mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-28 21:27:23 +00:00
Merge branch 'master' into Benny-54-passive-mode
This commit is contained in:
Denise Vangel-MSFT
GitHub
commit
a3440bc39c
@ -15110,6 +15110,11 @@
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip",
|
||||
"redirect_document_id": true
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/microsoft-defender-atp/find-machine-info-by-ip.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/find-machines-by-ip",
|
||||
"redirect_document_id": false
|
||||
},
|
||||
{
|
||||
"source_path": "windows/security/threat-protection/windows-defender-atp/get-filemachineaction-object-windows-defender-advanced-threat-protection.md",
|
||||
"redirect_url": "https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/use-apis",
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Customize Windows 10 Start and tasbkar with Group Policy (Windows 10)
|
||||
title: Customize Windows 10 Start and taskbar with Group Policy (Windows 10)
|
||||
description: In Windows 10, you can use a Group Policy Object (GPO) to deploy a customized Start layout to users in a domain.
|
||||
ms.assetid: F4A47B36-F1EF-41CD-9CBA-04C83E960545
|
||||
ms.reviewer:
|
||||
|
||||
@ -62,10 +62,11 @@ For information about setting up Delivery Optimization, including tips for the b
|
||||
- DOMaxUploadBandwidth
|
||||
|
||||
- Support for new types of downloads:
|
||||
- Office installations and updates
|
||||
- Office installs and updates
|
||||
- Xbox game pass games
|
||||
- MSIX apps (HTTP downloads only)
|
||||
- Edge browser installations and updates
|
||||
- Edge browser installs and updates
|
||||
- [Dynamic updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-benefits-of-windows-10-dynamic-update/ba-p/467847)
|
||||
|
||||
## Requirements
|
||||
|
||||
@ -90,7 +91,9 @@ The following table lists the minimum Windows 10 version that supports Delivery
|
||||
| Win32 apps for Intune | 1709 |
|
||||
| Xbox game pass games | 2004 |
|
||||
| MSIX apps (HTTP downloads only) | 2004 |
|
||||
| Configuration Manager Express Updates | 1709 + Configuration Manager version 1711 |
|
||||
| Configuration Manager Express updates | 1709 + Configuration Manager version 1711 |
|
||||
| Edge browser installs and updates | 1809 |
|
||||
| [Dynamic updates](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/the-benefits-of-windows-10-dynamic-update/ba-p/467847) | 1903 |
|
||||
|
||||
> [!NOTE]
|
||||
> Starting with Configuration Manager version 1910, you can use Delivery Optimization for the distribution of all Windows update content for clients running Windows 10 version 1709 or newer, not just express installation files. For more, see [Delivery Optimization starting in version 1910](https://docs.microsoft.com/mem/configmgr/sum/deploy-use/optimize-windows-10-update-delivery#bkmk_DO-1910).
|
||||
|
||||
@ -57,7 +57,7 @@ get-help get-VamtProduct -all
|
||||
```
|
||||
|
||||
**Warning**
|
||||
The update-help cmdlet is not supported for VAMT PowerShell cmdlets. To view online help for VAMT cmdlets, you can use the -online option with the get-help cmdlet. For more information, see [Volume Activation Management Tool (VAMT) Cmdlets in Windows PowerShell](https://go.microsoft.com/fwlink/p/?LinkId=242278).
|
||||
The update-help cmdlet is not supported for VAMT PowerShell cmdlets. To view online help for VAMT cmdlets, you can use the -online option with the get-help cmdlet. For more information, see [Volume Activation Management Tool (VAMT) Cmdlets in Windows PowerShell](https://docs.microsoft.com/powershell/module/vamt).
|
||||
|
||||
**To view VAMT PowerShell Help sections**
|
||||
|
||||
|
||||
@ -45,6 +45,48 @@ After the initial logon attempt, the user's Windows Hello for Business public ke
|
||||
|
||||
To resolve this behavior, upgrade Windows Server 2016 and 2019 domain controllers to with the latest patches. For Windows Server 2016, this behavior is fixed in build 14393.4104 ([KB4593226](https://support.microsoft.com/help/4593226)) and later. For Windows Server 2019, this behavior is fixed in build 17763.1637 ([KB4592440](https://support.microsoft.com/help/4592440)).
|
||||
|
||||
## Azure AD Joined Device Access to On-Premises Resources Using Key Trust and Third-Party Certificate Authority (CA)
|
||||
|
||||
Applies to:
|
||||
|
||||
- Azure AD joined key trust deployments
|
||||
- Third-party certificate authority (CA) issuing domain controller certificates
|
||||
|
||||
Windows Hello for Business uses smart card based authentication for many operations. Smart card has special guidelines when using a third-party CA for certificate issuance, some of which apply to the domain controllers. Not all Windows Hello for Business deployment types require these configurations. Accessing on-premises resources from an Azure AD Joined device does require special configuration when using a third-party CA to issue domain controller certificates.
|
||||
|
||||
For more information, read [Guidelines for enabling smart card logon with third-party certification authorities](
|
||||
https://support.microsoft.com/topic/a34a400a-51d5-f2a1-c8c0-7a6c9c49cb78).
|
||||
|
||||
### Identifying On-premises Resource Access Issues with Third-Party CAs
|
||||
|
||||
This issue can be identified using network traces or Kerberos logging from the client. In the network trace, the client will fail to place a TGS_REQ request when a user attempts to access a resource. On the client, this can be observed in the Kerberos operation event log under **Application and Services/Microsoft/Windows/Security-Kerberos/Operational**. These logs are default disabled. The failure event for this case will include the following information:
|
||||
|
||||
Log Name: Microsoft-Windows-Kerberos/Operational
|
||||
Source: Microsoft-Windows-Security-Kerberos
|
||||
Event ID: 107
|
||||
GUID: {98e6cfcb-ee0a-41e0-a57b-622d4e1b30b1}
|
||||
Task Category: None
|
||||
Level: Error
|
||||
Keywords:
|
||||
User: SYSTEM
|
||||
Description:
|
||||
|
||||
The Kerberos client received a KDC certificate that does not have a matched domain name.
|
||||
|
||||
Expected Domain Name: ad.contoso.com
|
||||
Error Code: 0xC000006D
|
||||
|
||||
### Resolving On-premises Resource Access Issue with Third-Party CAs
|
||||
|
||||
To resolve this issue, domain controller certificates need to be updated so the certificate subject contains directory path of the server object (distinguished name).
|
||||
Example Subject: CN=DC1 OU=Domain Controller, DC=ad, DC=contoso, DC=com
|
||||
|
||||
Alternatively, you can set the subject alternative name (SAN) of the domain controller certificate to contain the server object's fully qualified domain name and the NETBIOS name of the domain.
|
||||
Example Subject Alternative Name:
|
||||
dns=dc1.ad.contoso.com
|
||||
dns=ad.contoso.com
|
||||
dns=ad
|
||||
|
||||
## Key Trust Authentication Broken for Windows Server 2019
|
||||
|
||||
Applies to:
|
||||
|
||||
@ -332,7 +332,7 @@ Windows Hello for Business does not require an Azure AD premium subscription. H
|
||||
|
||||
If box **1a** on your planning worksheet reads **on-premises**, write **No** in box **6c** on your planning worksheet.
|
||||
|
||||
If box **1a** on your planning worksheet reads **hybrid** and box **1b** reads **key trust**, write **No** in box **6c** on your planning worksheet. You can deploy Windows Hello for Business using the free Azure Active Directory account (additional costs needed for multi-factor authentication).
|
||||
If box **1a** on your planning worksheet reads **hybrid** and box **1b** reads **key trust**, write **No** in box **6c** on your planning worksheet. You can deploy Windows Hello for Business using the Azure Active Directory free tier. All Azure Active Directory free accounts can use Azure AD Multi-Factor Authentication through the use of security defaults. Some Azure AD Multi-Factor Authentication features require a license. For more details, see [Features and licenses for Azure AD Multi-Factor Authentication](https://docs.microsoft.com/azure/active-directory/authentication/concept-mfa-licensing).
|
||||
|
||||
If box **5b** on your planning worksheet reads **AD FS RA**, write **Yes** in box **6c** on your planning worksheet. Enrolling a certificate using the AD FS registration authority requires devices to authenticate to the AD FS server, which requires device write-back, an Azure AD Premium feature.
|
||||
|
||||
|
||||
@ -444,7 +444,7 @@ To stop Windows from automatically blocking these connections, you can add the `
|
||||
For example:
|
||||
|
||||
```console
|
||||
URL <,proxy>|URL <,proxy>/*AppCompat*/
|
||||
URL <,proxy>|URL <,proxy>|/*AppCompat*/
|
||||
```
|
||||
|
||||
When you use this string, we recommend that you also turn on [Azure Active Directory Conditional Access](https://docs.microsoft.com/azure/active-directory/active-directory-conditional-access), using the **Domain joined or marked as compliant** option, which blocks apps from accessing any enterprise cloud resources that are protected by conditional access.
|
||||
|
||||
@ -28,7 +28,7 @@ This list provides all of the tasks and settings that are required for the opera
|
||||
|Task|Description|
|
||||
|----|-----------|
|
||||
|Add at least one app to the **Protected apps** list in your WIP policy.|You must have at least one app added to your **Protected apps** list. For more info about where this area is and how to add apps, see the **Add apps to your Protected apps list** section of the policy creation topics.|
|
||||
|Choose your WIP protection level.|You must choose the level of protection you want to apply to your WIP-protected content, including **Allow Overrides**, **Silent**, or **Block**. For more info about where this area is and how to decide on your protection level, see the **Manage the WIP protection mode for your enterprise data** section of the policy creation topics. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).|
|
||||
|Choose your WIP protection level.|You must choose the level of protection you want to apply to your WIP-protected content, including **Allow Overrides**, **Silent**, or **Block**. For more info about where this area is and how to decide on your protection level, see the [Manage the WIP protection mode for your enterprise data](https://docs.microsoft.com/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr#manage-the-wip-protection-level-for-your-enterprise-data) section of the policy creation topics. For info about how to collect your audit log files, see [How to collect Windows Information Protection (WIP) audit event logs](collect-wip-audit-event-logs.md).|
|
||||
|Specify your corporate identity.|This field is automatically filled out for you by Microsoft Intune. However, you must manually correct it if it’s incorrect or if you need to add additional domains. For more info about where this area is and what it means, see the **Define your enterprise-managed corporate identity** section of the policy creation topics.
|
||||
|Specify your network domain names.|Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the DNS suffixes used in your environment. All traffic to the fully-qualified domains appearing in this list will be protected. For more info about where this area is and how to add your suffixes, see the table that appears in the **Choose where apps can access enterprise data** section of the policy creation topics.|
|
||||
|Specify your enterprise IPv4 or IPv6 ranges.|Starting with Windows 10, version 1703, this field is optional.<br><br>Specify the addresses for a valid IPv4 or IPv6 value range within your intranet. These addresses, used with your Network domain names, define your corporate network boundaries. For more info about where this area is and what it means, see the table that appears in the **Define your enterprise-managed corporate identity** section of the policy creation topics.|
|
||||
|
||||
@ -114,6 +114,7 @@
|
||||
##### [Enable exploit protection](microsoft-defender-atp/enable-exploit-protection.md)
|
||||
##### [Customize exploit protection](microsoft-defender-atp/customize-exploit-protection.md)
|
||||
##### [Import, export, and deploy exploit protection configurations](microsoft-defender-atp/import-export-exploit-protection-emet-xml.md)
|
||||
##### [Troubleshoot exploit protection mitigations](microsoft-defender-atp/troubleshoot-exploit-protection-mitigations.md)
|
||||
##### [Exploit protection reference](microsoft-defender-atp/exploit-protection-reference.md )
|
||||
|
||||
#### [Network protection]()
|
||||
@ -508,6 +509,8 @@
|
||||
#### [Configure conditional access](microsoft-defender-atp/configure-conditional-access.md)
|
||||
#### [Configure Microsoft Cloud App Security integration](microsoft-defender-atp/microsoft-cloud-app-security-config.md)
|
||||
|
||||
### [Address false positives/negatives in Microsoft Defender for Endpoint](microsoft-defender-atp/defender-endpoint-false-positives-negatives.md)
|
||||
|
||||
### [Use audit mode](microsoft-defender-atp/audit-windows-defender.md)
|
||||
|
||||
## Reference
|
||||
@ -550,6 +553,7 @@
|
||||
####### [Get security recommendations](microsoft-defender-atp/get-security-recommendations.md)
|
||||
####### [Add or Remove machine tags](microsoft-defender-atp/add-or-remove-machine-tags.md)
|
||||
####### [Find machines by IP](microsoft-defender-atp/find-machines-by-ip.md)
|
||||
####### [Find machines by tag](microsoft-defender-atp/find-machines-by-tag.md)
|
||||
####### [Get missing KBs](microsoft-defender-atp/get-missing-kbs-machine.md)
|
||||
####### [Set device value](microsoft-defender-atp/set-device-value.md)
|
||||
|
||||
@ -576,6 +580,7 @@
|
||||
###### [Indicators]()
|
||||
####### [Indicators methods and properties](microsoft-defender-atp/ti-indicator.md)
|
||||
####### [Submit Indicator](microsoft-defender-atp/post-ti-indicator.md)
|
||||
####### [Import Indicators](microsoft-defender-atp/import-ti-indicators.md)
|
||||
####### [List Indicators](microsoft-defender-atp/get-ti-indicators-collection.md)
|
||||
####### [Delete Indicator](microsoft-defender-atp/delete-ti-indicator-by-id.md)
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.date: 06/08/2020
|
||||
ms.date: 01/26/2021
|
||||
ms.reviewer: shwetaj
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
@ -35,6 +35,9 @@ What if something gets detected wrongly as malware, or something is missed? We c
|
||||
- [Create an "Allow" indicator to prevent a false positive from recurring](#create-an-allow-indicator-to-prevent-a-false-positive-from-recurring)
|
||||
- [Define an exclusion on an individual Windows device to prevent an item from being scanned](#define-an-exclusion-on-an-individual-windows-device-to-prevent-an-item-from-being-scanned)
|
||||
|
||||
> [!TIP]
|
||||
> This article focuses on false positives in Microsoft Defender Antivirus. If you want guidance for Microsoft Defender for Endpoint, which includes next-generation protection, endpoint detection and response, automated investigation and remediation, and more, see [Address false positives/negatives in Microsoft Defender for Endpoint](../microsoft-defender-atp/defender-endpoint-false-positives-negatives.md).
|
||||
|
||||
## Submit a file to Microsoft for analysis
|
||||
|
||||
1. Review the [submission guidelines](../intelligence/submission-guide.md).
|
||||
@ -76,3 +79,5 @@ To learn more, see:
|
||||
[What is Microsoft Defender for Endpoint?](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection)
|
||||
|
||||
[Microsoft 365 Defender](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection)
|
||||
|
||||
[Address false positives/negatives in Microsoft Defender for Endpoint](../microsoft-defender-atp/defender-endpoint-false-positives-negatives.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Microsoft Defender Antivirus compatibility with other security products
|
||||
description: Get an overview of what to expect from Microsoft Defender Antivirus with other security products and the operating systems you are using.
|
||||
keywords: windows defender, next-generation, atp, advanced threat protection, compatibility, passive mode
|
||||
description: What to expect from Microsoft Defender Antivirus with other security products and the operating systems you are using.
|
||||
keywords: windows defender, next-generation, antivirus, compatibility, passive mode
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.pagetype: security
|
||||
ms.prod: m365-security
|
||||
@ -13,7 +13,7 @@ ms.author: deniseb
|
||||
ms.custom: nextgen
|
||||
ms.reviewer: tewchen, pahuijbr, shwjha
|
||||
manager: dansimp
|
||||
ms.date: 01/11/2021
|
||||
ms.date: 01/22/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
@ -40,17 +40,17 @@ The following table summarizes what happens with Microsoft Defender Antivirus wh
|
||||
| Windows version | Antimalware protection | Microsoft Defender for Endpoint enrollment | Microsoft Defender Antivirus state |
|
||||
|------|------|-------|-------|
|
||||
| Windows 10 | A third-party product that is not offered or developed by Microsoft | Yes | Passive mode |
|
||||
| Windows 10 | A third-party product that is not offered or developed by Microsoft | No | Automatic disabled mode |
|
||||
| Windows 10 | A third-party product that is not offered or developed by Microsoft | No | Automatically disabled mode |
|
||||
| Windows 10 | Microsoft Defender Antivirus | Yes | Active mode |
|
||||
| Windows 10 | Microsoft Defender Antivirus | No | Active mode |
|
||||
| Windows Server, version 1803 or newer, or Windows Server 2019 | A third-party product that is not offered or developed by Microsoft | Yes | Active mode<sup>[[1](#fn1)]</sup> |
|
||||
| Windows Server, version 1803 or newer, or Windows Server 2019 | A third-party product that is not offered or developed by Microsoft | No | Must be set to passive mode (manually)<sup>[[1](#fn1)]<sup> |
|
||||
| Windows Server, version 1803 or newer, or Windows Server 2019 | A third-party product that is not offered or developed by Microsoft | Yes | Active mode <sup>[[1](#fn1)]</sup> |
|
||||
| Windows Server, version 1803 or newer, or Windows Server 2019 | A third-party product that is not offered or developed by Microsoft | No | Must be set to passive mode (manually) <sup>[[1](#fn1)]<sup> |
|
||||
| Windows Server, version 1803 or newer, or Windows Server 2019 | Microsoft Defender Antivirus | Yes | Active mode |
|
||||
| Windows Server, version 1803 or newer, or Windows Server 2019 | Microsoft Defender Antivirus | No | Active mode |
|
||||
| Windows Server 2016 | Microsoft Defender Antivirus | Yes | Active mode |
|
||||
| Windows Server 2016 | Microsoft Defender Antivirus | No | Active mode |
|
||||
| Windows Server 2016 | A third-party product that is not offered or developed by Microsoft | Yes | Must be disabled (manually)<sup>[[2](#fn2)]<sup> |
|
||||
| Windows Server 2016 | A third-party product that is not offered or developed by Microsoft | No | Must be disabled (manually)<sup>[[2](#fn2)]<sup> |
|
||||
| Windows Server 2016 | A third-party product that is not offered or developed by Microsoft | Yes | Must be disabled (manually) <sup>[[2](#fn2)]<sup> |
|
||||
| Windows Server 2016 | A third-party product that is not offered or developed by Microsoft | No | Must be disabled (manually) <sup>[[2](#fn2)]<sup> |
|
||||
|
||||
(<a id="fn1">1</a>) On Windows Server, version 1803 or newer, or Windows Server 2019, Microsoft Defender Antivirus does not enter passive mode automatically when you install a non-Microsoft antivirus product. In those cases, [set Microsoft Defender Antivirus to passive mode](microsoft-defender-antivirus-on-windows-server-2016.md#need-to-set-microsoft-defender-antivirus-to-passive-mode) to prevent problems caused by having multiple antivirus products installed on a server.
|
||||
|
||||
@ -76,25 +76,34 @@ See [Microsoft Defender Antivirus on Windows Server](microsoft-defender-antiviru
|
||||
|
||||
## Functionality and features available in each state
|
||||
|
||||
The table in this section summarizes the functionality and features that are available in each state.
|
||||
The table in this section summarizes the functionality and features that are available in each state. The table is designed to be informational only. It is intended to describe the features & capabilities that are actively working or not, according to whether Microsoft Defender Antivirus is in active mode, in passive mode, or is disabled/uninstalled.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> The following table is informational, and it is designed to describe the features & capabilities that are turned on or off according to whether Microsoft Defender Antivirus is in Active mode, in Passive mode, or disabled/uninstalled. Do not turn off capabilities, such as real-time protection, if you are using Microsoft Defender Antivirus in passive mode or are using EDR in block mode.
|
||||
> Do not turn off capabilities, such as real-time protection, cloud-delivered protection, or limited periodic scanning, if you are using Microsoft Defender Antivirus in passive mode or you are using EDR in block mode.
|
||||
|
||||
|State |[Real-time protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) and [cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus) | [Limited periodic scanning availability](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus) | [File scanning and detection information](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus) | [Threat remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus) | [Security intelligence updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus) |
|
||||
|--|--|--|--|--|--|
|
||||
|Active mode <br/><br/> |Yes |No |Yes |Yes |Yes |
|
||||
|Passive mode |No |No |Yes |Only during [scheduled or on-demand scans](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/scheduled-catch-up-scans-microsoft-defender-antivirus) |Yes |
|
||||
|[EDR in block mode enabled](../microsoft-defender-atp/edr-in-block-mode.md) |No |No |Yes |Yes |Yes |
|
||||
|Automatic disabled mode |No |Yes |No |No |No |
|
||||
|Protection |Active mode |Passive mode |EDR in block mode |Disabled or uninstalled |
|
||||
|:---|:---|:---|:---|:---|
|
||||
| [Real-time protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) and [cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus) | Yes | No <sup>[[3](#fn3)]<sup> | No | No |
|
||||
| [Limited periodic scanning availability](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/limited-periodic-scanning-microsoft-defender-antivirus) | No | No | No | Yes |
|
||||
| [File scanning and detection information](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/customize-run-review-remediate-scans-microsoft-defender-antivirus) | Yes | Yes | Yes | No |
|
||||
| [Threat remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-remediation-microsoft-defender-antivirus) | Yes | See note <sup>[[4](#fn4)]<sup> | Yes | No |
|
||||
| [Security intelligence updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus) | Yes | Yes | Yes | No |
|
||||
|
||||
(<a id="fn3">3</a>) In general, when Microsoft Defender Antivirus is in passive mode, real-time protection does not provide any blocking or enforcement, even though it is enabled and in passive mode. However, if [Microsoft 365 Endpoint data loss prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about) (Endpoint DLP) is configured and in effect, protective actions are enforced. Endpoint DLP works with real-time protection and behavior monitoring.
|
||||
|
||||
(<a id="fn4">4</a>) When Microsoft Defender Antivirus is in passive mode, threat remediation features are active only during scheduled or on-demand scans.
|
||||
|
||||
- In Active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files are scanned and threats remediated, and detection information are reported in your configuration tool (such as Configuration Manager or the Microsoft Defender Antivirus app on the machine itself).
|
||||
- In Passive mode, Microsoft Defender Antivirus is not used as the antivirus app, and threats are not remediated by Microsoft Defender Antivirus. Files are scanned and reports are provided for threat detections that are shared with the Microsoft Defender for Endpoint service. Therefore, you might encounter alerts in the Security Center console with Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in Passive mode.
|
||||
- When [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) is turned on and Microsoft Defender Antivirus is not the primary antivirus solution, it can still detect and remediate malicious items.
|
||||
- When disabled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated. Disabling/uninstalling Microsoft Defender Antivirus is not recommended in general; if possible, keep Microsoft Defender Antivirus in passive mode if you are using a non-Microsoft antimalware/antivirus solution.
|
||||
|
||||
## Keep the following points in mind
|
||||
|
||||
- In active mode, Microsoft Defender Antivirus is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files are scanned and threats remediated, and detection information are reported in your configuration tool (such as Configuration Manager or the Microsoft Defender Antivirus app on the machine itself).
|
||||
|
||||
- In passive mode, Microsoft Defender Antivirus is not used as the antivirus app, and threats are not remediated by Microsoft Defender Antivirus. Files are scanned and reports are provided for threat detections that are shared with the Microsoft Defender for Endpoint service. Therefore, you might encounter alerts in the Security Center console with Microsoft Defender Antivirus as a source, even when Microsoft Defender Antivirus is in Passive mode.
|
||||
|
||||
- When [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md) is turned on and Microsoft Defender Antivirus is not the primary antivirus solution, it can still detect and remediate malicious items.
|
||||
|
||||
- When disabled, Microsoft Defender Antivirus is not used as the antivirus app. Files are not scanned and threats are not remediated. Disabling/uninstalling Microsoft Defender Antivirus is not recommended in general; if possible, keep Microsoft Defender Antivirus in passive mode if you are using a non-Microsoft antimalware/antivirus solution.
|
||||
|
||||
- If you are enrolled in Microsoft Defender for Endpoint and you are using a third-party antimalware product, then passive mode is enabled. [The service requires common information sharing from Microsoft Defender Antivirus service](../microsoft-defender-atp/defender-compatibility.md) in order to properly monitor your devices and network for intrusion attempts and attacks.
|
||||
|
||||
- When Microsoft Defender Antivirus is disabled automatically, it can be re-enabled automatically if the protection offered by a non-Microsoft antivirus product expires or otherwise stops providing real-time protection from viruses, malware, or other threats. Automatic re-enabling helps to ensure that antivirus protection is maintained on your devices. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), which uses the Microsoft Defender Antivirus engine to periodically check for threats in addition to your main antivirus app.
|
||||
@ -104,13 +113,14 @@ The table in this section summarizes the functionality and features that are ava
|
||||
If you uninstall the non-Microsoft antivirus product, and use Microsoft Defender Antivirus to provide protection to your devices, Microsoft Defender Antivirus will return to its normal active mode automatically.
|
||||
|
||||
> [!WARNING]
|
||||
> Do not disable, stop, or modify any of the associated services that are used by Microsoft Defender Antivirus, Microsoft Defender for Endpoint, or the Windows Security app. This includes the *wscsvc*, *SecurityHealthService*, *MsSense*, *Sense*, *WinDefend*, or *MsMpEng* services and processes. Manually modifying these services can cause severe instability on your devices and can make your network vulnerable. Disabling, stopping, or modifying those services can also cause problems when using non-Microsoft antivirus solutions and how their information is displayed in the [Windows Security app](microsoft-defender-security-center-antivirus.md).
|
||||
> Do not disable, stop, or modify any of the associated services that are used by Microsoft Defender Antivirus, Microsoft Defender for Endpoint, or the Windows Security app. This recommendation includes the *wscsvc*, *SecurityHealthService*, *MsSense*, *Sense*, *WinDefend*, or *MsMpEng* services and processes. Manually modifying these services can cause severe instability on your devices and can make your network vulnerable. Disabling, stopping, or modifying those services can also cause problems when using non-Microsoft antivirus solutions and how their information is displayed in the [Windows Security app](microsoft-defender-security-center-antivirus.md).
|
||||
|
||||
|
||||
## See also
|
||||
|
||||
- [Microsoft Defender Antivirus in Windows 10](microsoft-defender-antivirus-in-windows-10.md)
|
||||
- [Microsoft Defender Antivirus on Windows Server 2016 and 2019](microsoft-defender-antivirus-on-windows-server-2016.md)
|
||||
- [Microsoft Defender Antivirus on Windows Server](microsoft-defender-antivirus-on-windows-server-2016.md)
|
||||
- [EDR in block mode](../microsoft-defender-atp/edr-in-block-mode.md)
|
||||
- [Configure Endpoint Protection](https://docs.microsoft.com/mem/configmgr/protect/deploy-use/endpoint-protection-configure)
|
||||
- [Address false positives/negatives in Microsoft Defender for Endpoint](../microsoft-defender-atp/defender-endpoint-false-positives-negatives.md)
|
||||
- [Learn about Microsoft 365 Endpoint data loss prevention](https://docs.microsoft.com/microsoft-365/compliance/endpoint-dlp-learn-about)
|
||||
|
||||
@ -8,7 +8,7 @@ ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
ms.date: 12/17/2020
|
||||
ms.date: 01/27/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
@ -53,3 +53,4 @@ Application Guard has been created to target several types of devices:
|
||||
| [Microsoft Defender Application Guard Extension for web browsers](md-app-guard-browser-extension.md) | Describes the Application Guard extension for Chrome and Firefox, including known issues, and a troubleshooting guide |
|
||||
| [Microsoft Defender Application Guard for Microsoft Office](https://docs.microsoft.com/microsoft-365/security/office-365-security/install-app-guard) | Describes Application Guard for Microsoft Office, including minimum hardware requirements, configuration, and a troubleshooting guide |
|
||||
|[Frequently asked questions - Microsoft Defender Application Guard](faq-md-app-guard.md)|Provides answers to frequently asked questions about Application Guard features, integration with the Windows operating system, and general configuration.|
|
||||
|[Use a network boundary to add trusted sites on Windows devices in Microsoft Intune](https://docs.microsoft.com/mem/intune/configuration/network-boundary-windows)|Network boundary, a feature that helps you protect your environment from sites that aren't trusted by your organization.|
|
||||
|
||||
@ -90,9 +90,11 @@ If successful, this method returns 200 - Ok response code and the updated Machin
|
||||
|
||||
Here is an example of a request that adds machine tag.
|
||||
|
||||
```http
|
||||
```
|
||||
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/tags
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Value" : "test Tag 2",
|
||||
"Action": "Add"
|
||||
|
||||
@ -170,3 +170,6 @@ When you click on the pending actions link, you'll be taken to the Action center
|
||||
|
||||
- [See the interactive guide: Investigate and remediate threats with Microsoft Defender for Endpoint](https://aka.ms/MDATP-IR-Interactive-Guide)
|
||||
|
||||
## See also
|
||||
|
||||
- [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md)
|
||||
@ -93,5 +93,6 @@ All remediation actions, whether pending or completed, can be viewed in the [Act
|
||||
## See also
|
||||
|
||||
- [PUA protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus)
|
||||
- [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md)
|
||||
- [Automated investigation and response in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-air)
|
||||
- [Automated investigation and response in Microsoft 365 Defender](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-autoir)
|
||||
|
||||
@ -81,9 +81,11 @@ If successful, this method returns 201 - Created response code and [Machine Acti
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/machines/fb9ab6be3965095a09c057be7c90f0a2/collectInvestigationPackage
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Comment": "Collect forensics due to alert 1234"
|
||||
}
|
||||
|
||||
@ -96,9 +96,10 @@ If successful, this method returns 200 OK, and a new [alert](alerts.md) object i
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/alerts/CreateAlertByReference
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"machineId": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
|
||||
|
||||
@ -0,0 +1,357 @@
|
||||
---
|
||||
title: Address false positives/negatives in Microsoft Defender for Endpoint
|
||||
description: Learn how to handle false positives or false negatives in Microsoft Defender for Endpoint.
|
||||
keywords: alert, exclusion, defender atp, false positive, false negative
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: m365-security
|
||||
ms.technology: mde
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: deniseb
|
||||
author: denisebmsft
|
||||
ms.date: 01/26/2021
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection:
|
||||
- m365-security-compliance
|
||||
- m365initiative-defender-endpoint
|
||||
ms.topic: conceptual
|
||||
ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs, yonghree, jcedola
|
||||
ms.custom: FPFN
|
||||
---
|
||||
|
||||
# Address false positives/negatives in Microsoft Defender for Endpoint
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806)
|
||||
|
||||
In endpoint protection solutions, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution, including [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection).
|
||||
|
||||
Fortunately, steps can be taken to address and reduce these kinds of issues. If you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives:
|
||||
|
||||
1. [Review and classify alerts](#part-1-review-and-classify-alerts)
|
||||
2. [Review remediation actions that were taken](#part-2-review-remediation-actions)
|
||||
3. [Review and define exclusions](#part-3-review-or-define-exclusions)
|
||||
4. [Submit an entity for analysis](#part-4-submit-a-file-for-analysis)
|
||||
5. [Review and adjust your threat protection settings](#part-5-review-and-adjust-your-threat-protection-settings)
|
||||
|
||||
And, you can [get help if you still have issues with false positives/negatives](#still-need-help) after performing the tasks described in this article.
|
||||
|
||||
> [!NOTE]
|
||||
> This article is intended as guidance for security operators and security administrators who are using [Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md).
|
||||
|
||||
## Part 1: Review and classify alerts
|
||||
|
||||
If you see an alert that was triggered because something was detected as malicious or suspicious that should not have been, you can suppress the alert for that entity. You can also suppress alerts that are not necessarily false positives, but are unimportant. We recommend that you classify alerts as well.
|
||||
|
||||
Managing your alerts and classifying true/false positives helps to train your threat protection solution and can reduce the number of false positives or false negatives over time. Taking these steps also helps reduce noise in your security operations dashboard so that your security team can focus on higher priority work items.
|
||||
|
||||
### Determine whether an alert is accurate
|
||||
|
||||
Before you classify or suppress an alert, determine whether the alert is accurate, a false positive, or benign.
|
||||
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in.
|
||||
2. In the navigation pane, choose **Alerts queue**.
|
||||
3. Select an alert to more details about the alert. (See [Review alerts](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/review-alerts).)
|
||||
4. Depending on the alert status, take the steps described in the following table: <br/>
|
||||
|
||||
| Alert status | What to do |
|
||||
|:---|:---|
|
||||
| The alert is accurate | Assign the alert, and then [investigate it](investigate-alerts.md) further. |
|
||||
| The alert is a false positive | 1. [Classify the alert](#classify-an-alert) as a false positive. <br/>2. [Suppress the alert](#suppress-an-alert). <br/> 3. [Create an indicator](#indicators-for-microsoft-defender-for-endpoint) for Microsoft Defender for Endpoint. <br/> 4. [Submit a file to Microsoft for analysis](#part-4-submit-a-file-for-analysis). |
|
||||
| The alert is accurate, but benign (unimportant) | [Classify the alert](#classify-an-alert) as a true positive, and then [suppress the alert](#suppress-an-alert). |
|
||||
|
||||
### Classify an alert
|
||||
|
||||
Your security team can classify an alert as a false positive or a true positive in the Microsoft Defender Security Center, in the **Alerts queue**.
|
||||
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in.
|
||||
2. Select **Alerts queue**, and then select an alert that is a false positive.
|
||||
3. For the selected alert, select **Actions** > **Manage alert**. A flyout pane opens.
|
||||
4. In the **Manage alert** section, select either **True alert** or **False alert**. (Use **False alert** to classify a false positive.)
|
||||
|
||||
> [!TIP]
|
||||
> For more information about suppressing alerts, see [Manage Microsoft Defender for Endpoint alerts](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-alerts). And, if your organization is using a security information and event management (SIEM) server, make sure to define a suppression rule there, too.
|
||||
|
||||
### Suppress an alert
|
||||
|
||||
If you have alerts that are either false positives or that are true positives but are for unimportant events, you can suppress those alerts in the Microsoft Defender Security Center. Suppressing alerts helps reduce noise in your security operations dashboard.
|
||||
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in.
|
||||
2. In the navigation pane, select **Alerts queue**.
|
||||
3. Select an alert that you want to suppress to open its **Details** pane.
|
||||
4. In the **Details** pane, choose the ellipsis (**...**), and then **Create a suppression rule**.
|
||||
5. Specify all the settings for your suppression rule, and then choose **Save**.
|
||||
|
||||
> [!TIP]
|
||||
> Need help with suppression rules? See [Suppress an alert and create a new suppression rule](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-alerts#suppress-an-alert-and-create-a-new-suppression-rule).
|
||||
|
||||
## Part 2: Review remediation actions
|
||||
|
||||
[Remediation actions](manage-auto-investigation.md#remediation-actions), such as sending a file to quarantine or stopping a process, can be taken on entities that are detected as threats. Several types of remediation actions can occur automatically through automated investigation and Microsoft Defender Antivirus. Examples of such actions include:
|
||||
- Quarantine a file
|
||||
- Remove a registry key
|
||||
- Kill a process
|
||||
- Stop a service
|
||||
- Disable a driver
|
||||
- Remove a scheduled task
|
||||
|
||||
Other actions, such as starting an antivirus scan or collecting an investigation package, can occur through [Live Response](live-response.md). Those actions cannot be undone.
|
||||
|
||||
> [!TIP]
|
||||
> See [Review remediation actions following an automated investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation).
|
||||
|
||||
### Review completed actions
|
||||
|
||||
1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in.
|
||||
2. Select the **History** tab.
|
||||
3. Select an item to view more details about the remediation action that was taken.
|
||||
|
||||
If you find that a remediation action was taken automatically on an entity that is not actually a threat, you can undo the action. You can undo the following remediation actions:
|
||||
- Isolate device
|
||||
- Restrict code execution
|
||||
- Quarantine a file
|
||||
- Remove a registry key
|
||||
- Stop a service
|
||||
- Disable a driver
|
||||
- Remove a scheduled task
|
||||
|
||||
### Undo an action
|
||||
|
||||
1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in.
|
||||
2. On the **History** tab, select an action that you want to undo.
|
||||
3. In the flyout pane, select **Undo**. (If the action cannot be undone with this method, you will not see an **Undo** button.)
|
||||
|
||||
### Undo multiple actions at one time
|
||||
|
||||
1. Go to the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) and sign in.
|
||||
2. On the **History** tab, select the actions that you want to undo.
|
||||
3. In the pane on the right side of the screen, select **Undo**.
|
||||
|
||||
## Part 3: Review or define exclusions
|
||||
|
||||
An exclusion is an entity that you specify as an exception to remediation actions. The excluded entity might still get detected, but no remediation actions are taken on that entity. That is, the detected file or process won’t be stopped, sent to quarantine, removed, or otherwise changed by Microsoft Defender for Endpoint.
|
||||
|
||||
To define exclusions across Microsoft Defender for Endpoint, perform the following tasks:
|
||||
- [Define exclusions for Microsoft Defender Antivirus](#exclusions-for-microsoft-defender-antivirus)
|
||||
- [Create “allow” indicators for Microsoft Defender for Endpoint](#indicators-for-microsoft-defender-for-endpoint)
|
||||
|
||||
> [!NOTE]
|
||||
> Microsoft Defender Antivirus exclusions don't apply to other Microsoft Defender for Endpoint capabilities, including [endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response), [attack surface reduction rules](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction), and [controlled folder access](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/controlled-folders). Files that you exclude using the methods described in this article can still trigger alerts and other detections. To exclude files broadly, use [custom indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators), such as "allow" indicators for Microsoft Defender for Endpoint.
|
||||
|
||||
The procedures in this section describe how to define exclusions and indicators.
|
||||
|
||||
### Exclusions for Microsoft Defender Antivirus
|
||||
|
||||
In general, you should not need to define exclusions for Microsoft Defender Antivirus. Make sure that you define exclusions sparingly, and that you only include the files, folders, processes, and process-opened files that are resulting in false positives. In addition, make sure to review your defined exclusions regularly. We recommend using Microsoft Endpoint Manager to define or edit your antivirus exclusions; however, you can use other methods, such as Group Policy as well.
|
||||
|
||||
> [!TIP]
|
||||
> Need help with antivirus exclusions? See [Configure and validate exclusions for Microsoft Defender Antivirus scans](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-exclusions-microsoft-defender-antivirus).
|
||||
|
||||
#### Use Microsoft Endpoint Manager to manage antivirus exclusions (for existing policies)
|
||||
|
||||
1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in.
|
||||
2. Choose **Endpoint security** > **Antivirus**, and then select an existing policy. (If you don’t have an existing policy, or you want to create a new policy, skip to [the next procedure](#use-microsoft-endpoint-manager-to-create-a-new-antivirus-policy-with-exclusions)).
|
||||
3. Choose **Properties**, and next to **Configuration settings**, choose **Edit**.
|
||||
4. Expand **Microsoft Defender Antivirus Exclusions** and then specify your exclusions.
|
||||
5. Choose **Review + save**, and then choose **Save**.
|
||||
|
||||
#### Use Microsoft Endpoint Manager to create a new antivirus policy with exclusions
|
||||
|
||||
1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in.
|
||||
2. Choose **Endpoint security** > **Antivirus** > **+ Create Policy**.
|
||||
3. Select a platform (such as **Windows 10 and later**, **macOS**, or **Windows 10 and Windows Server**).
|
||||
4. For **Profile**, select **Microsoft Defender Antivirus exclusions**, and then choose **Create**.
|
||||
5. Specify a name and description for the profile, and then choose **Next**.
|
||||
6. On the **Configuration settings** tab, specify your antivirus exclusions, and then choose **Next**.
|
||||
7. On the **Scope tags** tab, if you are using scope tags in your organization, specify scope tags for the policy you are creating. (See [Scope tags](https://docs.microsoft.com/mem/intune/fundamentals/scope-tags).)
|
||||
8. On the **Assignments** tab, specify the users and groups to whom your policy should be applied, and then choose **Next**. (If you need help with assignments, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/mem/intune/configuration/device-profile-assign).)
|
||||
9. On the **Review + create** tab, review the settings, and then choose **Create**.
|
||||
|
||||
### Indicators for Microsoft Defender for Endpoint
|
||||
|
||||
[Indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators) (specifically, indicators of compromise, or IoCs) enable your security operations team to define the detection, prevention, and exclusion of entities. For example, you can specify certain files to be omitted from scans and remediation actions in Microsoft Defender for Endpoint. Or, indicators can be used to generate alerts for certain files, IP addresses, or URLs.
|
||||
|
||||
To specify entities as exclusions for Microsoft Defender for Endpoint, you can create "allow" indicators for those entities. Such "allow" indicators in Microsoft Defender for Endpoint apply to:
|
||||
|
||||
- [Next-generation protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10)
|
||||
- [Endpoint detection and response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response)
|
||||
- [Automated investigation & remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations)
|
||||
|
||||
You can create indicators for:
|
||||
- [Files](#indicators-for-files)
|
||||
- [IP addresses, URLs, and domains](#indicators-for-ip-addresses-urls-or-domains)
|
||||
- [Application certificates](#indicators-for-application-certificates)
|
||||
|
||||
#### Indicators for files
|
||||
|
||||
When you [create an "allow" indicator for a file, such as an executable](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-file), it helps prevent files that your organization is using from being blocked. Files can include portable executable (PE) files, such as `.exe` and `.dll` files.
|
||||
|
||||
Before you create indicators for files, make sure the following requirements are met:
|
||||
- Microsoft Defender Antivirus is configured with cloud-based protection enabled (See [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).)
|
||||
- Antimalware client version is 4.18.1901.x or later
|
||||
- Devices are running Windows 10, version 1703 or later; Windows Server 2016; or Windows Server 2019
|
||||
- The [Block or allow feature is turned on](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features)
|
||||
|
||||
#### Indicators for IP addresses, URLs, or domains
|
||||
|
||||
When you [create an "allow" indicator for an IP address, URL, or domain](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain), it helps prevent the sites or IP addresses your organization uses from being blocked.
|
||||
|
||||
Before you create indicators for IP addresses, URLs, or domains, make sure the following requirements are met:
|
||||
- Network protection in Defender for Endpoint is enabled in block mode (See [Enable network protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/enable-network-protection))
|
||||
- Antimalware client version is 4.18.1906.x or later
|
||||
- Devices are running Windows 10, version 1709, or later
|
||||
|
||||
Custom network indicators are turned on in the Microsoft Defender Security Center (See [Advanced features](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-features).)
|
||||
|
||||
#### Indicators for application certificates
|
||||
|
||||
When you [create an "allow" indicator for an application certificate](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates), it helps prevent applications, such as internally developed applications, that your organization uses from being blocked. `.CER` or `.PEM` file extensions are supported.
|
||||
|
||||
Before you create indicators for application certificates, make sure the following requirements are met:
|
||||
- Microsoft Defender Antivirus is configured with cloud-based protection enabled (See [Manage cloud-based protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus).)
|
||||
- Antimalware client version is 4.18.1901.x or later
|
||||
- Devices are running Windows 10, version 1703 or later; Windows Server 2016; or Windows Server 2019
|
||||
- Virus and threat protection definitions are up to date
|
||||
|
||||
> [!TIP]
|
||||
> When you create indicators, you can define them one by one or import multiple items at once. Keep in mind there's a limit of 15,000 indicators you can have in a single tenant. And, you might need to gather certain details first, such as file hash information. Make sure to review the prerequisites before you [create indicators](manage-indicators.md).
|
||||
|
||||
## Part 4: Submit a file for analysis
|
||||
|
||||
You can submit entities, such as files and fileless detections, to Microsoft for analysis. Microsoft security researchers analyze all submissions. When you sign in at the submission site, you can track your submissions.
|
||||
|
||||
### Submit a file for analysis
|
||||
|
||||
If you have a file that was either wrongly detected as malicious or was missed, follow these steps to submit the file for analysis.
|
||||
|
||||
1. Review the guidelines here: [Submit files for analysis](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide).
|
||||
2. Visit the Microsoft Security Intelligence submission site ([https://www.microsoft.com/wdsi/filesubmission](https://www.microsoft.com/wdsi/filesubmission)), and submit your file(s).
|
||||
|
||||
### Submit a fileless detection for analysis
|
||||
|
||||
If something was detected as malware based on behavior, and you don’t have a file, you can submit your `Mpsupport.cab` file for analysis. You can get the *.cab* file by using the Microsoft Malware Protection Command-Line Utility (MPCmdRun.exe) tool on Windows 10.
|
||||
|
||||
1. Go to ` C:\ProgramData\Microsoft\Windows Defender\Platform\<version>`, and then run `MpCmdRun.exe` as an administrator.
|
||||
2. Type `mpcmdrun.exe -GetFiles`, and then press **Enter**.
|
||||
A .cab file is generated that contains various diagnostic logs. The location of the file is specified in the output of the command prompt. By default, the location is `C:\ProgramData\Microsoft\Microsoft Defender\Support\MpSupportFiles.cab`.
|
||||
3. Review the guidelines here: [Submit files for analysis](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide).
|
||||
4. Visit the Microsoft Security Intelligence submission site ([https://www.microsoft.com/wdsi/filesubmission](https://www.microsoft.com/wdsi/filesubmission)), and submit your .cab files.
|
||||
|
||||
### What happens after a file is submitted?
|
||||
|
||||
Your submission is immediately scanned by our systems to give you the latest determination even before an analyst starts handling your case. It’s possible that a file might have already been submitted and processed by an analyst. In those cases, a determination is made quickly.
|
||||
|
||||
For submissions that were not already processed, they are prioritized for analysis as follows:
|
||||
|
||||
- Prevalent files with the potential to impact large numbers of computers are given a higher priority.
|
||||
- Authenticated customers, especially enterprise customers with valid [Software Assurance IDs (SAIDs)](https://www.microsoft.com/licensing/licensing-programs/software-assurance-default.aspx), are given a higher priority.
|
||||
- Submissions flagged as high priority by SAID holders are given immediate attention.
|
||||
|
||||
To check for updates regarding your submission, sign in at the [Microsoft Security Intelligence submission site](https://www.microsoft.com/wdsi/filesubmission).
|
||||
|
||||
> [!TIP]
|
||||
> To learn more, see [Submit files for analysis](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide#how-does-microsoft-prioritize-submissions).
|
||||
|
||||
## Part 5: Review and adjust your threat protection settings
|
||||
|
||||
Microsoft Defender for Endpoint offers a wide variety of options, including the ability to fine-tune settings for various features and capabilities. If you’re getting numerous false positives, make sure to review your organization’s threat protection settings. You might need to make some adjustments to the following settings in particular:
|
||||
|
||||
- [Cloud-delivered protection](#cloud-delivered-protection)
|
||||
- [Remediation for potentially unwanted applications](#remediation-for-potentially-unwanted-applications)
|
||||
- [Automated investigation and remediation](#automated-investigation-and-remediation)
|
||||
|
||||
### Cloud-delivered protection
|
||||
|
||||
Check your cloud-delivered protection level for Microsoft Defender Antivirus. By default, cloud-delivered protection is set to **Not configured**, which corresponds to a normal level of protection for most organizations. If your cloud-delivered protection is set to **High**, **High +**, or **Zero tolerance**, you might experience a higher number of false positives.
|
||||
|
||||
> [!TIP]
|
||||
> To learn more about configuring your cloud-delivered protection, see [Specify the cloud-delivered protection level](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/specify-cloud-protection-level-microsoft-defender-antivirus).
|
||||
|
||||
We recommend using Microsoft Endpoint Manager to edit or set your cloud-delivered protection settings.
|
||||
|
||||
#### Use Microsoft Endpoint Manager to review and edit cloud-delivered protection settings (for existing policies)
|
||||
|
||||
1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in.
|
||||
2. Choose **Endpoint security** > **Antivirus** and then select an existing policy. (If you don’t have an existing policy, or you want to create a new policy, skip to [the next procedure](#use-microsoft-endpoint-manager-to-set-cloud-delivered-protection-settings-for-a-new-policy)).
|
||||
3. Under **Manage**, select **Properties**. Then, next to **Configuration settings**, choose **Edit**.
|
||||
4. Expand **Cloud protection**, and review your current setting in the **Cloud-delivered protection level** row. We recommend setting cloud-delivered protection to **Not configured**, which provides strong protection while reducing the chances of getting false positives.
|
||||
5. Choose **Review + save**, and then **Save**.
|
||||
|
||||
#### Use Microsoft Endpoint Manager to set cloud-delivered protection settings (for a new policy)
|
||||
|
||||
1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in.
|
||||
2. Choose **Endpoint security** > **Antivirus** > **+ Create policy**.
|
||||
3. For **Platform**, select an option, and then for **Profile**, select **Antivirus** or **Microsoft Defender Antivirus** (the specific option depends on what you selected for **Platform**.) Then choose **Create**.
|
||||
4. On the **Basics** tab, specify a name and description for the policy. Then choose **Next**.
|
||||
5. On the **Configuration settings** tab, expand **Cloud protection**, and specify the following settings:
|
||||
- Set **Turn on cloud-delivered protection** to **Yes**.
|
||||
- Set **Cloud-delivered protection level** to **Not configured**. (This level provides a strong level of protection by default while reducing the chances of getting false positives.)
|
||||
6. On the **Scope tags** tab, if you are using scope tags in your organization, specify scope tags for the policy. (See [Scope tags](https://docs.microsoft.com/mem/intune/fundamentals/scope-tags).)
|
||||
8. On the **Assignments** tab, specify the users and groups to whom your policy should be applied, and then choose **Next**. (If you need help with assignments, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/mem/intune/configuration/device-profile-assign).)
|
||||
9. On the **Review + create** tab, review the settings, and then choose **Create**.
|
||||
|
||||
### Remediation for potentially unwanted applications
|
||||
|
||||
Potentially unwanted applications (PUA) are a category of software that can cause devices to run slowly, display unexpected ads, or install other software that might be unexpected or unwanted. Examples of PUA include advertising software, bundling software, and evasion software that behaves differently with security products. Although PUA is not considered malware, some kinds of software are PUA based on their behavior and reputation.
|
||||
|
||||
Depending on the apps your organization is using, you might be getting false positives as a result of your PUA protection settings. If necessary, consider running PUA protection in audit mode for a while, or apply PUA protection to a subset of devices in your organization. PUA protection can be configured for the Microsoft Edge browser and for Microsoft Defender Antivirus.
|
||||
|
||||
We recommend using Microsoft Endpoint Manager to edit or set PUA protection settings.
|
||||
|
||||
> [!TIP]
|
||||
> To learn more about PUA, see [Detect and block potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus).
|
||||
|
||||
#### Use Microsoft Endpoint Manager to edit PUA protection (for existing configuration profiles)
|
||||
|
||||
1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in.
|
||||
2. Choose **Devices** > **Configuration profiles**, and then select an existing policy. (If you don’t have an existing policy, or you want to create a new policy, skip to [the next procedure](#use-microsoft-endpoint-manager-to-set-pua-protection-for-a-new-configuration-profile).)
|
||||
3. Under **Manage**, choose **Properties**, and then, next to **Configuration settings**, choose **Edit**.
|
||||
4. On the **Configuration settings** tab, scroll down and expand **Microsoft Defender Antivirus**.
|
||||
5. Set **Detect potentially unwanted applications** to **Audit**. (You can turn it off, but by using audit mode, you will be able to see detections.)
|
||||
6. Choose **Review + save**, and then choose **Save**.
|
||||
|
||||
#### Use Microsoft Endpoint Manager to set PUA protection (for a new configuration profile)
|
||||
|
||||
1. Go to the Microsoft Endpoint Manager admin center ([https://endpoint.microsoft.com](https://endpoint.microsoft.com)) and sign in.
|
||||
2. Choose **Devices** > **Configuration profiles** > **+ Create profile**.
|
||||
3. For the **Platform**, choose **Windows 10 and later**, and for **Profile**, select **Device restrictions**.
|
||||
4. On the **Basics** tab, specify a name and description for your policy. Then choose **Next**.
|
||||
5. On the **Configuration settings** tab, scroll down and expand **Microsoft Defender Antivirus**.
|
||||
6. Set **Detect potentially unwanted applications** to **Audit**, and then choose **Next**. (You can turn off PUA protection, but by using audit mode, you will be able to see detections.)
|
||||
7. On the **Assignments** tab, specify the users and groups to whom your policy should be applied, and then choose **Next**. (If you need help with assignments, see [Assign user and device profiles in Microsoft Intune](https://docs.microsoft.com/mem/intune/configuration/device-profile-assign).)
|
||||
8. On the **Applicability Rules** tab, specify the OS editions or versions to include or exclude from the policy. For example, you can set the policy to be applied to all devices certain editions of Windows 10. Then choose **Next**.
|
||||
9. On the **Review + create** tab, review your settings, and, and then choose **Create**.
|
||||
|
||||
### Automated investigation and remediation
|
||||
|
||||
[Automated investigation and remediation](automated-investigations.md) (AIR) capabilities are designed to examine alerts and take immediate action to resolve breaches. As alerts are triggered, and an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*.
|
||||
|
||||
Depending on the [level of automation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automation-levels) set for your organization and other security settings, remediation actions are taken on artifacts deemed Malicious or Suspicious. Remediation actions can occur automatically, or only upon approval by your security operations team.
|
||||
|
||||
- [Learn more about automation levels](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automation-levels); and then
|
||||
- [Configure AIR capabilities in Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-automated-investigations-remediation).
|
||||
|
||||
> [!TIP]
|
||||
> We recommend using *Full automation* for automated investigation and remediation. Don't turn these capabilities off because of a false positive. Instead, use ["allow" indicators to define exceptions](#indicators-for-microsoft-defender-for-endpoint), and keep automated investigation and remediation set to take appropriate actions automatically. Following [this guidance](automation-levels.md#levels-of-automation) helps reduce the number of alerts your security operations team must handle.
|
||||
|
||||
|
||||
## Still need help?
|
||||
|
||||
If you have worked through all the steps in this article and still need help, your best bet is to contact technical support.
|
||||
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in.
|
||||
2. In the upper right corner, select the question mark (**?**), and then select **Microsoft support**.
|
||||
3. In the Support Assistant window, describe your issue, and then send your message. From there, you can open a service request.
|
||||
|
||||
## See also
|
||||
|
||||
[Manage Microsoft Defender for Endpoint](manage-atp-post-migration.md)
|
||||
|
||||
[Overview of Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use)
|
||||
@ -73,6 +73,6 @@ If Indicator with the specified id was not found - 404 Not Found.
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
DELETE https://api.securitycenter.microsoft.com/api/indicators/995
|
||||
```
|
||||
|
||||
@ -15,7 +15,7 @@ ms.localizationpriority: medium
|
||||
ms.custom:
|
||||
- next-gen
|
||||
- edr
|
||||
ms.date: 01/07/2021
|
||||
ms.date: 01/26/2021
|
||||
ms.collection:
|
||||
- m365-security-compliance
|
||||
- m365initiative-defender-endpoint
|
||||
@ -70,7 +70,7 @@ The following image shows an instance of unwanted software that was detected and
|
||||
|Requirement |Details |
|
||||
|---------|---------|
|
||||
|Permissions |Global Administrator or Security Administrator role assigned in [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). See [Basic permissions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions). |
|
||||
|Operating system |One of the following versions: <br/>- Windows 10 (all releases) <br/>- Windows Server 2016 or later |
|
||||
|Operating system |One of the following versions: <br/>- Windows 10 (all releases) <br/>- Windows Server, version 1803 or newer <br/>- Windows Server 2019 |
|
||||
|Windows E5 enrollment |Windows E5 is included in the following subscriptions: <br/>- Microsoft 365 E5 <br/>- Microsoft 365 E3 together with the Identity & Threat Protection offering <br/><br/>See [Components](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide&preserve-view=true#components) and [features and capabilities for each plan](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans). |
|
||||
|Microsoft Defender Antivirus |Microsoft Defender Antivirus must be installed and running in either active mode or passive mode. (You can use Microsoft Defender Antivirus alongside a non-Microsoft antivirus solution.) [Confirm Microsoft Defender Antivirus is in active or passive mode](#how-do-i-confirm-microsoft-defender-antivirus-is-in-active-or-passive-mode). |
|
||||
|Cloud-delivered protection |Make sure Microsoft Defender Antivirus is configured such that [cloud-delivered protection is enabled](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus). |
|
||||
|
||||
@ -1,96 +0,0 @@
|
||||
---
|
||||
title: Find device information by internal IP API
|
||||
description: Use this API to create calls related to finding a device entry around a specific timestamp by internal IP.
|
||||
keywords: ip, apis, graph api, supported apis, find device, device information
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: m365-security
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Find device information by internal IP API
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
|
||||
|
||||
[!include[Improve request performance](../../includes/improve-request-performance.md)]
|
||||
|
||||
Find a device by internal IP.
|
||||
|
||||
>[!NOTE]
|
||||
>The timestamp must be within the last 30 days.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Machine.Read.All | 'Read all machine profiles'
|
||||
Application | Machine.ReadWrite.All | 'Read and write all machine information'
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/machines/find(timestamp={time},key={IP})
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and machine exists - 200 OK.
|
||||
If no machine found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/machines/find(timestamp=2018-06-19T10:00:00Z,key='10.166.93.61')
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
The response will return a list of all devices that reported this IP address within sixteen minutes prior and after the timestamp.
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Machines",
|
||||
"value": [
|
||||
{
|
||||
"id": "04c99d46599f078f1c3da3783cf5b95f01ac61bb",
|
||||
"computerDnsName": "",
|
||||
"firstSeen": "2017-07-06T01:25:04.9480498Z",
|
||||
"osPlatform": "Windows10",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -80,6 +80,6 @@ If the timestamp is not in the past 30 days - 400 Bad Request.
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/machines/findbyip(ip='10.248.240.38',timestamp=2019-09-22T08:44:05Z)
|
||||
```
|
||||
|
||||
@ -0,0 +1,89 @@
|
||||
---
|
||||
title: Find devices by tag API
|
||||
description: Find all devices that contain specifc tag
|
||||
keywords: apis, supported apis, get, device, find, find device, by tag, tag
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Find devices by tag API
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
|
||||
|
||||
[!include[Improve request performance](../../includes/improve-request-performance.md)]
|
||||
|
||||
|
||||
## API description
|
||||
Find [Machines](machine.md) by [Tag](machine-tags.md).
|
||||
<br>```startswith``` query is supported.
|
||||
|
||||
## Limitations
|
||||
1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.
|
||||
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Machine.Read.All | 'Read all machine profiles'
|
||||
Application | Machine.ReadWrite.All | 'Read and write all machine information'
|
||||
Delegated (work or school account) | Machine.Read | 'Read machine information'
|
||||
Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine information'
|
||||
|
||||
>[!Note]
|
||||
> When obtaining a token using user credentials:
|
||||
> - Response will include only devices that the user have access to based on device group settings (See [Create and manage device groups](machine-groups.md) for more information)
|
||||
> - The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information)
|
||||
> - Response will include only devices that the user have access to based on device group settings (See [Create and manage device groups](machine-groups.md) for more information)
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/machines/findbytag?tag={tag}&useStartsWithFilter={true/false}
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
## Request URI parameters
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
tag | String | The tag name. **Required**.
|
||||
useStartsWithFilter | Boolean | When set to true, the search will find all devices with tag name that starts with the given tag in the query. Defaults to false. **Optional**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful - 200 OK with list of the machines in the response body.
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/machines/findbytag?tag=testTag&useStartsWithFilter=true
|
||||
```
|
||||
@ -77,7 +77,7 @@ If successful and alert and domain exist - 200 OK. If alert not found - 404 Not
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/alerts/636688558380765161_2136280442/domains
|
||||
```
|
||||
|
||||
@ -85,9 +85,7 @@ GET https://api.securitycenter.microsoft.com/alerts/636688558380765161_213628044
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/$metadata#Domains",
|
||||
"value": [
|
||||
|
||||
@ -77,7 +77,7 @@ If successful and alert and files exist - 200 OK. If alert not found - 404 Not F
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/alerts/636688558380765161_2136280442/files
|
||||
```
|
||||
|
||||
@ -86,9 +86,7 @@ GET https://api.securitycenter.microsoft.com/api/alerts/636688558380765161_21362
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Files",
|
||||
"value": [
|
||||
|
||||
@ -78,7 +78,7 @@ If successful and alert and an IP exist - 200 OK. If alert not found - 404 Not F
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/alerts/636688558380765161_2136280442/ips
|
||||
```
|
||||
|
||||
@ -87,9 +87,7 @@ GET https://api.securitycenter.microsoft.com/alerts/636688558380765161_213628044
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/$metadata#Ips",
|
||||
"value": [
|
||||
|
||||
@ -79,7 +79,7 @@ If successful and alert and device exist - 200 OK. If alert not found or device
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/alerts/636688558380765161_2136280442/machine
|
||||
```
|
||||
|
||||
@ -88,9 +88,7 @@ GET https://api.securitycenter.microsoft.com/api/alerts/636688558380765161_21362
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines/$entity",
|
||||
"id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
|
||||
|
||||
@ -78,7 +78,7 @@ If successful and alert and a user exists - 200 OK with user in the body. If ale
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/alerts/636688558380765161_2136280442/user
|
||||
```
|
||||
|
||||
@ -87,9 +87,7 @@ GET https://api.securitycenter.microsoft.com/api/alerts/636688558380765161_21362
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Users/$entity",
|
||||
"id": "contoso\\user1",
|
||||
|
||||
@ -88,7 +88,7 @@ If successful, this method returns 200 OK, and a list of [alert](alerts.md) obje
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/alerts
|
||||
```
|
||||
|
||||
@ -152,7 +152,7 @@ Here is an example of the response.
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/alerts?$top=10&$expand=evidence
|
||||
```
|
||||
|
||||
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK with the list of security recommendati
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/recommendations
|
||||
```
|
||||
|
||||
|
||||
@ -72,7 +72,7 @@ If successful, this method returns 200 OK with the list of vulnerabilities in th
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/vulnerabilities/machinesVulnerabilities
|
||||
```
|
||||
|
||||
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK with the list of vulnerabilities in th
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/Vulnerabilities
|
||||
```
|
||||
|
||||
|
||||
@ -61,18 +61,15 @@ If successful and map exists - 200 OK.
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://graph.microsoft.com/testwdatppreview/CveKbMap
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context":"https://graph.microsoft.com/testwdatppreview/$metadata#CveKbMap",
|
||||
"@odata.count": 4168,
|
||||
|
||||
@ -68,7 +68,7 @@ If successful, this method returns 200 OK, with the device secure score data in
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/configurationScore
|
||||
```
|
||||
|
||||
|
||||
@ -30,8 +30,12 @@ ms.technology: mde
|
||||
|
||||
[!include[Improve request performance](../../includes/improve-request-performance.md)]
|
||||
|
||||
## API description
|
||||
Retrieves a collection of discovered vulnerabilities related to a given device ID.
|
||||
|
||||
## Limitations
|
||||
1. Rate limitations for this API are 50 calls per minute and 1500 calls per hour.
|
||||
|
||||
## Permissions
|
||||
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||
@ -67,7 +71,7 @@ If successful, this method returns 200 OK with the discovered vulnerability info
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/vulnerabilities
|
||||
```
|
||||
|
||||
@ -75,7 +79,7 @@ GET https://api.securitycenter.microsoft.com/api/machines/ac233fa6208e1579620bf4
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
|
||||
"value": [
|
||||
|
||||
@ -62,6 +62,11 @@ Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
|
||||
## Request URI parameters
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
lookBackHours | Int32 | Defines the hours we search back to get the statistics. Defaults to 30 days. **Optional**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
@ -76,8 +81,8 @@ If successful and domain exists - 200 OK, with statistics object in the response
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.microsoft.com/api/domains/example.com/stats
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/domains/example.com/stats?lookBackHours=48
|
||||
```
|
||||
|
||||
**Response**
|
||||
@ -85,9 +90,7 @@ GET https://api.securitycenter.microsoft.com/api/domains/example.com/stats
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgDomainStats",
|
||||
"host": "example.com",
|
||||
|
||||
@ -70,7 +70,7 @@ If successful, this method returns 200 OK, with the exposure data in the respons
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/exposureScore
|
||||
```
|
||||
|
||||
|
||||
@ -76,7 +76,7 @@ If successful and file exists - 200 OK with the [file](files.md) entity in the b
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/files/4388963aaa83afe2042a46a3c017ad50bdcdafb3
|
||||
```
|
||||
|
||||
@ -85,9 +85,7 @@ GET https://api.securitycenter.microsoft.com/api/files/4388963aaa83afe2042a46a3c
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Files/$entity",
|
||||
"sha1": "4388963aaa83afe2042a46a3c017ad50bdcdafb3",
|
||||
|
||||
@ -79,6 +79,6 @@ If successful and file exists - 200 OK with list of [alert](alerts.md) entities
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/files/6532ec91d513acc05f43ee0aa3002599729fd3e1/alerts
|
||||
```
|
||||
|
||||
@ -79,6 +79,6 @@ If successful and file exists - 200 OK with list of [machine](machine.md) entiti
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/files/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/machines
|
||||
```
|
||||
|
||||
@ -62,6 +62,11 @@ Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
## Request URI parameters
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
lookBackHours | Int32 | Defines the hours we search back to get the statistics. Defaults to 30 days. **Optional**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
@ -76,8 +81,8 @@ If successful and file exists - 200 OK with statistical data in the body. If fil
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://api.securitycenter.microsoft.com/api/files/0991a395da64e1c5fbe8732ed11e6be064081d9f/stats
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/files/0991a395da64e1c5fbe8732ed11e6be064081d9f/stats?lookBackHours=48
|
||||
```
|
||||
|
||||
**Response**
|
||||
@ -85,9 +90,7 @@ GET https://api.securitycenter.microsoft.com/api/files/0991a395da64e1c5fbe8732ed
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgFileStats",
|
||||
"sha1": "0991a395da64e1c5fbe8732ed11e6be064081d9f",
|
||||
|
||||
@ -66,7 +66,7 @@ If successful, this method returns 200 OK with the installed software informatio
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/software
|
||||
```
|
||||
|
||||
|
||||
@ -90,9 +90,7 @@ GET https://api.securitycenter.microsoft.com/api/investigations
|
||||
|
||||
Here is an example of the response:
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Investigations",
|
||||
"value": [
|
||||
|
||||
@ -79,6 +79,6 @@ If successful and IP exists - 200 OK with list of [alert](alerts.md) entities in
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/ips/10.209.67.177/alerts
|
||||
```
|
||||
|
||||
@ -63,6 +63,11 @@ Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
|
||||
## Request URI parameters
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
lookBackHours | Int32 | Defines the hours we search back to get the statistics. Defaults to 30 days. **Optional**.
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
@ -78,7 +83,7 @@ If successful and ip exists - 200 OK with statistical data in the body. IP do no
|
||||
Here is an example of the request.
|
||||
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/ips/10.209.67.177/stats
|
||||
GET https://api.securitycenter.microsoft.com/api/ips/10.209.67.177/stats?lookBackHours=48
|
||||
```
|
||||
|
||||
**Response**
|
||||
@ -86,9 +91,7 @@ GET https://api.securitycenter.microsoft.com/api/ips/10.209.67.177/stats
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```http
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#microsoft.windowsDefenderATP.api.InOrgIPStats",
|
||||
"ipAddress": "10.209.67.177",
|
||||
|
||||
@ -61,18 +61,15 @@ If successful - 200 OK.
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://graph.microsoft.com/testwdatppreview/KbInfo
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#KbInfo",
|
||||
"@odata.count": 271,
|
||||
|
||||
@ -91,9 +91,7 @@ GET https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c29
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```http
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machine",
|
||||
"id": "1e5bc9d7e413ddd7902c2932e418702b84d0cc07",
|
||||
|
||||
@ -70,7 +70,7 @@ If successful, this method returns 200 OK, with a list of exposure score per dev
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/exposureScore/ByMachineGroups
|
||||
```
|
||||
|
||||
|
||||
@ -87,9 +87,7 @@ GET https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c29
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```http
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Users",
|
||||
"value": [
|
||||
|
||||
@ -77,7 +77,7 @@ If successful, this method returns 200, Ok response code with a [Machine Action]
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/machineactions/2e9da30d-27f6-4208-81f2-9cd3d67893ba
|
||||
```
|
||||
|
||||
@ -86,9 +86,7 @@ GET https://api.securitycenter.microsoft.com/api/machineactions/2e9da30d-27f6-42
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineActions/$entity",
|
||||
"id": "5382f7ea-7557-4ab7-9782-d50480024a4e",
|
||||
|
||||
@ -82,7 +82,7 @@ If successful, this method returns 200, Ok response code with a collection of [m
|
||||
|
||||
Here is an example of the request on an organization that has three MachineActions.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/machineactions
|
||||
```
|
||||
|
||||
@ -91,9 +91,7 @@ GET https://api.securitycenter.microsoft.com/api/machineactions
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineActions",
|
||||
"value": [
|
||||
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK and a list of devices with the softwar
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge/machineReferences
|
||||
```
|
||||
|
||||
@ -76,7 +76,6 @@ GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge/machi
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#MachineReferences",
|
||||
"value": [
|
||||
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK with the vulnerability information in
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/vulnerabilities/CVE-2019-0608/machineReferences
|
||||
```
|
||||
|
||||
|
||||
@ -92,9 +92,7 @@ GET https://api.securitycenter.microsoft.com/api/machines
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```http
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Machines",
|
||||
"value": [
|
||||
|
||||
@ -60,9 +60,8 @@ If successful - 200 OK.
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://graph.microsoft.com/testwdatppreview/machinesecuritystates
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
**Response**
|
||||
@ -70,9 +69,7 @@ Content-type: application/json
|
||||
Here is an example of the response.
|
||||
Field *id* contains device id and equal to the field *id** in devices info.
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context":"https://graph.microsoft.com/testwdatppreview/$metadata#MachineSecurityStates",
|
||||
"@odata.count":444,
|
||||
|
||||
@ -30,7 +30,11 @@ ms.technology: mde
|
||||
|
||||
[!include[Improve request performance](../../includes/improve-request-performance.md)]
|
||||
|
||||
Retrieves missing KBs (security updates) by device ID
|
||||
## API description
|
||||
Retrieves missing KBs (security updates) by device ID.
|
||||
|
||||
## Limitations
|
||||
1. Rate limitations for this API are 50 calls per minute and 1500 calls per hour.
|
||||
|
||||
## HTTP request
|
||||
|
||||
@ -58,7 +62,7 @@ If successful, this method returns 200 OK, with the specified device missing kb
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/machines/2339ad14a01bd0299afb93dfa2550136057bff96/getmissingkbs
|
||||
```
|
||||
|
||||
|
||||
@ -68,7 +68,7 @@ If successful, this method returns 200 OK, with the specified software missing k
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge/getmissingkbs
|
||||
```
|
||||
|
||||
|
||||
@ -73,19 +73,15 @@ If successful, this method returns 200, Ok response code with object that holds
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/machineactions/7327b54fd718525cbca07dacde913b5ac3c85673/GetPackageUri
|
||||
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
Content-type: application/json
|
||||
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Edm.String",
|
||||
"value": "\"https://userrequests-us.securitycenter.windows.com:443/safedownload/WDATP_Investigation_Package.zip?token=gbDyj7y%2fbWGAZjn2sFiZXlliBTXOCVG7yiJ6mXNaQ9pLByC2Wxeno9mENsPFP3xMk5l%2bZiJXjLvqAyNEzUNROxoM2I1er9dxzfVeBsxSmclJjPsAx%2btiNyxSz1Ax%2b5jaT5cL5bZg%2b8wgbwY9urXbTpGjAKh6FB1e%2b0ypcWkPm8UkfOwsmtC%2biZJ2%2bPqnkkeQk7SKMNoAvmh9%2fcqDIPKXGIBjMa0D9auzypOqd8bQXp7p2BnLSH136BxST8n9IHR4PILvRjAYW9kvtHkBpBitfydAsUW4g2oDZSPN3kCLBOoo1C4w4Lkc9Bc3GNU2IW6dfB7SHcp7G9p4BDkeJl3VuDs6esCaeBorpn9FKJ%2fXo7o9pdcI0hUPZ6Ds9hiPpwPUtz5J29CBE3QAopCK%2fsWlf6OW2WyXsrNRSnF1tVE5H3wXpREzuhD7S4AIA3OIEZKzC4jIPLeMu%2bazZU9xGwuc3gICOaokbwMJiZTqcUuK%2fV9YdBdjdg8wJ16NDU96Pl6%2fgew2KYuk6Wo7ZuHotgHI1abcsvdlpe4AvixDbqcRJthsg2PpLRaFLm5av44UGkeK6TJpFvxUn%2f9fg6Zk5yM1KUTHb8XGmutoCM8U9er6AzXZlY0gGc3D3bQOg41EJZkEZLyUEbk1hXJB36ku2%2bW01cG71t7MxMBYz7%2bdXobxpdo%3d%3bRWS%2bCeoDfTyDcfH5pkCg6hYDmCOPr%2fHYQuaUWUBNVnXURYkdyOzVHqp%2fe%2f1BNyPdVoVkpQHpz1pPS3b5g9h7IMmNKCk5gFq5m2nPx6kk9EYtzx8Ndoa2m9Yj%2bSaf8zIFke86YnfQL4AYewsnQNJJh4wc%2bXxGlBq7axDcoiOdX91rKzVicH3GSBkFoLFAKoegWWsF%2fEDZcVpF%2fXUA1K8HvB6dwyfy4y0sAqnNPxYTQ97mG7yHhxPt4Pe9YF2UPPAJVuEf8LNlQ%2bWHC9%2f7msF6UUI4%2fca%2ftpjFs%2fSNeRE8%2fyQj21TI8YTF1SowvaJuDc1ivEoeopNNGG%2bGI%2fX0SckaVxU9Hdkh0zbydSlT5SZwbSwescs0IpzECitBbaLUz4aT8KTs8T0lvx8D7Te3wVsKAJ1r3iFMQZrlk%2bS1WW8rvac7oHRx2HKURn1v7fDIQWgJr9aNsNlFz4fLJ50T2qSHuuepkLVbe93Va072aMGhvr09WVKoTpAf1j2bcFZZU6Za5PxI32mr0k90FgiYFJ1F%2f1vRDrGwvWVWUkR3Z33m4g0gHa52W1FMxQY0TJIwbovD6FaSNDx7xhKZSd5IJ7r6P91Gez49PaZRcAZPjd%2bfbul3JNm1VqQPTLohT7wa0ymRiXpSST74xtFzuEBzNSNATdbngj3%2fwV4JesTjZjIj5Dc%3d%3blumqauVlFuuO8MQffZgs0tLJ4Fq6fpeozPTdDf8Ll6XLegi079%2b4mSPFjTK0y6eohstxdoOdom2wAHiZwk0u4KLKmRkfYOdT1wHY79qKoBQ3ZDHFTys9V%2fcwKGl%2bl8IenWDutHygn5IcA1y7GTZj4g%3d%3d\""
|
||||
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK with the security recommendations in t
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/recommendations/va-_-google-_-chrome
|
||||
```
|
||||
|
||||
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK with the list of devices associated wi
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/recommendations/va-_-google-_-chrome/machineReferences
|
||||
```
|
||||
|
||||
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK with the software associated with the
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/recommendations/va-_-google-_-chrome/software
|
||||
```
|
||||
|
||||
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK, with the list of vulnerabilities asso
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/recommendations/va-_-google-_-chrome/vulnerabilities
|
||||
```
|
||||
|
||||
|
||||
@ -31,8 +31,12 @@ ms.technology: mde
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
## API description
|
||||
Retrieves a collection of security recommendations related to a given device ID.
|
||||
|
||||
## Limitations
|
||||
1. Rate limitations for this API are 50 calls per minute and 1500 calls per hour.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||
|
||||
@ -66,7 +70,7 @@ If successful, this method returns 200 OK with the security recommendations in t
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/machines/ac233fa6208e1579620bf44207c4006ed7cc4501/recommendations
|
||||
```
|
||||
|
||||
@ -75,7 +79,7 @@ GET https://api.securitycenter.microsoft.com/api/machines/ac233fa6208e1579620bf4
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Recommendations",
|
||||
"value": [
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get software by Id
|
||||
description: Retrieves a list of exposure scores by device group.
|
||||
description: Retrieves a list of sofware by ID.
|
||||
keywords: apis, graph api, supported apis, get, software, mdatp tvm api
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: m365-security
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK with the specified software data in th
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge
|
||||
```
|
||||
|
||||
@ -76,7 +76,6 @@ GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Software/$entity",
|
||||
"id": "microsoft-_-edge",
|
||||
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK with a list of software distributions
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge/distributions
|
||||
```
|
||||
|
||||
@ -76,7 +76,6 @@ GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge/distr
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Distributions",
|
||||
"value": [
|
||||
|
||||
@ -66,7 +66,7 @@ If successful, this method returns 200 OK with the software inventory in the bod
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/Software
|
||||
```
|
||||
|
||||
|
||||
@ -78,7 +78,7 @@ If successful, this method returns 200, Ok response code with a collection of [I
|
||||
|
||||
Here is an example of a request that gets all Indicators
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/indicators
|
||||
```
|
||||
|
||||
@ -86,9 +86,7 @@ GET https://api.securitycenter.microsoft.com/api/indicators
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators",
|
||||
"value": [
|
||||
@ -141,7 +139,7 @@ Content-type: application/json
|
||||
|
||||
Here is an example of a request that gets all Indicators with 'AlertAndBlock' action
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/indicators?$filter=action+eq+'AlertAndBlock'
|
||||
```
|
||||
|
||||
@ -149,9 +147,7 @@ GET https://api.securitycenter.microsoft.com/api/indicators?$filter=action+eq+'A
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```
|
||||
HTTP/1.1 200 Ok
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Indicators",
|
||||
"value": [
|
||||
|
||||
@ -64,9 +64,8 @@ If successful and user exists - 200 OK with [user](user.md) entity in the body.
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/users/user1
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
**Response**
|
||||
@ -74,9 +73,7 @@ Content-type: application/json
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
```json
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Users/$entity",
|
||||
"id": "user1",
|
||||
|
||||
@ -81,6 +81,6 @@ If successful and user exists - 200 OK. If the user does not exist - 404 Not Fou
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/users/user1/alerts
|
||||
```
|
||||
|
||||
@ -82,6 +82,6 @@ If successful and user exists - 200 OK with list of [machine](machine.md) entiti
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/users/user1/machines
|
||||
```
|
||||
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK with a a list of vulnerabilities expos
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge/vulnerabilities
|
||||
```
|
||||
|
||||
@ -76,7 +76,6 @@ GET https://api.securitycenter.microsoft.com/api/Software/microsoft-_-edge/vulne
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
|
||||
{
|
||||
"@odata.context": "https://api.securitycenter.microsoft.com/api/$metadata#Collection(Analytics.Contracts.PublicAPI.PublicVulnerabilityDto)",
|
||||
"value": [
|
||||
|
||||
@ -67,7 +67,7 @@ If successful, this method returns 200 OK with the vulnerability information in
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
GET https://api.securitycenter.microsoft.com/api/Vulnerabilities/CVE-2019-0608
|
||||
```
|
||||
|
||||
|
||||
@ -29,31 +29,33 @@ ms.technology: mde
|
||||
Access helpful resources such as links to blogs and other resources related to Microsoft Defender for Endpoint.
|
||||
|
||||
## Endpoint protection platform
|
||||
- [Top scoring in industry
|
||||
- [Top scoring in industry
|
||||
tests](https://docs.microsoft.com/windows/security/threat-protection/intelligence/top-scoring-industry-antivirus-tests)
|
||||
|
||||
- [Inside out: Get to know the advanced technologies at the core of Defender for Endpoint next generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/)
|
||||
- [Inside out: Get to know the advanced technologies at the core of Defender for Endpoint next generation protection](https://www.microsoft.com/security/blog/2019/06/24/inside-out-get-to-know-the-advanced-technologies-at-the-core-of-microsoft-defender-atp-next-generation-protection/)
|
||||
|
||||
- [Protecting disconnected devices with Defender for Endpoint](https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/Protecting-disconnected-devices-with-Microsoft-Defender-ATP/ba-p/500341)
|
||||
- [Protecting disconnected devices with Defender for Endpoint](https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/Protecting-disconnected-devices-with-Microsoft-Defender-ATP/ba-p/500341)
|
||||
|
||||
- [Tamper protection in Defender for Endpoint](https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/Tamper-protection-in-Microsoft-Defender-ATP/ba-p/389571)
|
||||
- [Tamper protection in Defender for Endpoint](https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/Tamper-protection-in-Microsoft-Defender-ATP/ba-p/389571)
|
||||
|
||||
## Endpoint Detection Response
|
||||
|
||||
- [Incident response at your fingertips with Defender for Endpoint live response](https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/Incident-response-at-your-fingertips-with-Microsoft-Defender-ATP/ba-p/614894)
|
||||
- [Incident response at your fingertips with Defender for Endpoint live response](https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/Incident-response-at-your-fingertips-with-Microsoft-Defender-ATP/ba-p/614894)
|
||||
|
||||
## Threat Vulnerability Management
|
||||
|
||||
- [Defender for Endpoint Threat & Vulnerability Management now publicly
|
||||
- [Defender for Endpoint Threat & Vulnerability Management now publicly
|
||||
available!](https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/MDATP-Threat-amp-Vulnerability-Management-now-publicly-available/ba-p/460977)
|
||||
|
||||
## Operational
|
||||
|
||||
- [The Golden Hour remake - Defining metrics for a successful security
|
||||
- [The Golden Hour remake - Defining metrics for a successful security
|
||||
operations](https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/The-Golden-Hour-remake-Defining-metrics-for-a-successful/ba-p/782014)
|
||||
|
||||
- [Defender for Endpoint Evaluation lab is now available in public preview
|
||||
- [Defender for Endpoint Evaluation lab is now available in public preview
|
||||
](https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/Microsoft-Defender-ATP-Evaluation-lab-is-now-available-in-public/ba-p/770271)
|
||||
|
||||
- [How automation brings value to your security
|
||||
- [How automation brings value to your security
|
||||
teams](https://techcommunity.microsoft.com/t5/Microsoft-Defender-ATP/How-automation-brings-value-to-your-security-teams/ba-p/729297)
|
||||
|
||||
- [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md)
|
||||
@ -0,0 +1,142 @@
|
||||
---
|
||||
title: Import Indicators API
|
||||
description: Learn how to use the Import batch of Indicator API in Microsoft Defender Advanced Threat Protection.
|
||||
keywords: apis, supported apis, submit, ti, indicator, update
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Import Indicators API
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
|
||||
|
||||
[!include[Improve request performance](../../includes/improve-request-performance.md)]
|
||||
|
||||
|
||||
## API description
|
||||
Submits or Updates batch of [Indicator](ti-indicator.md) entities.
|
||||
<br>CIDR notation for IPs is not supported.
|
||||
|
||||
## Limitations
|
||||
1. Rate limitations for this API are 30 calls per minute.
|
||||
2. There is a limit of 15,000 active [Indicators](ti-indicator.md) per tenant.
|
||||
3. Maximum batch size for one API call is 500.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Get started](apis-intro.md)
|
||||
|
||||
Permission type | Permission | Permission display name
|
||||
:---|:---|:---
|
||||
Application | Ti.ReadWrite | 'Read and write Indicators'
|
||||
Application | Ti.ReadWrite.All | 'Read and write All Indicators'
|
||||
Delegated (work or school account) | Ti.ReadWrite | 'Read and write Indicators'
|
||||
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
POST https://api.securitycenter.microsoft.com/api/indicators/import
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Name | Type | Description
|
||||
:---|:---|:---
|
||||
Authorization | String | Bearer {token}. **Required**.
|
||||
Content-Type | string | application/json. **Required**.
|
||||
|
||||
## Request body
|
||||
In the request body, supply a JSON object with the following parameters:
|
||||
|
||||
Parameter | Type | Description
|
||||
:---|:---|:---
|
||||
Indicators | List<[Indicator](ti-indicator.md)> | List of [Indicators](ti-indicator.md). **Required**
|
||||
|
||||
|
||||
## Response
|
||||
- If successful, this method returns 200 - OK response code with a list of import results per indicator, see example below.
|
||||
- If not successful: this method return 400 - Bad Request. Bad request usually indicates incorrect body.
|
||||
|
||||
## Example
|
||||
|
||||
**Request**
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/indicators/import
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Indicators":
|
||||
[
|
||||
{
|
||||
"indicatorValue": "220e7d15b011d7fac48f2bd61114db1022197f7f",
|
||||
"indicatorType": "FileSha1",
|
||||
"title": "demo",
|
||||
"application": "demo-test",
|
||||
"expirationTime": "2021-12-12T00:00:00Z",
|
||||
"action": "Alert",
|
||||
"severity": "Informational",
|
||||
"description": "demo2",
|
||||
"recommendedActions": "nothing",
|
||||
"rbacGroupNames": ["group1", "group2"]
|
||||
},
|
||||
{
|
||||
"indicatorValue": "2233223322332233223322332233223322332233223322332233223322332222",
|
||||
"indicatorType": "FileSha256",
|
||||
"title": "demo2",
|
||||
"application": "demo-test2",
|
||||
"expirationTime": "2021-12-12T00:00:00Z",
|
||||
"action": "Alert",
|
||||
"severity": "Medium",
|
||||
"description": "demo2",
|
||||
"recommendedActions": "nothing",
|
||||
"rbacGroupNames": []
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
**Response**
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
```json
|
||||
{
|
||||
"value": [
|
||||
{
|
||||
"id": "2841",
|
||||
"indicator": "220e7d15b011d7fac48f2bd61114db1022197f7f",
|
||||
"isFailed": false,
|
||||
"failureReason": null
|
||||
},
|
||||
{
|
||||
"id": "2842",
|
||||
"indicator": "2233223322332233223322332233223322332233223322332233223322332222",
|
||||
"isFailed": false,
|
||||
"failureReason": null
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Related topic
|
||||
- [Manage indicators](manage-indicators.md)
|
||||
@ -84,9 +84,12 @@ If successful, this method returns 201 - Created response code and [Investigatio
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/startInvestigation
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Comment": "Test investigation",
|
||||
"Comment": "Test investigation"
|
||||
}
|
||||
```
|
||||
|
||||
@ -40,7 +40,7 @@ Represent an Automated Investigation entity in Defender for Endpoint.
|
||||
Method|Return Type |Description
|
||||
:---|:---|:---
|
||||
[List Investigations](get-investigation-collection.md) | Investigation collection | Get collection of Investigation
|
||||
[Get single Investigation](get-investigation-collection.md) | Investigation entity | Gets single Investigation entity.
|
||||
[Get single Investigation](get-investigation-object.md) | Investigation entity | Gets single Investigation entity.
|
||||
[Start Investigation](initiate-autoir-investigation.md) | Investigation entity | Starts Investigation on a device.
|
||||
|
||||
|
||||
|
||||
@ -90,13 +90,15 @@ If successful, this method returns 201 - Created response code and [Machine Acti
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```console
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/isolate
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Comment": "Isolate machine due to alert 1234",
|
||||
“IsolationType”: “Full”
|
||||
"IsolationType": "Full"
|
||||
}
|
||||
```
|
||||
|
||||
- To unisolate a device, see [Release device from isolation](unisolate-machine.md).
|
||||
- To release a device from isolation, see [Release device from isolation](unisolate-machine.md).
|
||||
@ -20,7 +20,7 @@ ms.topic: conceptual
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# Set up Microsoft c for macOS device groups in Jamf Pro
|
||||
# Set up Microsoft Defender for Endpoint for macOS device groups in Jamf Pro
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
@ -751,18 +751,14 @@ Follow the instructions on [Schedule scans with Microsoft Defender for Endpoint
|
||||
|
||||
|
||||
|
||||
4. Navigate to **Advanced Computer Searches**.
|
||||
|
||||
|
||||
|
||||
5. Select **Computer Management**.
|
||||
4. Select your computer and click the gear icon at the top, then select **Computer Management**.
|
||||
|
||||
|
||||
|
||||
6. In **Packages**, select **+ New**.
|
||||
5. In **Packages**, select **+ New**.
|
||||
|
||||
|
||||
7. In **New Package** Enter the following details:
|
||||
6. In **New Package** Enter the following details:
|
||||
|
||||
**General tab**
|
||||
- Display Name: Leave it blank for now. Because it will be reset when you choose your pkg.
|
||||
@ -775,7 +771,9 @@ Follow the instructions on [Schedule scans with Microsoft Defender for Endpoint
|
||||
|
||||
|
||||
|
||||
8. Select **Open**. Set the **Display Name** to **Microsoft Defender Advanced Threat Protection and Microsoft Defender Antivirus**.
|
||||
7. Select **Open**. Set the **Display Name** to **Microsoft Defender Advanced Threat Protection and Microsoft Defender Antivirus**.
|
||||
|
||||
**Manifest File** is not required. Microsoft Defender Advanced Threat Protection works without Manifest File.
|
||||
|
||||
**Options tab**<br> Keep default values.
|
||||
|
||||
@ -783,7 +781,7 @@ Follow the instructions on [Schedule scans with Microsoft Defender for Endpoint
|
||||
|
||||
|
||||
|
||||
9. Select **Save**. The package is uploaded to Jamf Pro.
|
||||
8. Select **Save**. The package is uploaded to Jamf Pro.
|
||||
|
||||
|
||||
|
||||
@ -791,45 +789,45 @@ Follow the instructions on [Schedule scans with Microsoft Defender for Endpoint
|
||||
|
||||
|
||||
|
||||
10. Navigate to the **Policies** page.
|
||||
9. Navigate to the **Policies** page.
|
||||
|
||||
|
||||
|
||||
11. Select **+ New** to create a new policy.
|
||||
10. Select **+ New** to create a new policy.
|
||||
|
||||
|
||||
|
||||
|
||||
12. In **General** Enter the following details:
|
||||
11. In **General** Enter the following details:
|
||||
|
||||
- Display name: MDATP Onboarding Contoso 200329 v100.86.92 or later
|
||||
|
||||
|
||||
|
||||
13. Select **Recurring Check-in**.
|
||||
12. Select **Recurring Check-in**.
|
||||
|
||||
|
||||
|
||||
|
||||
14. Select **Save**.
|
||||
13. Select **Save**.
|
||||
|
||||
15. Select **Packages > Configure**.
|
||||
14. Select **Packages > Configure**.
|
||||
|
||||
|
||||
|
||||
16. Select the **Add** button next to **Microsoft Defender Advanced Threat Protection and Microsoft Defender Antivirus**.
|
||||
15. Select the **Add** button next to **Microsoft Defender Advanced Threat Protection and Microsoft Defender Antivirus**.
|
||||
|
||||
|
||||
|
||||
17. Select **Save**.
|
||||
16. Select **Save**.
|
||||
|
||||
|
||||
|
||||
18. Select the **Scope** tab.
|
||||
17. Select the **Scope** tab.
|
||||
|
||||
|
||||
|
||||
19. Select the target computers.
|
||||
18. Select the target computers.
|
||||
|
||||
|
||||
|
||||
@ -845,7 +843,7 @@ Follow the instructions on [Schedule scans with Microsoft Defender for Endpoint
|
||||
|
||||
|
||||
|
||||
20. Select **Done**.
|
||||
19. Select **Done**.
|
||||
|
||||
|
||||
|
||||
@ -854,4 +852,3 @@ Follow the instructions on [Schedule scans with Microsoft Defender for Endpoint
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -45,6 +45,7 @@ Method|Return Type |Description
|
||||
[Get security recommendations](get-security-recommendations.md) | [recommendation](recommendation.md) collection | Retrieves a collection of security recommendations related to a given machine ID.
|
||||
[Add or Remove machine tags](add-or-remove-machine-tags.md) | [machine](machine.md) | Add or Remove tag to a specific machine.
|
||||
[Find machines by IP](find-machines-by-ip.md) | [machine](machine.md) collection | Find machines seen with IP.
|
||||
[Find machines by tag](find-machines-by-tag.md) | [machine](machine.md) collection | Find machines by [Tag](machine-tags.md).
|
||||
[Get missing KBs](get-missing-kbs-machine.md) | KB collection | Get a list of missing KBs associated with the machine ID
|
||||
[Set device value](set-device-value.md)| [machine](machine.md) collection | Set the [value of a device](tvm-assign-device-value.md).
|
||||
|
||||
@ -61,7 +62,7 @@ version | String | Operating system Version.
|
||||
osBuild | Nullable long | Operating system build number.
|
||||
lastIpAddress | String | Last IP on local NIC on the [machine](machine.md).
|
||||
lastExternalIpAddress | String | Last IP through which the [machine](machine.md) accessed the internet.
|
||||
healthStatus | Enum | [machine](machine.md) health status. Possible values are: "Active", "Inactive", "ImpairedCommunication", "NoSensorData" and "NoSensorDataImpairedCommunication"
|
||||
healthStatus | Enum | [machine](machine.md) health status. Possible values are: "Active", "Inactive", "ImpairedCommunication", "NoSensorData", "NoSensorDataImpairedCommunication" and "Unknown".
|
||||
rbacGroupName | String | Machine group Name.
|
||||
rbacGroupId | Int | Machine group unique ID.
|
||||
riskScore | Nullable Enum | Risk score as evaluated by Microsoft Defender for Endpoint. Possible values are: 'None', 'Informational', 'Low', 'Medium' and 'High'.
|
||||
|
||||
@ -18,7 +18,7 @@ ms.collection:
|
||||
- M365-security-compliance
|
||||
- m365solution-scenario
|
||||
ms.topic: conceptual
|
||||
ms.date: 09/22/2020
|
||||
ms.date: 01/26/2021
|
||||
ms.reviewer: chventou
|
||||
---
|
||||
|
||||
@ -43,3 +43,6 @@ The following table lists various tools/methods you can use, with links to learn
|
||||
|**[Group Policy Objects in Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/manage-group-policy)** |[Azure Active Directory Domain Services](https://docs.microsoft.com/azure/active-directory-domain-services/overview) includes built-in Group Policy Objects for users and devices. You can customize the built-in Group Policy Objects as needed for your environment, as well as create custom Group Policy Objects and organizational units (OUs). <br/><br/>See [Manage Microsoft Defender for Endpoint with Group Policy Objects](manage-atp-post-migration-group-policy-objects.md). |
|
||||
|**[PowerShell, WMI, and MPCmdRun.exe](manage-atp-post-migration-other-tools.md)** |*We recommend using Microsoft Endpoint Manager (which includes Intune and Configuration Manager) to manage threat protection features on your organization's devices. However, you can configure some settings, such as Microsoft Defender Antivirus settings on individual devices (endpoints) with PowerShell, WMI, or the MPCmdRun.exe tool.*<br/><br/>You can use PowerShell to manage Microsoft Defender Antivirus, exploit protection, and your attack surface reduction rules. See [Configure Microsoft Defender for Endpoint with PowerShell](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-for-endpoint-with-powershell).<br/><br/>You can use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus and exclusions. See [Configure Microsoft Defender for Endpoint with WMI](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-for-endpoint-with-windows-management-instrumentation-wmi).<br/><br/>You can use the Microsoft Malware Protection Command-Line Utility (MPCmdRun.exe) to manage Microsoft Defender Antivirus and exclusions, as well as validate connections between your network and the cloud. See [Configure Microsoft Defender for Endpoint with MPCmdRun.exe](manage-atp-post-migration-other-tools.md#configure-microsoft-defender-for-endpoint-with-microsoft-malware-protection-command-line-utility-mpcmdrunexe). |
|
||||
|
||||
## See also
|
||||
|
||||
- [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md)
|
||||
@ -45,13 +45,13 @@ You can also use [audit mode](audit-windows-defender.md) to evaluate how Network
|
||||
|
||||
## Requirements
|
||||
|
||||
Network protection requires Windows 10 Pro, Enterprise E3, E5, and Microsoft Defender AV real-time protection.
|
||||
Network protection requires Windows 10 Pro or Enterprise, and Microsoft Defender Antivirus real-time protection.
|
||||
|
||||
Windows 10 version | Microsoft Defender Antivirus
|
||||
-|-
|
||||
Windows 10 version 1709 or later | [Microsoft Defender AV real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) and [cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) must be enabled
|
||||
| Windows 10 version | Microsoft Defender Antivirus |
|
||||
|:---|:---|
|
||||
| Windows 10 version 1709 or later | [Microsoft Defender AV real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) and [cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) must be enabled |
|
||||
|
||||
After you have enabled the services, you may need to configure your network or firewall to allow the connections between the services and your endpoints.
|
||||
After you have enabled the services, you might need to configure your network or firewall to allow the connections between the services and your endpoints.
|
||||
|
||||
- .smartscreen.microsoft.com
|
||||
- .smartscreen-prod.microsoft.com
|
||||
@ -79,11 +79,11 @@ You can review the Windows event log to see events that are created when network
|
||||
|
||||
3. This will create a custom view that filters to only show the following events related to network protection:
|
||||
|
||||
Event ID | Description
|
||||
-|-
|
||||
5007 | Event when settings are changed
|
||||
1125 | Event when network protection fires in audit mode
|
||||
1126 | Event when network protection fires in block mode
|
||||
| Event ID | Description |
|
||||
|:---|:---|
|
||||
| 5007 | Event when settings are changed |
|
||||
| 1125 | Event when network protection fires in audit mode |
|
||||
| 1126 | Event when network protection fires in block mode |
|
||||
|
||||
## Related articles
|
||||
|
||||
|
||||
@ -87,9 +87,11 @@ If successful, this method returns 201 - Created response code and [Machine Acti
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/offboard
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Comment": "Offboard machine by automation"
|
||||
}
|
||||
|
||||
@ -33,7 +33,7 @@ ms.technology: mde
|
||||
|
||||
## API description
|
||||
Submits or Updates new [Indicator](ti-indicator.md) entity.
|
||||
<br>CIDR notation for IPs is supported.
|
||||
<br>CIDR notation for IPs is not supported.
|
||||
|
||||
## Limitations
|
||||
1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.
|
||||
@ -89,9 +89,11 @@ rbacGroupNames | String | Comma-separated list of RBAC group names the indicator
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/indicators
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"indicatorValue": "220e7d15b011d7fac48f2bd61114db1022197f7f",
|
||||
"indicatorType": "FileSha1",
|
||||
|
||||
@ -83,9 +83,11 @@ If successful, this method returns 201 - Created response code and [Machine Acti
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/restrictCodeExecution
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Comment": "Restrict code execution due to alert 1234"
|
||||
}
|
||||
@ -93,4 +95,3 @@ Content-type: application/json
|
||||
```
|
||||
|
||||
- To remove code execution restriction from a device, see [Remove app restriction](unrestrict-code-execution.md).
|
||||
|
||||
|
||||
@ -35,10 +35,10 @@ ms.technology: mde
|
||||
1. You can only run a query on data from the last 30 days.
|
||||
2. The results will include a maximum of 100,000 rows.
|
||||
3. The number of executions is limited per tenant:
|
||||
- API calls: Up to 15 calls per minute
|
||||
- Execution time: 10 minutes of running time every hour and 4 hours of running time a day
|
||||
- API calls: Up to 45 calls per minute.
|
||||
- Execution time: 10 minutes of running time every hour and 3 hours of running time a day.
|
||||
4. The maximal execution time of a single request is 10 minutes.
|
||||
5. 429 response will represent reaching quota limit either by number of requests or by CPU. The 429 response body will also indicate the time until the quota is renewed.
|
||||
5. 429 response will represent reaching quota limit either by number of requests or by CPU. Read response body to understand what limit has been reached.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||
@ -82,9 +82,11 @@ Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/advancedqueries/run
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Query":"DeviceProcessEvents
|
||||
| where InitiatingProcessFileName =~ 'powershell.exe'
|
||||
|
||||
@ -91,12 +91,14 @@ If successful, this method returns 201, Created response code and _MachineAction
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/runAntiVirusScan
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Comment": "Check machine for viruses due to alert 3212",
|
||||
“ScanType”: “Full”
|
||||
"ScanType": "Full"
|
||||
}
|
||||
```
|
||||
|
||||
|
||||
@ -84,9 +84,11 @@ If successful, this method returns 201 - Created response code and [Machine Acti
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/StopAndQuarantineFile
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Comment": "Stop and quarantine file on machine due to alert 441688558380765161_2136280442",
|
||||
"Sha1": "87662bc3d60e4200ceaf7aae249d1c343f4b83c9"
|
||||
|
||||
@ -36,7 +36,8 @@ ms.technology: mde
|
||||
Method|Return Type |Description
|
||||
:---|:---|:---
|
||||
[List Indicators](get-ti-indicators-collection.md) | [Indicator](ti-indicator.md) Collection | List [Indicator](ti-indicator.md) entities.
|
||||
[Submit Indicator](post-ti-indicator.md) | [Indicator](ti-indicator.md) | Submits [Indicator](ti-indicator.md) entity.
|
||||
[Submit Indicator](post-ti-indicator.md) | [Indicator](ti-indicator.md) | Submit or update [Indicator](ti-indicator.md) entity.
|
||||
[Import Indicators](import-ti-indicators.md) | [Indicator](ti-indicator.md) Collection | Submit or update [Indicators](ti-indicator.md) entities.
|
||||
[Delete Indicator](delete-ti-indicator-by-id.md) | No Content | Deletes [Indicator](ti-indicator.md) entity.
|
||||
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
author: dansimp
|
||||
ms.author: dansimp
|
||||
ms.date: 03/27/2019
|
||||
ms.date: 01/26/2021
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
ms.technology: mde
|
||||
@ -24,14 +24,13 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
* IT administrators
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- IT administrators
|
||||
|
||||
When you use [Network protection](network-protection.md) you may encounter issues, such as:
|
||||
|
||||
* Network protection blocks a website that is safe (false positive)
|
||||
* Network protection fails to block a suspicious or known malicious website (false negative)
|
||||
- Network protection blocks a website that is safe (false positive)
|
||||
- Network protection fails to block a suspicious or known malicious website (false negative)
|
||||
|
||||
There are four steps to troubleshooting these problems:
|
||||
|
||||
@ -45,11 +44,11 @@ There are four steps to troubleshooting these problems:
|
||||
Network protection will only work on devices with the following conditions:
|
||||
|
||||
>[!div class="checklist"]
|
||||
> * Endpoints are running Windows 10 Enterprise edition, version 1709 or higher (also known as the Fall Creators Update).
|
||||
> * Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app will cause Microsoft Defender AV to disable itself](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||
> * [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled.
|
||||
> * [Cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) is enabled.
|
||||
> * Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**).
|
||||
> - Endpoints are running Windows 10 Pro or Enterprise edition, version 1709 or higher.
|
||||
> - Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [See what happens when you are using a non-Microsoft antivirus solution](../microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility.md).
|
||||
> - [Real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md) is enabled.
|
||||
> - [Cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) is enabled.
|
||||
> - Audit mode is not enabled. Use [Group Policy](enable-network-protection.md#group-policy) to set the rule to **Disabled** (value: **0**).
|
||||
|
||||
## Use audit mode
|
||||
|
||||
@ -61,9 +60,9 @@ You can enable network protection in audit mode and then visit a website that we
|
||||
Set-MpPreference -EnableNetworkProtection AuditMode
|
||||
```
|
||||
|
||||
1. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block).
|
||||
2. Perform the connection activity that is causing an issue (for example, attempt to visit the site, or connect to the IP address you do or don't want to block).
|
||||
|
||||
1. [Review the network protection event logs](network-protection.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**.
|
||||
3. [Review the network protection event logs](network-protection.md#review-network-protection-events-in-windows-event-viewer) to see if the feature would have blocked the connection if it had been set to **Enabled**.
|
||||
|
||||
If network protection is not blocking a connection that you are expecting it should block, enable the feature.
|
||||
|
||||
@ -75,6 +74,8 @@ You can enable network protection in audit mode and then visit a website that we
|
||||
|
||||
If you've tested the feature with the demo site and with audit mode, and network protection is working on pre-configured scenarios, but is not working as expected for a specific connection, use the [Windows Defender Security Intelligence web-based submission form](https://www.microsoft.com/wdsi/filesubmission) to report a false negative or false positive for network protection. With an E5 subscription, you can also [provide a link to any associated alert](../microsoft-defender-atp/alerts-queue.md).
|
||||
|
||||
See [Address false positives/negatives in Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives).
|
||||
|
||||
## Exclude website from network protection scope
|
||||
|
||||
To allow the website that is being blocked (false positive), add its URL to the [list of trusted sites](https://blogs.msdn.microsoft.com/asiatech/2014/08/19/how-to-add-web-sites-to-trusted-sites-via-gpo-from-dc-installed-ie10-or-higher-ie-version/). Web resources from this list bypass the network protection check.
|
||||
@ -85,20 +86,21 @@ When you report a problem with network protection, you are asked to collect and
|
||||
|
||||
1. Open an elevated command prompt and change to the Windows Defender directory:
|
||||
|
||||
```PowerShell
|
||||
```console
|
||||
cd c:\program files\windows defender
|
||||
```
|
||||
|
||||
1. Run this command to generate the diagnostic logs:
|
||||
2. Run this command to generate the diagnostic logs:
|
||||
|
||||
```PowerShell
|
||||
```console
|
||||
mpcmdrun -getfiles
|
||||
```
|
||||
|
||||
1. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form.
|
||||
3. By default, they are saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form.
|
||||
|
||||
## Related topics
|
||||
|
||||
* [Network protection](network-protection.md)
|
||||
* [Evaluate network protection](evaluate-network-protection.md)
|
||||
* [Enable network protection](enable-network-protection.md)
|
||||
- [Network protection](network-protection.md)
|
||||
- [Evaluate network protection](evaluate-network-protection.md)
|
||||
- [Enable network protection](enable-network-protection.md)
|
||||
- [Address false positives/negatives in Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives)
|
||||
|
||||
@ -84,9 +84,11 @@ If successful, this method returns 201 - Created response code and [Machine Acti
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/unisolate
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Comment": "Unisolate machine since it was clean and validated"
|
||||
}
|
||||
|
||||
@ -82,9 +82,11 @@ If successful, this method returns 201 - Created response code and [Machine Acti
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
POST https://api.securitycenter.microsoft.com/api/machines/1e5bc9d7e413ddd7902c2932e418702b84d0cc07/unrestrictCodeExecution
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"Comment": "Unrestrict code execution since machine was cleaned and validated"
|
||||
}
|
||||
|
||||
@ -91,10 +91,11 @@ If successful, this method returns 200 OK, and the [alert](alerts.md) entity in
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
```http
|
||||
PATCH https://api.securitycenter.microsoft.com/api/alerts/121688558380765161_2136280442
|
||||
Content-Type: application/json
|
||||
```
|
||||
|
||||
```json
|
||||
{
|
||||
"status": "Resolved",
|
||||
"assignedTo": "secop2@contoso.com",
|
||||
|
||||
@ -33,7 +33,7 @@ Web content filtering is part of [Web protection](web-protection-overview.md) ca
|
||||
|
||||
Configure policies across your device groups to block certain categories. Blocking a category prevents users within specified device groups from accessing URLs associated with the category. For any category that's not blocked, the URLs are automatically audited. Your users can access the URLs without disruption, and you'll gather access statistics to help create a more custom policy decision. Your users will see a block notification if an element on the page they're viewing is making calls to a blocked resource.
|
||||
|
||||
Web content filtering is available on the major web browsers, with blocks performed by Windows Defender SmartScreen (Microsoft Edge) and Network Protection (Chrome and Firefox). For more information about browser support, see the prerequisites section.
|
||||
Web content filtering is available on the major web browsers, with blocks performed by Windows Defender SmartScreen (Microsoft Edge) and Network Protection (Chrome, Firefox, Brave and Opera). For more information about browser support, see the prerequisites section.
|
||||
|
||||
Summarizing the benefits:
|
||||
|
||||
@ -43,7 +43,7 @@ Summarizing the benefits:
|
||||
|
||||
## User experience
|
||||
|
||||
The blocking experience for Chrome/Firefox is provided by Network Protection, which provides a system-level toast notifying the user of a blocked connection.
|
||||
The blocking experience for 3rd party supported browsers is provided by Network Protection, which provides a system-level toast notifying the user of a blocked connection.
|
||||
|
||||
For a more user-friendly in-browser experience, consider using Microsoft Edge.
|
||||
|
||||
@ -55,11 +55,11 @@ Before trying out this feature, make sure you have the following requirements:
|
||||
- Access to Microsoft Defender Security Center portal
|
||||
- Devices running Windows 10 Anniversary Update (version 1607) or later with the latest MoCAMP update.
|
||||
|
||||
If Windows Defender SmartScreen isn't turned on, Network Protection will take over the blocking. It requires [enabling Network Protection](enable-network-protection.md) on the device.
|
||||
If Windows Defender SmartScreen isn't turned on, Network Protection will take over the blocking. It requires [enabling Network Protection](enable-network-protection.md) on the device. Chrome, Firefox, Brave, and Opera are currently 3rd party browsers in which this feature is enabled.
|
||||
|
||||
## Data handling
|
||||
|
||||
We will follow whichever region you have elected to use as part of your [Microsoft Defender for Endpoint data handling settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy). Your data will not leave the data center in that region. In addition, your data will not be shared with any third-parties, including our data providers. However, we may send them aggregate data (across users and organizations) to help them improve their feeds.
|
||||
We will follow whichever region you have elected to use as part of your [Microsoft Defender for Endpoint data handling settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/data-storage-privacy). Your data will not leave the data center in that region. In addition, your data will not be shared with any third-parties, including our data providers.
|
||||
|
||||
## Turn on web content filtering
|
||||
|
||||
@ -79,7 +79,7 @@ To add a new policy:
|
||||
2. Specify a name.
|
||||
3. Select the categories to block. Use the expand icon to fully expand each parent category and select specific web content categories.
|
||||
4. Specify the policy scope. Select the device groups to specify where to apply the policy. Only devices in the selected device groups will be prevented from accessing websites in the selected categories.
|
||||
5. Review the summary and save the policy. The policy may take up to 15 minutes to apply to your selected devices.
|
||||
5. Review the summary and save the policy. The policy refresh may take up to 2 hours to apply to your selected devices.
|
||||
|
||||
Tip: You can deploy a policy without selecting any category on a device group. This action will create an audit only policy, to help you understand user behavior before creating a block policy.
|
||||
|
||||
@ -139,7 +139,7 @@ Use the time range filter at the top left of the page to select a time period. Y
|
||||
|
||||
### Limitations and known issues in this preview
|
||||
|
||||
- Only Microsoft Edge is supported if your device's OS configuration is Server (cmd > Systeminfo > OS Configuration). Network Protection is only supported in Inspect mode on Server devices, which is responsible for securing traffic across Chrome/Firefox.
|
||||
- Only Microsoft Edge is supported if your device's OS configuration is Server (cmd > Systeminfo > OS Configuration). Network Protection is only supported in Inspect mode on Server devices, which is responsible for securing traffic across supported 3rd party browsers.
|
||||
|
||||
- Unassigned devices will have incorrect data shown within the report. In the Report details > Device groups pivot, you may see a row with a blank Device Group field. This group contains your unassigned devices before they get put into your specified group. The report for this row may not contain an accurate count of devices or access counts.
|
||||
|
||||
|
||||
@ -34,7 +34,6 @@ The Security Compliance Toolkit consists of:
|
||||
- Windows 10 Version 1903 (May 2019 Update)
|
||||
- Windows 10 Version 1809 (October 2018 Update)
|
||||
- Windows 10 Version 1803 (April 2018 Update)
|
||||
- Windows 10 Version 1709 (Fall Creators Update)
|
||||
- Windows 10 Version 1607 (Anniversary Update)
|
||||
- Windows 10 Version 1507
|
||||
|
||||
|
||||
@ -70,6 +70,7 @@ The following table links to each security policy setting and provides the const
|
||||
| [Manage auditing and security log](manage-auditing-and-security-log.md)| SeSecurityPrivilege|
|
||||
| [Modify an object label](modify-an-object-label.md) | SeRelabelPrivilege|
|
||||
| [Modify firmware environment values](modify-firmware-environment-values.md)| SeSystemEnvironmentPrivilege|
|
||||
| [Obtain an impersonation token for another user in the same session](impersonate-a-client-after-authentication.md) | SeDelegateSessionUserImpersonatePrivilege|
|
||||
| [Perform volume maintenance tasks](perform-volume-maintenance-tasks.md) | SeManageVolumePrivilege|
|
||||
| [Profile single process](profile-single-process.md) | SeProfileSingleProcessPrivilege|
|
||||
| [Profile system performance](profile-system-performance.md) | SeSystemProfilePrivilege|
|
||||
@ -80,6 +81,7 @@ The following table links to each security policy setting and provides the const
|
||||
| [Synchronize directory service data](synchronize-directory-service-data.md)| SeSyncAgentPrivilege|
|
||||
| [Take ownership of files or other objects](take-ownership-of-files-or-other-objects.md) | SeTakeOwnershipPrivilege|
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Security policy settings reference](security-policy-settings-reference.md)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user