mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-16 10:53:43 +00:00
Merge branch 'master' into nimishasatapathy-4848929-newpolicy
This commit is contained in:
Daniel Simpson
GitHub
@ -159,16 +159,16 @@
|
||||
### [Personalization CSP](personalization-csp.md)
|
||||
#### [Personalization DDF file](personalization-ddf.md)
|
||||
### [Policy CSP](policy-configuration-service-provider.md)
|
||||
#### [Policy DDF file](policy-ddf-file.md)
|
||||
#### [Policies in Policy CSP supported by Group Policy](policy-csps-supported-by-group-policy.md)
|
||||
#### [ADMX-backed policies in Policy CSP](policy-csps-admx-backed.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens 2](policy-csps-supported-by-hololens2.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite](policy-csps-supported-by-hololens-1st-gen-commercial-suite.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens (1st gen) Development Edition](policy-csps-supported-by-hololens-1st-gen-development-edition.md)
|
||||
#### [Policies in Policy CSP supported by Windows 10 IoT Enterprise](policy-csps-supported-by-iot-enterprise.md)
|
||||
#### [Policies in Policy CSP supported by Windows 10 IoT Core](policy-csps-supported-by-iot-core.md)
|
||||
#### [Policies in Policy CSP supported by Microsoft Surface Hub](policy-csps-supported-by-surface-hub.md)
|
||||
#### [Policy CSPs that can be set using Exchange Active Sync (EAS)](policy-csps-that-can-be-set-using-eas.md)
|
||||
#### [Policy CSP DDF file](policy-ddf-file.md)
|
||||
#### [Policies in Policy CSP supported by Group Policy](policies-in-policy-csp-supported-by-group-policy.md)
|
||||
#### [ADMX-backed policies in Policy CSP](policies-in-policy-csp-admx-backed.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens 2](policies-in-policy-csp-supported-by-hololens2.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens (1st gen) Commercial Suite](policies-in-policy-csp-supported-by-hololens-1st-gen-commercial-suite.md)
|
||||
#### [Policies in Policy CSP supported by HoloLens (1st gen) Development Edition](policies-in-policy-csp-supported-by-hololens-1st-gen-development-edition.md)
|
||||
#### [Policies in Policy CSP supported by Windows 10 IoT Enterprise](policies-in-policy-csp-supported-by-iot-enterprise.md)
|
||||
#### [Policies in Policy CSP supported by Windows 10 IoT Core](policies-in-policy-csp-supported-by-iot-core.md)
|
||||
#### [Policies in Policy CSP supported by Microsoft Surface Hub](policies-in-policy-csp-supported-by-surface-hub.md)
|
||||
#### [Policy CSPs that can be set using Exchange Active Sync (EAS)](policies-in-policy-csp-that-can-be-set-using-eas.md)
|
||||
#### [AboveLock](policy-csp-abovelock.md)
|
||||
#### [Accounts](policy-csp-accounts.md)
|
||||
#### [ActiveXControls](policy-csp-activexcontrols.md)
|
||||
|
||||
@ -429,7 +429,8 @@
|
||||
##### [DeviceNetworkEvents](microsoft-defender-atp/advanced-hunting-devicenetworkevents-table.md)
|
||||
##### [DeviceProcessEvents](microsoft-defender-atp/advanced-hunting-deviceprocessevents-table.md)
|
||||
##### [DeviceRegistryEvents](microsoft-defender-atp/advanced-hunting-deviceregistryevents-table.md)
|
||||
##### [DeviceTvmSoftwareInventoryVulnerabilities](microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md)
|
||||
##### [DeviceTvmSoftwareInventory](microsoft-defender-atp/advanced-hunting-devicetvmsoftwareinventory-table.md)
|
||||
##### [DeviceTvmSoftwareVulnerabilities](microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilities-table.md)
|
||||
##### [DeviceTvmSoftwareVulnerabilitiesKB](microsoft-defender-atp/advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessment](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessment-table.md)
|
||||
##### [DeviceTvmSecureConfigurationAssessmentKB](microsoft-defender-atp/advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md)
|
||||
|
||||
@ -25,14 +25,14 @@ MBSA was largely used in situations where neither Microsoft Update nor a local W
|
||||
A script can help you with an alternative to MBSA’s patch-compliance checking:
|
||||
|
||||
- [Using WUA to Scan for Updates Offline](https://docs.microsoft.com/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline), which includes a sample .vbs script.
|
||||
For a PowerShell alternative, see [Using WUA to Scan for Updates Offline with PowerShell](https://gallery.technet.microsoft.com/Using-WUA-to-Scan-for-f7e5e0be).
|
||||
For a PowerShell alternative, see [Using WUA to Scan for Updates Offline with PowerShell](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0).
|
||||
|
||||
For example:
|
||||
|
||||
[](https://docs.microsoft.com/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline)
|
||||
[](https://gallery.technet.microsoft.com/Using-WUA-to-Scan-for-f7e5e0be)
|
||||
|
||||
The preceding scripts leverage the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) (wsusscn2.cab) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it.
|
||||
The preceding scripts use the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) (wsusscn2.cab) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it.
|
||||
The wsusscn2.cab file contains the metadata of only security updates, update rollups and service packs available from Microsoft Update; it does not contain any information on non-security updates, tools or drivers.
|
||||
|
||||
## More Information
|
||||
|
||||
@ -23,8 +23,6 @@ ms.technology: mde
|
||||
|
||||
Applies to:
|
||||
- Windows 10 multi-session running on Windows Virtual Desktop (WVD)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
|
||||
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
@ -33,7 +31,7 @@ Applies to:
|
||||
|
||||
Microsoft Defender for Endpoint supports monitoring both VDI as well as Windows Virtual Desktop sessions. Depending on your organization's needs, you might need to implement VDI or Windows Virtual Desktop sessions to help your employees access corporate data and apps from an unmanaged device, remote location, or similar scenario. With Microsoft Defender for Endpoint, you can monitor these virtual machines for anomalous activity.
|
||||
|
||||
## Before you begin
|
||||
## Before you begin
|
||||
|
||||
See [considerations for non-persistent VDI](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-endpoints-vdi#onboard-non-persistent-virtual-desktop-infrastructure-vdi-devices-1). Although [Windows Virtual Desktop](https://docs.microsoft.com/azure/virtual-desktop/overview) does not provide non-persistence options, it does provide ways to use a Windows image that can be used to provision new hosts and redeploy machines. This increases volatility in the environment, and thus impacts what entries are created and maintained in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)), potentially reducing visibility for your security analysts.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: DeviceTvmSoftwareInventoryVulnerabilities table in the advanced hunting schema
|
||||
description: Learn about the inventory of software in your devices and their vulnerabilities in the DeviceTvmSoftwareInventoryVulnerabilities table of the advanced hunting schema.
|
||||
title: DeviceTvmSoftwareInventory table in the advanced hunting schema
|
||||
description: Learn about the inventory of software in your devices in the DeviceTvmSoftwareInventory table of the advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -8,8 +8,8 @@ ms.prod: m365-security
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: dolmont
|
||||
author: DulceMontemayor
|
||||
ms.author: maccruz
|
||||
author: maccruz
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
@ -18,7 +18,7 @@ ms.topic: article
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# DeviceTvmSoftwareInventoryVulnerabilities
|
||||
# DeviceTvmSoftwareInventory
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
@ -30,7 +30,10 @@ ms.technology: mde
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The `DeviceTvmSoftwareInventoryVulnerabilities` table in the advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software on your devices as well as any known vulnerabilities in these software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. Use this reference to construct queries that return information from the table.
|
||||
The `DeviceTvmSoftwareInventory` table in the advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) inventory of software currently installed on devices in your network, including end of support information. You can, for instance, hunt for events involving devices that are installed with a currently vulnerable software version. Use this reference to construct queries that return information from the table.
|
||||
|
||||
>[!NOTE]
|
||||
>The `DeviceTvmSoftwareInventory` and `DeviceTvmSoftwareVulnerabilities` tables have replaced the `DeviceTvmSoftwareInventoryVulnerabilities` table. Together, the first two tables include more columns you can use to help inform your vulnerability management activities.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
@ -44,8 +47,8 @@ For information on other tables in the advanced hunting schema, see [the advance
|
||||
| `SoftwareVendor` | string | Name of the software vendor |
|
||||
| `SoftwareName` | string | Name of the software product |
|
||||
| `SoftwareVersion` | string | Version number of the software product |
|
||||
| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system |
|
||||
| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
| `EndOfSupportStatus` | string | Indicates the lifecycle stage of the software product relative to its specified end-of-support (EOS) or end-of-life (EOL) date |
|
||||
| `EndOfSupportDate` | string | End-of-support (EOS) or end-of-life (EOL) date of the software product |
|
||||
|
||||
|
||||
|
||||
@ -55,3 +58,4 @@ For information on other tables in the advanced hunting schema, see [the advance
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
|
||||
@ -0,0 +1,62 @@
|
||||
---
|
||||
title: DeviceTvmSoftwareVulnerabilities table in the advanced hunting schema
|
||||
description: Learn about software vulnerabilities found on devices and the list of available security updates that address each vulnerability in the DeviceTvmSoftwareVulnerabilities table of the advanced hunting schema.
|
||||
keywords: advanced hunting, threat hunting, cyber threat hunting, mdatp, microsoft defender atp, wdatp search, query, telemetry, schema reference, kusto, table, column, data type, description, threat & vulnerability management, TVM, device management, software, inventory, vulnerabilities, CVE ID, OS DeviceTvmSoftwareInventoryVulnerabilities
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: m365-security
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: maccruz
|
||||
author: maccruz
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# DeviceTvmSoftwareVulnerabilities
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||
|
||||
The `DeviceTvmSoftwareVulnerabilities` table in the advanced hunting schema contains the [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) list of vulnerabilities in installed software products. This table also includes operating system information, CVE IDs, and vulnerability severity information. You can use this table, for example, to hunt for events involving devices that have severe vulnerabilities in their software. Use this reference to construct queries that return information from the table.
|
||||
|
||||
>[!NOTE]
|
||||
>The `DeviceTvmSoftwareInventory` and `DeviceTvmSoftwareVulnerabilities` tables have replaced the `DeviceTvmSoftwareInventoryVulnerabilities` table. Together, the first two tables include more columns you can use to help inform your vulnerability management activities.
|
||||
|
||||
For information on other tables in the advanced hunting schema, see [the advanced hunting reference](advanced-hunting-reference.md).
|
||||
|
||||
| Column name | Data type | Description |
|
||||
|-------------|-----------|-------------|
|
||||
| `DeviceId` | string | Unique identifier for the device in the service |
|
||||
| `DeviceName` | string | Fully qualified domain name (FQDN) of the device |
|
||||
| `OSPlatform` | string | Platform of the operating system running on the device. This indicates specific operating systems, including variations within the same family, such as Windows 10 and Windows 7. |
|
||||
| `OSVersion` | string | Version of the operating system running on the device |
|
||||
| `OSArchitecture` | string | Architecture of the operating system running on the device |
|
||||
| `SoftwareVendor` | string | Name of the software vendor |
|
||||
| `SoftwareName` | string | Name of the software product |
|
||||
| `SoftwareVersion` | string | Version number of the software product |
|
||||
| `CveId` | string | Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system |
|
||||
| `VulnerabilitySeverityLevel` | string | Severity level assigned to the security vulnerability based on the CVSS score and dynamic factors influenced by the threat landscape |
|
||||
| `RecommendedSecurityUpdate` | string | Name or description of the security update provided by the software vendor to address the vulnerability |
|
||||
| `RecommendedSecurityUpdateId` | string | Identifier of the applicable security updates or identifier for the corresponding guidance or knowledge base (KB) articles |
|
||||
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Advanced hunting overview](advanced-hunting-overview.md)
|
||||
- [Learn the query language](advanced-hunting-query-language.md)
|
||||
- [Understand the schema](advanced-hunting-schema-reference.md)
|
||||
- [Overview of Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
|
||||
@ -64,7 +64,8 @@ Table and column names are also listed within the Microsoft Defender Security Ce
|
||||
| **[DeviceImageLoadEvents](advanced-hunting-deviceimageloadevents-table.md)** | DLL loading events |
|
||||
| **[DeviceEvents](advanced-hunting-deviceevents-table.md)** | Multiple event types, including events triggered by security controls such as Microsoft Defender Antivirus and exploit protection |
|
||||
| **[DeviceFileCertificateInfo](advanced-hunting-devicefilecertificateinfo-table.md)** | Certificate information of signed files obtained from certificate verification events on endpoints |
|
||||
| **[DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md)** | Inventory of software on devices as well as any known vulnerabilities in these software products |
|
||||
| **[DeviceTvmSoftwareInventory](advanced-hunting-devicetvmsoftwareinventory-table.md)** | Inventory of software installed on devices, including their version information and end-of-support status |
|
||||
| **[DeviceTvmSoftwareVulnerabilities](advanced-hunting-devicetvmsoftwarevulnerabilities-table.md)** | Software vulnerabilities found on devices and the list of available security updates that address each vulnerability |
|
||||
| **[DeviceTvmSoftwareVulnerabilitiesKB ](advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md)** | Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available |
|
||||
| **[DeviceTvmSecureConfigurationAssessment](advanced-hunting-devicetvmsecureconfigurationassessment-table.md)** | Threat & Vulnerability Management assessment events, indicating the status of various security configurations on devices |
|
||||
| **[DeviceTvmSecureConfigurationAssessmentKB](advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md)** | Knowledge base of various security configurations used by Threat & Vulnerability Management to assess devices; includes mappings to various standards and benchmarks |
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Onboard non-Windows devices to the Microsoft Defender ATP service
|
||||
title: Onboard non-Windows devices to the Microsoft Defender for Endpoint service
|
||||
description: Configure non-Windows devices so that they can send sensor data to the Microsoft Defender ATP service.
|
||||
keywords: onboard non-Windows devices, macos, linux, device management, configure Windows ATP devices, configure Microsoft Defender Advanced Threat Protection devices
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -24,12 +24,13 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- macOS
|
||||
- Linux
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
|
||||
**Platforms**
|
||||
- macOS
|
||||
- Linux
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-nonwindows-abovefoldlink)
|
||||
|
||||
Defender for Endpoint provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Microsoft Defender Security Center and better protect your organization's network.
|
||||
|
||||
@ -37,14 +37,12 @@ ms.technology: mde
|
||||
|
||||
Ensure that you have Defender for Endpoint deployed in your environment with devices enrolled, and not just on a laboratory set-up.
|
||||
|
||||
Defender for Endpoint customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive Targeted Attack Notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. Targeted Attack Notifications are always included after you have been accepted into Microsoft Threat Experts managed threat hunting service.
|
||||
If you're a Defender for Endpoint customer, you need to apply for Microsoft Threat Experts - Targeted Attack Notifications to get special insights and analysis to help identify the most critical threats, so you can respond to them quickly. Contact your account team or Microsoft representative to subscribe to Microsoft Threat Experts - Experts on Demand to consult with our threat experts on relevant detections and adversaries.
|
||||
|
||||
If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply. Once accepted, you will get the benefits of Targeted Attack Notifications, and start a 90-day trial of Experts on Demand. Contact your Microsoft representative to get a full Experts on-Demand subscription.
|
||||
## Apply for Microsoft Threat Experts - Targeted Attack Notifications service
|
||||
If you're already a Defender for Endpoint customer, you can apply through the Microsoft Defender Security Center.
|
||||
|
||||
## Register to Microsoft Threat Experts managed threat hunting service
|
||||
If you're already a Defender for Endpoint customer, you can apply through the Microsoft Defender for Endpoint portal.
|
||||
|
||||
1. From the navigation pane, go to **Settings > General > Advanced features > Microsoft Threat Experts**.
|
||||
1. From the navigation pane, go to **Settings > General > Advanced features > Microsoft Threat Experts - Targeted Attack Notifications**.
|
||||
|
||||
2. Click **Apply**.
|
||||
|
||||
@ -58,11 +56,14 @@ If you're already a Defender for Endpoint customer, you can apply through the Mi
|
||||
|
||||
|
||||
|
||||
6. From the navigation pane, go to **Settings** > **General** > **Advanced features** to turn the **Threat Experts** toggle on. Click **Save preferences**.
|
||||
When accepted, you will receive a welcome email and you will see the **Apply** button change to a toggle that is “on”. In case you want to take yourself out of the Targeted Attack Notifications service, slide the toggle “off” and click **Save preferences** at the bottom of the page.
|
||||
|
||||
## Receive targeted attack notification from Microsoft Threat Experts
|
||||
## Where you'll see the targeted attack notifications from Microsoft Threat Experts
|
||||
You can receive targeted attack notification from Microsoft Threat Experts through the following medium:
|
||||
- The Defender for Endpoint portal's **Incidents** page
|
||||
- The Defender for Endpoint portal's **Alerts** dashboard
|
||||
- OData alerting [API](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/get-alerts) and [REST API](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api)
|
||||
- [DeviceAlertEvents](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-devicealertevents-table) table in Advanced hunting
|
||||
- Your email, if you choose to configure it
|
||||
|
||||
To receive targeted attack notifications through email, create an email notification rule.
|
||||
@ -77,13 +78,15 @@ You'll start receiving targeted attack notification from Microsoft Threat Expert
|
||||
|
||||
2. From the dashboard, select the same alert topic that you got from the email, to view the details.
|
||||
|
||||
## Subscribe to Microsoft Threat Experts - Experts on Demand
|
||||
If you're already a Defender for Endpoint customer, you can contact your Microsoft representative to subscribe to Microsoft Threat Experts - Experts on Demand.
|
||||
|
||||
## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization
|
||||
You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised device, or a threat intelligence context that you see on your portal dashboard.
|
||||
|
||||
> [!NOTE]
|
||||
> - Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details.
|
||||
> - You will need to have the "Manage security settings" permission in the Security Center portal to be able to submit a "Consult a threat expert" inquiry.
|
||||
> - You need to have the **Manage security settings** permission in the Security Center portal to be able to submit a "Consult a threat expert" inquiry.
|
||||
|
||||
1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or device is in view before you send an investigation request.
|
||||
|
||||
@ -106,7 +109,7 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w
|
||||
4. Enter the email address that you'd like to use to correspond with Microsoft Threat Experts.
|
||||
|
||||
> [!NOTE]
|
||||
> Customers with Premier Support subscription mapped to their Office 365 license can track the status of their Experts on Demand cases through Microsoft Services Hub.
|
||||
> If you would like to track the status of your Experts on Demand cases through Microsoft Services Hub, reach out to your Technical Account Manager.
|
||||
|
||||
Watch this video for a quick overview of the Microsoft Services Hub.
|
||||
|
||||
@ -114,7 +117,7 @@ Watch this video for a quick overview of the Microsoft Services Hub.
|
||||
|
||||
|
||||
|
||||
## Sample investigation topics that you can consult with Microsoft Threat Experts
|
||||
## Sample investigation topics that you can consult with Microsoft Threat Experts - Experts on Demand
|
||||
|
||||
**Alert information**
|
||||
- We see a new type of alert for a living-off-the-land binary: [AlertID]. Can you tell us something more about this alert and how we can investigate further?
|
||||
|
||||
@ -114,7 +114,7 @@ The following downloadable spreadsheet lists the services and their associated U
|
||||
|
||||
|**Spreadsheet of domains list**|**Description**|
|
||||
|:-----|:-----|
|
||||
|<br/> | Spreadsheet of specific DNS records for service locations, geographic locations, and OS. <br><br>[Download the spreadsheet here.](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)
|
||||
|<br/> | Spreadsheet of specific DNS records for service locations, geographic locations, and OS. <br><br>[Download the spreadsheet here.](https://download.microsoft.com/download/8/a/5/8a51eee5-cd02-431c-9d78-a58b7f77c070/mde-urls.xlsx)
|
||||
|
||||
|
||||
If a proxy or firewall has HTTPS scanning (SSL inspection) enabled, exclude the domains listed in the above table from HTTPS scanning.
|
||||
@ -157,7 +157,7 @@ Please see the following guidance to eliminate the wildcard (*) requirement for
|
||||
|
||||
3. Run the TestCloudConnection.exe tool from “C:\Program Files\Microsoft Monitoring Agent\Agent” to validate the connectivity and to see the required URLs for your specific workspace.
|
||||
|
||||
4. Check the Microsoft Defender for Endpoint URLs list for the complete list of requirements for your region (please refer to the Service URLs [Spreadsheet](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)).
|
||||
4. Check the Microsoft Defender for Endpoint URLs list for the complete list of requirements for your region (please refer to the Service URLs [Spreadsheet](https://download.microsoft.com/download/8/a/5/8a51eee5-cd02-431c-9d78-a58b7f77c070/mde-urls.xlsx)).
|
||||
|
||||
|
||||
|
||||
|
||||
@ -31,9 +31,6 @@ ms.technology: mde
|
||||
- Windows Server (SAC) version 1803 and later
|
||||
- Windows Server 2019 and later
|
||||
- Windows Server 2019 core edition
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
|
||||
|
||||
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
|
||||
|
||||
Binary file not shown.
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: See how Exploit protection works in a demo
|
||||
description: See how exploit protection can prevent suspicious behaviors from occurring on specific apps.
|
||||
description: See how Exploit Protection can prevent suspicious behaviors from occurring on specific apps.
|
||||
keywords: Exploit protection, exploits, kernel, events, evaluate, demo, try, mitigation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: m365-security
|
||||
@ -30,14 +30,14 @@ ms.technology: mde
|
||||
|
||||
[Exploit protection](exploit-protection.md) helps protect devices from malware that uses exploits to spread and infect other devices. Mitigation can be applied to either the operating system or to an individual app. Many of the features that were part of the Enhanced Mitigation Experience Toolkit (EMET) are included in exploit protection. (The EMET has reached its end of support.)
|
||||
|
||||
Use exploit protection in audit mode to review related events in Event Viewer. By enabling audit mode, you'll see how mitigation works for certain apps in a test environment. Audit mode shows what *would* have happened if you enabled exploit protection in your production environment. This way, you can verify that exploit protection doesn't adversely affect your line-of-business apps, and see which suspicious or malicious events occur.
|
||||
In audit, you can see how mitigation works for certain apps in a test environment. This shows what *would* have happened if you enabled exploit protection in your production environment. This way, you can verify that exploit protection doesn't adversely affect your line-of-business apps, and see which suspicious or malicious events occur.
|
||||
|
||||
> [!TIP]
|
||||
> You can also visit the Microsoft Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to see how exploit protection works.
|
||||
|
||||
## Enable exploit protection in audit mode
|
||||
## Enable exploit protection for testing
|
||||
|
||||
You can set mitigations in audit mode for specific programs by using the Windows Security app or Windows PowerShell.
|
||||
You can set mitigations in a testing mode for specific programs by using the Windows Security app or Windows PowerShell.
|
||||
|
||||
### Windows Security app
|
||||
|
||||
@ -99,12 +99,12 @@ To review which apps would have been blocked, open Event Viewer and filter for t
|
||||
|
||||
| Feature | Provider/source | Event ID | Description |
|
||||
|---|---|--|---|
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 1 | ACG audit |
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 3 | Do not allow child processes audit |
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 5 | Block low integrity images audit |
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 7 | Block remote images audit |
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 9 | Disable win32k system calls audit |
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 11 | Code integrity guard audit |
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 1 | ACG audit |
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 3 | Do not allow child processes audit |
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 5 | Block low integrity images audit |
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 7 | Block remote images audit |
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 9 | Disable win32k system calls audit |
|
||||
| Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 11 | Code integrity guard audit |
|
||||
|
||||
## See also
|
||||
|
||||
|
||||
@ -21,11 +21,11 @@ ms.technology: mde
|
||||
# Microsoft Defender for Endpoint for US Government customers
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2154037)
|
||||
|
||||
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
Microsoft Defender for Endpoint for US Government customers, built in the US Azure Government environment, uses the same underlying technologies as Defender for Endpoint in Azure Commercial.
|
||||
|
||||
This offering is available to GCC, GCC High, and DoD customers and is based on the same prevention, detection, investigation, and remediation as the commercial version. However, there are some differences in the availability of capabilities for this offering.
|
||||
|
||||
> [!NOTE]
|
||||
> If you are a GCC customer using Defender for Endpoint in Commercial, please refer to the public documentation pages.
|
||||
@ -102,21 +102,25 @@ The following OS versions are supported when using [Azure Defender for Servers](
|
||||
|
||||
OS version | GCC | GCC High | DoD (PREVIEW)
|
||||
:---|:---|:---|:---
|
||||
Windows Server 2016 |  Rolling out |  | 
|
||||
Windows Server 2012 R2 |  Rolling out |  | 
|
||||
Windows Server 2008 R2 SP1 |  Rolling out |  | 
|
||||
Windows Server 2016 |  |  | 
|
||||
Windows Server 2012 R2 |  |  | 
|
||||
Windows Server 2008 R2 SP1 |  |  | 
|
||||
|
||||
<br>
|
||||
|
||||
## Required connectivity settings
|
||||
You'll need to ensure that traffic from the following are allowed:
|
||||
If a proxy or firewall is blocking all traffic by default and allowing only specific domains through, add the domains listed in the downloadable sheet to the allowed domains list.
|
||||
|
||||
Service location | DNS record
|
||||
:---|:---
|
||||
Common URLs for all locations (Global location) | `crl.microsoft.com`<br>`ctldl.windowsupdate.com`<br>`notify.windows.com`<br>`settings-win.data.microsoft.com` <br><br> Note: `settings-win.data.microsoft.com` is only needed on Windows 10 devices running version 1803 or earlier.
|
||||
Common URLs for all US Gov customers | `us4-v20.events.data.microsoft.com` <br>`*.blob.core.usgovcloudapi.net`
|
||||
Defender for Endpoint GCC specific | `winatp-gw-usmt.microsoft.com`<br>`winatp-gw-usmv.microsoft.com`
|
||||
Defender for Endpoint GCC High & DoD (PREVIEW) specific | `winatp-gw-usgt.microsoft.com`<br>`winatp-gw-usgv.microsoft.com`
|
||||
The following downloadable spreadsheet lists the services and their associated URLs your network must be able to connect to. Verify there are no firewall or network filtering rules that would deny access to these URLs, or create an *allow* rule specifically for them.
|
||||
|
||||
Spreadsheet of domains list | Description
|
||||
:-----|:-----
|
||||
<br/> | Spreadsheet of specific DNS records for service locations, geographic locations, and OS. <br><br>[Download the spreadsheet here.](https://download.microsoft.com/download/8/a/5/8a51eee5-cd02-431c-9d78-a58b7f77c070/mde-urls.xlsx)
|
||||
|
||||
For more information, see [Configure device proxy and Internet connectivity settings](configure-proxy-internet.md).
|
||||
|
||||
> [!NOTE]
|
||||
> The spreadsheet contains commercial URLs as well, make sure you check the "US Gov" tabs. <br> When filtering look for the records labeled as "US Gov" and your specific cloud under the geography column.
|
||||
|
||||
<br>
|
||||
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 10 KiB After Width: | Height: | Size: 12 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 30 KiB After Width: | Height: | Size: 125 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 43 KiB After Width: | Height: | Size: 136 KiB |
@ -30,8 +30,8 @@ ms.technology: mde
|
||||
|
||||
This article provides some general steps to mitigate missing events or alerts in the [security center](https://securitycenter.windows.com/) portal.
|
||||
|
||||
Once Microsoft Defender for Endpoint has been installed properly on a device, a device page will be generated in the portal and _File_, _Process_, _Network_ and other events should appear in the timeline and advanced hunting pages.
|
||||
In case events are not appearing or some types of events are missing, that could indicate some problem.
|
||||
Once **Microsoft Defender for Endpoint** has been installed properly on a device, a _device page_ will be generated in the portal. You can review all recorded events in the timeline tab in the device page, or in advanced hunting page. This section troubleshoots the case of some or all expected events are missing.
|
||||
For instance, if all _CreatedFile_ events are missing.
|
||||
|
||||
## Missing network and login events
|
||||
|
||||
@ -62,21 +62,21 @@ Microsoft Defender for Endpoint utilized `audit` framework from linux to track n
|
||||
└─16671 /opt/microsoft/mdatp/sbin/mdatp_audisp_plugin -d
|
||||
```
|
||||
|
||||
2. If auditd is stopped, please start it.
|
||||
2. If `auditd` is marked as stopped, start it.
|
||||
|
||||
```bash
|
||||
service auditd start
|
||||
```
|
||||
|
||||
**On SLES15** systems, SYSCALL auditing in `auditd` is disabled by default and can explain missing events.
|
||||
**On SLES** systems, SYSCALL auditing in `auditd` might be disabled by default and can be accounted for missing events.
|
||||
|
||||
1. To validate that SYSCALL auditing is not disabeld, list the current audit rules:
|
||||
1. To validate that SYSCALL auditing is not disabled, list the current audit rules:
|
||||
|
||||
```bash
|
||||
sudo auditctl -l
|
||||
```
|
||||
|
||||
if the following line is present, please remove it or edit it to enable Microsoft Defender for Endpoint to track specific SYSCALLs.
|
||||
if the following line is present, remove it or edit it to enable Microsoft Defender for Endpoint to track specific SYSCALLs.
|
||||
|
||||
```output
|
||||
-a task, never
|
||||
@ -86,7 +86,7 @@ Microsoft Defender for Endpoint utilized `audit` framework from linux to track n
|
||||
|
||||
## Missing file events
|
||||
|
||||
File events are collected with `fanotify` framework. In case some or all file events are missing please make sure fanotify is enabled on the device and that the file system is [supported](microsoft-defender-atp-linux.md#system-requirements).
|
||||
File events are collected with `fanotify` framework. In case some or all file events are missing, make sure `fanotify` is enabled on the device and that the file system is [supported](microsoft-defender-atp-linux.md#system-requirements).
|
||||
|
||||
List the filesystems on the machine with:
|
||||
|
||||
|
||||
@ -24,11 +24,8 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Azure Active Directory
|
||||
- Office 365
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
|
||||
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -109,7 +109,7 @@ The following downloadable spreadsheet lists the services and their associated U
|
||||
|
||||
|**Spreadsheet of domains list**|**Description**|
|
||||
|:-----|:-----|
|
||||
|<br/> | Spreadsheet of specific DNS records for service locations, geographic locations, and OS. <br><br>[Download the spreadsheet here.](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)
|
||||
|<br/> | Spreadsheet of specific DNS records for service locations, geographic locations, and OS. <br><br>[Download the spreadsheet here.](https://download.microsoft.com/download/8/a/5/8a51eee5-cd02-431c-9d78-a58b7f77c070/mde-urls.xlsx)
|
||||
|
||||
> [!NOTE]
|
||||
> For a more specific URL list, see [Configure proxy and internet connectivity settings](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-proxy-internet#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
||||
|
||||
@ -104,7 +104,7 @@ The following downloadable spreadsheet lists the services and their associated U
|
||||
|
||||
|**Spreadsheet of domains list**|**Description**|
|
||||
|:-----|:-----|
|
||||
|<br/> | Spreadsheet of specific DNS records for service locations, geographic locations, and OS. <br><br>Download the spreadsheet here: [mdatp-urls.xlsx](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx).
|
||||
|<br/> | Spreadsheet of specific DNS records for service locations, geographic locations, and OS. <br><br>Download the spreadsheet here: [mdatp-urls.xlsx](https://download.microsoft.com/download/8/a/5/8a51eee5-cd02-431c-9d78-a58b7f77c070/mde-urls.xlsx).
|
||||
|
||||
Microsoft Defender for Endpoint can discover a proxy server by using the following discovery methods:
|
||||
- Proxy autoconfig (PAC)
|
||||
|
||||
@ -2,7 +2,7 @@
|
||||
title: Microsoft Threat Experts
|
||||
ms.reviewer:
|
||||
description: Microsoft Threat Experts provides an additional layer of expertise to Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
|
||||
keywords: managed threat hunting service, managed threat hunting, managed detection and response (MDR) service, MTE, Microsoft Threat Experts
|
||||
keywords: managed threat hunting service, managed threat hunting, managed detection and response (MDR) service, MTE, Microsoft Threat Experts, MTE-TAN, targeted attack notification, Targeted Attack Notification
|
||||
search.product: Windows 10
|
||||
search.appverid: met150
|
||||
ms.prod: m365-security
|
||||
@ -32,25 +32,22 @@ ms.technology: mde
|
||||
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
Microsoft Threat Experts is a managed threat hunting service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don’t get missed.
|
||||
Microsoft Threat Experts is a managed threat hunting service that provides your Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in your unique environments don’t get missed.
|
||||
|
||||
This new capability provides expert-driven insights and data through targeted attack notification and access to experts on demand.
|
||||
|
||||
Watch this video for a quick overview of Microsoft Threat Experts.
|
||||
|
||||
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qZ0B]
|
||||
|
||||
This managed threat hunting service provides expert-driven insights and data through these two capabilities: targeted attack notification and access to experts on demand.
|
||||
|
||||
## Before you begin
|
||||
> [!NOTE]
|
||||
> Discuss the eligibility requirements with your Microsoft Technical Service provider and account team before you apply to the managed threat hunting service.
|
||||
|
||||
Microsoft Defender for Endpoint customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive Targeted Attack Notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. Targeted Attack Notifications are always included after you have been accepted into Microsoft Threat Experts managed threat hunting service.
|
||||
If you're a Microsoft Defender for Endpoint customer, you need to apply for Microsoft Threat Experts - Targeted Attack Notifications to get special insights and analysis that help identify the most critical threats so you can respond to them quickly. Contact your account team or Microsoft representative to subscribe to Microsoft Threat Experts - Experts on Demand to consult with our threat experts on relevant detections and adversaries.
|
||||
|
||||
If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply. Once accepted, you will get the benefits of Targeted Attack Notifications, and start a 90-day trial of Experts on Demand. Contact your Microsoft representative to get a full Experts on-Demand subscription. See [Configure Microsoft Threat Experts capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts#before-you-begin) for details.
|
||||
To enroll to Microsoft Threat Experts - Targeted Attack Notifications benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts - Targeted Attack Notifications** to apply. Once accepted, you will get the benefits of Targeted Attack Notifications.
|
||||
|
||||
See [Configure Microsoft Threat Experts capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts#before-you-begin) for details.
|
||||
|
||||
## Targeted attack notification
|
||||
Microsoft Threat Experts provides proactive hunting for the most important threats to your network, including human adversary intrusions, hands-on-keyboard attacks, or advanced attacks like cyberespionage. The managed hunting service includes:
|
||||
Microsoft Threat Experts provides proactive hunting for the most important threats to your network, including human adversary intrusions, hands-on-keyboard attacks, or advanced attacks like cyberespionage. These notifications shows up as a new alert. The managed hunting service includes:
|
||||
- Threat monitoring and analysis, reducing dwell time and risk to the business
|
||||
- Hunter-trained artificial intelligence to discover and prioritize both known and unknown attacks
|
||||
- Identifying the most important risks, helping SOCs maximize time and energy
|
||||
@ -58,11 +55,9 @@ Microsoft Threat Experts provides proactive hunting for the most important threa
|
||||
|
||||
## Collaborate with experts, on demand
|
||||
Customers can engage our security experts directly from within Microsoft Defender Security Center for timely and accurate response. Experts provide insights needed to better understand the complex threats affecting your organization, from alert inquiries, potentially compromised devices, root cause of a suspicious network connection, to additional threat intelligence regarding ongoing advanced persistent threat campaigns. With this capability, you can:
|
||||
|
||||
- Get additional clarification on alerts including root cause or scope of the incident
|
||||
- Gain clarity into suspicious device behavior and next steps if faced with an advanced attacker
|
||||
- Determine risk and protection regarding threat actors, campaigns, or emerging attacker techniques
|
||||
- Seamlessly transition to Microsoft Incident Response (IR) or other third-party Incident Response services when necessary
|
||||
|
||||
The option to **Consult a threat expert** is available in several places in the portal so you can engage with experts in the context of your investigation:
|
||||
|
||||
@ -79,7 +74,7 @@ The option to **Consult a threat expert** is available in several places in the
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> Customers with Premier Support subscription mapped to their Office 365 license can track the status of their Experts on Demand cases through Microsoft Services Hub.
|
||||
> If you would like to track the status of your Experts on Demand cases through Microsoft Services Hub, reach out to your Technical Account Manager.
|
||||
|
||||
Watch this video for a quick overview of the Microsoft Services Hub.
|
||||
|
||||
|
||||
@ -24,14 +24,14 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
|
||||
**Platforms**
|
||||
- macOS
|
||||
- Linux
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
|
||||
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-offboarddevices-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,13 +24,14 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
|
||||
**Platforms**
|
||||
- Windows 7 SP1 Enterprise
|
||||
- Windows 7 SP1 Pro
|
||||
- Windows 8.1 Pro
|
||||
- Windows 8.1 Enterprise
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-downlevel-abovefoldlink).
|
||||
|
||||
@ -226,7 +226,7 @@ The following downloadable spreadsheet lists the services and their associated U
|
||||
|
||||
|**Spreadsheet of domains list**|**Description**|
|
||||
|:-----|:-----|
|
||||
|<br/> | Spreadsheet of specific DNS records for service locations, geographic locations, and OS. <br><br>[Download the spreadsheet here.](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)
|
||||
|<br/> | Spreadsheet of specific DNS records for service locations, geographic locations, and OS. <br><br>[Download the spreadsheet here.](https://download.microsoft.com/download/8/a/5/8a51eee5-cd02-431c-9d78-a58b7f77c070/mde-urls.xlsx)
|
||||
|
||||
|
||||
### Microsoft Defender for Endpoint service backend IP range
|
||||
|
||||
@ -25,13 +25,9 @@ ms.technology: mde
|
||||
**Applies to:**
|
||||
- Azure Active Directory
|
||||
- Office 365
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
|
||||
|
||||
|
||||
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-rbac-abovefoldlink)
|
||||
|
||||
|
||||
Using role-based access control (RBAC), you can create roles and groups within your security operations team to grant appropriate access to the portal. Based on the roles and groups you create, you have fine-grained control over what users with access to the portal can see and do.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4bJ2a]
|
||||
|
||||
@ -38,7 +38,9 @@ Advanced hunting is a query-based threat-hunting tool that lets you explore up t
|
||||
|
||||
### Schema tables
|
||||
|
||||
- [DeviceTvmSoftwareInventoryVulnerabilities](advanced-hunting-devicetvmsoftwareinventoryvulnerabilities-table.md) - Inventory of software on devices as well as any known vulnerabilities in these software products
|
||||
- [DeviceTvmSoftwareInventory](advanced-hunting-devicetvmsoftwareinventory-table.md) - Inventory of software installed on devices, including their version information and end-of-support status
|
||||
|
||||
- [DeviceTvmSoftwareVulnerabilities](advanced-hunting-devicetvmsoftwarevulnerabilities-table.md) - Software vulnerabilities found on devices and the list of available security updates that address each vulnerability
|
||||
|
||||
- [DeviceTvmSoftwareVulnerabilitiesKB](advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md) - Knowledge base of publicly disclosed vulnerabilities, including whether exploit code is publicly available
|
||||
|
||||
@ -56,7 +58,7 @@ Advanced hunting is a query-based threat-hunting tool that lets you explore up t
|
||||
|
||||
```kusto
|
||||
// Search for devices with High active alerts or Critical CVE public exploit
|
||||
DeviceTvmSoftwareInventoryVulnerabilities
|
||||
DeviceTvmSoftwareVulnerabilities
|
||||
| join kind=inner(DeviceTvmSoftwareVulnerabilitiesKB) on CveId
|
||||
| where IsExploitAvailable == 1 and CvssScore >= 7
|
||||
| summarize NumOfVulnerabilities=dcount(CveId),
|
||||
@ -66,7 +68,6 @@ DeviceName=any(DeviceName) by DeviceId
|
||||
DeviceName=any(DeviceName) by DeviceId, AlertId
|
||||
| project DeviceName, NumOfVulnerabilities, AlertId
|
||||
| order by NumOfVulnerabilities desc
|
||||
|
||||
```
|
||||
|
||||
## Related topics
|
||||
|
||||
Reference in New Issue
Block a user