14 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Incidents in Windows Defender ATP
|
||||
# Incidents in Microsoft Defender ATP
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
When a cybersecurity threat is emerging, or a potential attacker is deploying its tactics, techniques/tools, and procedures (TTPs) on the network, Windows Defender ATP will quickly trigger alerts and launch matching automatic investigations.
|
||||
When a cybersecurity threat is emerging, or a potential attacker is deploying its tactics, techniques/tools, and procedures (TTPs) on the network, Microsoft Defender ATP will quickly trigger alerts and launch matching automatic investigations.
|
||||
|
||||
Windows Defender ATP applies correlation analytics and aggregates all related alerts and investigations into an incident. Doing so helps narrate a broader story of an attack, thus providing you with the right visuals (upgraded incident graph) and data representations to understand and deal with complex cross-entity threats to your organization's network.
|
||||
Microsoft Defender ATP applies correlation analytics and aggregates all related alerts and investigations into an incident. Doing so helps narrate a broader story of an attack, thus providing you with the right visuals (upgraded incident graph) and data representations to understand and deal with complex cross-entity threats to your organization's network.
|
||||
|
||||
|
||||
## In this section
|
||||
|
||||
@ -19,18 +19,18 @@ ms.date: 12/05/2018
|
||||
|
||||
# Configure information protection in Windows
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Learn how you can use Windows Defender ATP to expand the coverage of Windows Information Protection (WIP) to protect files based on their label, regardless of their origin.
|
||||
Learn how you can use Microsoft Defender ATP to expand the coverage of Windows Information Protection (WIP) to protect files based on their label, regardless of their origin.
|
||||
|
||||
>[!TIP]
|
||||
> Read our blog post about how [Windows Defender ATP integrates with Microsoft Information Protection to discover, protect, and monitor sensitive data on Windows devices](https://cloudblogs.microsoft.com/microsoftsecure/2019/01/17/windows-defender-atp-integrates-with-microsoft-information-protection-to-discover-protect-and-monitor-sensitive-data-on-windows-devices/).
|
||||
> Read our blog post about how [Microsoft Defender ATP integrates with Microsoft Information Protection to discover, protect, and monitor sensitive data on Windows devices](https://cloudblogs.microsoft.com/microsoftsecure/2019/01/17/windows-defender-atp-integrates-with-microsoft-information-protection-to-discover-protect-and-monitor-sensitive-data-on-windows-devices/).
|
||||
|
||||
## Prerequisites
|
||||
- Endpoints need to be on Windows 10, version 1809 or later
|
||||
- You'll need the appropriate license to leverage the Windows Defender ATP and Azure Information Protection integration
|
||||
- You'll need the appropriate license to leverage the Microsoft Defender ATP and Azure Information Protection integration
|
||||
- Your tenant needs to be onboarded to Azure Information Protection analytics, for more information see, [Configure a Log Analytics workspace for the reports](https://docs.microsoft.comazure/information-protection/reports-aip#configure-a-log-analytics-workspace-for-the-reports)
|
||||
|
||||
|
||||
@ -46,10 +46,10 @@ Learn how you can use Windows Defender ATP to expand the coverage of Windows Inf
|
||||
|
||||
4. Repeat for every label that you want to get WIP applied to in Windows.
|
||||
|
||||
After completing these steps Windows Defender ATP will automatically identify labeled documents stored on the device and enable WIP on them.
|
||||
After completing these steps Microsoft Defender ATP will automatically identify labeled documents stored on the device and enable WIP on them.
|
||||
|
||||
>[!NOTE]
|
||||
>- The Windows Defender ATP configuration is pulled every 15 minutes. Allow up to 30 minutes for the new policy to take effect and ensure that the endpoint is online. Otherwise, it will not receive the policy.
|
||||
>- The Microsoft Defender ATP configuration is pulled every 15 minutes. Allow up to 30 minutes for the new policy to take effect and ensure that the endpoint is online. Otherwise, it will not receive the policy.
|
||||
>- Data forwarded to Azure Information Protection is stored in the same location as your other Azure Information Protection data.
|
||||
|
||||
## Related topic
|
||||
|
||||
@ -19,56 +19,56 @@ ms.date: 12/05/2018
|
||||
|
||||
# Information protection in Windows overview
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Information protection is an integral part of Microsoft 365 Enterprise suite, providing intelligent protection to keep sensitive data secure while enabling productivity in the workplace.
|
||||
|
||||
|
||||
Windows Defender ATP is seamlessly integrated in Microsoft Threat Protection to provide a complete and comprehensive data loss prevention (DLP) solution for Windows devices. This solution is delivered and managed as part of the unified Microsoft 365 information protection suite.
|
||||
Microsoft Defender ATP is seamlessly integrated in Microsoft Threat Protection to provide a complete and comprehensive data loss prevention (DLP) solution for Windows devices. This solution is delivered and managed as part of the unified Microsoft 365 information protection suite.
|
||||
|
||||
>[!TIP]
|
||||
> Read our blog post about how [Windows Defender ATP integrates with Microsoft Information Protection to discover, protect, and monitor sensitive data on Windows devices](https://cloudblogs.microsoft.com/microsoftsecure/2019/01/17/windows-defender-atp-integrates-with-microsoft-information-protection-to-discover-protect-and-monitor-sensitive-data-on-windows-devices/).
|
||||
> Read our blog post about how [Microsoft Defender ATP integrates with Microsoft Information Protection to discover, protect, and monitor sensitive data on Windows devices](https://cloudblogs.microsoft.com/microsoftsecure/2019/01/17/windows-defender-atp-integrates-with-microsoft-information-protection-to-discover-protect-and-monitor-sensitive-data-on-windows-devices/).
|
||||
|
||||
|
||||
Windows Defender ATP applies two methods to discover and protect data:
|
||||
Microsoft Defender ATP applies two methods to discover and protect data:
|
||||
- **Data discovery** - Identify sensitive data on Windows devices at risk
|
||||
- **Data protection** - Windows Information Protection (WIP) as outcome of Azure Information Protection label
|
||||
|
||||
|
||||
## Data discovery
|
||||
Windows Defender ATP automatically discovers files with sensitivity labels on Windows devices when the feature is enabled. You can enable the Azure Information Protection integration feature from Windows Defender Security Center. For more information, see [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md#azure-information-protection).
|
||||
Microsoft Defender ATP automatically discovers files with sensitivity labels on Windows devices when the feature is enabled. You can enable the Azure Information Protection integration feature from Windows Defender Security Center. For more information, see [Configure advanced features](advanced-features-windows-defender-advanced-threat-protection.md#azure-information-protection).
|
||||
|
||||
|
||||
|
||||
|
||||
After enabling the Azure Information Protection integration, data discovery signals are immediately forwarded to Azure Information Protection from the device. When a labeled file is created or modified on a Windows device, Windows Defender ATP automatically reports the signal to Azure Information Protection.
|
||||
After enabling the Azure Information Protection integration, data discovery signals are immediately forwarded to Azure Information Protection from the device. When a labeled file is created or modified on a Windows device, Microsoft Defender ATP automatically reports the signal to Azure Information Protection.
|
||||
|
||||
The reported signals can be viewed on the Azure Information Protection - Data discovery dashboard.
|
||||
|
||||
### Azure Information Protection - Data discovery dashboard
|
||||
This dashboard presents a summarized discovery information of data discovered by both Windows Defender ATP and Azure Information Protection. Data from Windows Defender ATP is marked with Location Type - Endpoint.
|
||||
This dashboard presents a summarized discovery information of data discovered by both Microsoft Defender ATP and Azure Information Protection. Data from Microsoft Defender ATP is marked with Location Type - Endpoint.
|
||||
|
||||
|
||||
|
||||
|
||||
Notice the Device Risk column on the right, this device risk is derived directly from Windows Defender ATP, indicating the risk level of the security device where the file was discovered, based on the active security threats detected by Windows Defender ATP.
|
||||
Notice the Device Risk column on the right, this device risk is derived directly from Microsoft Defender ATP, indicating the risk level of the security device where the file was discovered, based on the active security threats detected by Microsoft Defender ATP.
|
||||
|
||||
Clicking the device risk level will redirect you to the device page in Windows Defender ATP, where you can get a comprehensive view of the device security status and its active alerts.
|
||||
Clicking the device risk level will redirect you to the device page in Microsoft Defender ATP, where you can get a comprehensive view of the device security status and its active alerts.
|
||||
|
||||
|
||||
>[!NOTE]
|
||||
>Windows Defender ATP does not currently report the Information Types.
|
||||
>Microsoft Defender ATP does not currently report the Information Types.
|
||||
|
||||
### Log Analytics
|
||||
Data discovery based on Windows Defender ATP is also available in [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-overview), where you can perform complex queries over the raw data.
|
||||
Data discovery based on Microsoft Defender ATP is also available in [Azure Log Analytics](https://docs.microsoft.com/azure/log-analytics/log-analytics-overview), where you can perform complex queries over the raw data.
|
||||
|
||||
For more information on Azure Information Protection analytics, see [Central reporting for Azure Information Protection](https://docs.microsoft.com/azure/information-protection/reports-aip).
|
||||
|
||||
Open Azure Log Analytics in Azure Portal and open a query builder (standard or classic).
|
||||
|
||||
To view Windows Defender ATP data, perform a query that contains:
|
||||
To view Microsoft Defender ATP data, perform a query that contains:
|
||||
|
||||
|
||||
```
|
||||
@ -83,15 +83,15 @@ InformationProtectionLogs_CL
|
||||
|
||||
|
||||
## Data protection
|
||||
For data to be protected, they must first be identified through labels. Sensitivity labels are created in Office Security and Compliance (SCC). Windows Defender ATP then uses the labels to identify endpoints that need Windows Information Protection (WIP) applied on them.
|
||||
For data to be protected, they must first be identified through labels. Sensitivity labels are created in Office Security and Compliance (SCC). Microsoft Defender ATP then uses the labels to identify endpoints that need Windows Information Protection (WIP) applied on them.
|
||||
|
||||
|
||||
When you create sensitivity labels, you can set the information protection functionalities that will be applied on the file. The setting that applies to Windows Defender ATP is the Data loss prevention. You'll need to turn on the Data loss prevention and select Enable Windows end point protection (DLP for devices).
|
||||
When you create sensitivity labels, you can set the information protection functionalities that will be applied on the file. The setting that applies to Microsoft Defender ATP is the Data loss prevention. You'll need to turn on the Data loss prevention and select Enable Windows end point protection (DLP for devices).
|
||||
|
||||
|
||||
|
||||
|
||||
Once, the policy is set and published, Windows Defender ATP automatically enables WIP for labeled files. When a labeled file is created or modified on a Windows device, Windows Defender ATP automatically detects it and enables WIP on that file if its label corresponds with Office Security and Compliance (SCC) policy.
|
||||
Once, the policy is set and published, Microsoft Defender ATP automatically enables WIP for labeled files. When a labeled file is created or modified on a Windows device, Microsoft Defender ATP automatically detects it and enables WIP on that file if its label corresponds with Office Security and Compliance (SCC) policy.
|
||||
|
||||
This functionality expands the coverage of WIP to protect files based on their label, regardless of their origin.
|
||||
|
||||
|
||||
@ -18,7 +18,7 @@ ms.topic: article
|
||||
|
||||
# Initiate machine investigation API (Preview)
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
@ -33,7 +33,7 @@ Initiate AutoIR investigation on a machine.
|
||||
2. For Automated Investigation limitations, see [Automated Investigation](automated-investigations-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Windows Defender ATP APIs](apis-intro.md)
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Investigate Windows Defender Advanced Threat Protection alerts
|
||||
title: Investigate Microsoft Defender Advanced Threat Protection alerts
|
||||
description: Use the investigation options to get details on alerts are affecting your network, what they mean, and how to resolve them.
|
||||
keywords: investigate, investigation, machines, machine, alerts queue, dashboard, IP address, file, submit, submissions, deep analysis, timeline, search, domain, URL, IP
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -18,15 +18,15 @@ ms.topic: article
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
|
||||
# Investigate Windows Defender Advanced Threat Protection alerts
|
||||
# Investigate Microsoft Defender Advanced Threat Protection alerts
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatealerts-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatealerts-abovefoldlink)
|
||||
|
||||
Investigate alerts that are affecting your network, understand what they mean, and how to resolve them.
|
||||
|
||||
@ -93,12 +93,12 @@ The **Artifact timeline** feature provides an addition view of the evidence that
|
||||
Selecting an alert detail brings up the **Details pane** where you'll be able to see more information about the alert such as file details, detections, instances of it observed worldwide, and in the organization.
|
||||
|
||||
## Related topics
|
||||
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
- [View and organize the Microsoft Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Microsoft Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Investigate Windows Defender Advanced Threat Protection domains
|
||||
title: Investigate Microsoft Defender Advanced Threat Protection domains
|
||||
description: Use the investigation options to see if machines and servers have been communicating with malicious domains.
|
||||
keywords: investigate domain, domain, malicious domain, windows defender atp, alert, URL
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -17,16 +17,16 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
# Investigate a domain associated with a Windows Defender ATP alert
|
||||
# Investigate a domain associated with a Microsoft Defender ATP alert
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatedomain-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatedomain-abovefoldlink)
|
||||
|
||||
Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain.
|
||||
|
||||
@ -60,10 +60,10 @@ The **Most recent observed machinew with URL** section provides a chronological
|
||||
5. Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events.
|
||||
|
||||
## Related topics
|
||||
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
- [View and organize the Microsoft Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Microsoft Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Investigate Windows Defender Advanced Threat Protection files
|
||||
title: Investigate Microsoft Defender Advanced Threat Protection files
|
||||
description: Use the investigation options to get details on files associated with alerts, behaviours, or events.
|
||||
keywords: investigate, investigation, file, malicious activity, attack motivation, deep analysis, deep analysis report
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -17,16 +17,16 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
# Investigate a file associated with a Windows Defender ATP alert
|
||||
# Investigate a file associated with a Microsoft Defender ATP alert
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatefiles-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigatefiles-abovefoldlink)
|
||||
|
||||
Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach.
|
||||
|
||||
@ -65,10 +65,10 @@ The **Most recent observed machines with the file** section allows you to specif
|
||||
This allows for greater accuracy in defining entities to display such as if and when an entity was observed in the organization. For example, if you’re trying to identify the origin of a network communication to a certain IP Address within a 10-minute period on a given date, you can specify that exact time interval, and see only files that communicated with that IP Address at that time, drastically reducing unnecessary scrolling and searching.
|
||||
|
||||
## Related topics
|
||||
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
- [View and organize the Microsoft Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Microsoft Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Investigate incidents in Windows Defender ATP
|
||||
title: Investigate incidents in Microsoft Defender ATP
|
||||
description: See associated alerts, manage the incident, and see alert metadata to help you investigate an incident
|
||||
keywords: investigate, incident, alerts, metadata, risk, detection source, affected machines, patterns, correlation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -17,10 +17,10 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Investigate incidents in Windows Defender ATP
|
||||
# Investigate incidents in Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
Investigate incidents that affect your network, understand what they mean, and collate evidence to resolve them.
|
||||
@ -57,13 +57,13 @@ Select **Investigations** to see all the automatic investigations launched by th
|
||||
|
||||
|
||||
## Going through the evidence
|
||||
Windows Defender Advanced Threat Protection automatically investigates all the incidents' supported events and suspicious entities in the alerts, providing you with auto-response and information about the important files, processes, services, and more. This helps quickly detect and block potential threats in the incident.
|
||||
Microsoft Defender Advanced Threat Protection automatically investigates all the incidents' supported events and suspicious entities in the alerts, providing you with auto-response and information about the important files, processes, services, and more. This helps quickly detect and block potential threats in the incident.
|
||||
Each of the analyzed entities will be marked as infected, remediated, or suspicious.
|
||||
|
||||
|
||||
|
||||
## Visualizing associated cybersecurity threats
|
||||
Windows Defender Advanced Threat Protection aggregates the threat information into an incident so you can see the patterns and correlations coming in from various data points. You can view such correlation through the incident graph.
|
||||
Microsoft Defender Advanced Threat Protection aggregates the threat information into an incident so you can see the patterns and correlations coming in from various data points. You can view such correlation through the incident graph.
|
||||
|
||||
### Incident graph
|
||||
The **Graph** tells the story of the cybersecurity attack. For example, it shows you what was the entry point, which indicator of compromise or activity was observed on which machine. etc.
|
||||
|
||||
@ -17,16 +17,16 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 04/24/2018
|
||||
---
|
||||
# Investigate an IP address associated with a Windows Defender ATP alert
|
||||
# Investigate an IP address associated with a Microsoft Defender ATP alert
|
||||
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigateip-abovefoldlink)
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-investigateip-abovefoldlink)
|
||||
|
||||
Examine possible communication between your machines and external internet protocol (IP) addresses.
|
||||
|
||||
@ -67,10 +67,10 @@ Use the search filters to define the search criteria. You can also use the timel
|
||||
Clicking any of the machine names will take you to that machine's view, where you can continue investigate reported alerts, behaviors, and events.
|
||||
|
||||
## Related topics
|
||||
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
- [View and organize the Microsoft Defender Advanced Threat Protection Alerts queue ](alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage Microsoft Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate Microsoft Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a file associated with a Microsoft Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Microsoft Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user