deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-17 15:57:23 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Update defender-endpoint-false-positives-negatives.md

Browse Source
This commit is contained in:
Denise Vangel-MSFT 2020-12-15 16:02:50 -08:00
parent 131da8346a
commit ae764c12b4
1 changed files with 15 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
windows/security/threat-protection/microsoft-defender-atp/defender-endpoint-false-positives-negatives.md
View File

@ -35,12 +35,12 @@ Did Microsoft Defender for Endpoint identify an artifact as malicious, even thou
| Step | Description |
|:---|:---|
| 1. Identify a false positive/negative | |
| 2. Review/define exclusions for Defender for Endpoint | |
| 3. Review/define indicators for Defender for Endpoint | |
| 4. Classify a false positive/negative in Defender for Endpoint | |
| 5. Submit a file for analysis | |
| 6. Confirm your software uses EV code signing | |
| 1. [Identify a false positive/negative](#identify-a-false-positivenegative) | |
| 2. [Review/define exclusions for Defender for Endpoint](#review-or-define-exclusions) | |
| 3. [Review/define indicators for Defender for Endpoint](#review-or-define-indicators) | |
| 4. [Classify a false positive/negative in Defender for Endpoint](#classify-a-false-positive-or-false-negative) | |
| 5. [Submit a file for analysis](#submit-a-file-for-analysis) | |
| 6. [Confirm your software uses EV code signing](#confirm-your-software-uses-ev-code-signing) | |
## Identify a false positive/negative
@ -52,8 +52,16 @@ Did Microsoft Defender for Endpoint identify an artifact as malicious, even thou
## Review or define indicators
*Allow indicators for false positives; block indicators for false negatives. https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators*
## Classify a false positive or false negative
*Need to figure out where/how this is done*
## Submit a file for analysis
*https://www.microsoft.com/wdsi/filesubmission/*
## Confirm your software uses EV code signing
*Some info is available here: https://docs.microsoft.com/windows-hardware/drivers/dashboard/get-a-code-signing-certificate*