deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-22 22:03:46 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

update portal URL to https://securitycenter.windows.com

Browse Source
This commit is contained in:
Joey Caparas
2016-05-10 13:40:05 +10:00
parent 878e509036
commit af13a6cf74
8 changed files with 33 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
windows/keep-secure/configure-endpoints-windows-defender-advanced-threat-protection.md
View File

@ -21,15 +21,15 @@ You can use a Group Policy (GP) configuration package or an automated script to
## Configure with System Center Configuration Manager (SCCM)
1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage_ConfigurationManager.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com):
1. Open the SCCM configuration package .zip file (*WindowsATPOnboardingPackage_ConfigurationManager.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
a. Click **Client onboarding** on the **Navigation pane**.
b. Select **SCCM**, click **Download package**, and save the .zip file.
b. Select **SCCM**, click **Download package**, and save the .zip file.
2. Copy the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package.
3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic.
3. Import the configuration package by following the steps in the [How to Create Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682112.aspx#BKMK_Import) topic.
4. Deploy the package by following the steps in the [How to Deploy Packages and Programs in Configuration Manager](https://technet.microsoft.com/en-us/library/gg682178.aspx) topic.
@ -41,7 +41,7 @@ Using the GP configuration package ensures your endpoints will be correctly conf
> **Note**   To use GP updates to deploy the package, you must be on Windows Server 2008 R2 or later. The endpoints must be running Windows 10 TAP.
1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage_GroupPolicy.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://seville.windows.com):
1. Open the GP configuration package .zip file (*WindowsATPOnboardingPackage_GroupPolicy.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
a. Click **Client onboarding** on the **Navigation pane**.

1
windows/keep-secure/data-storage-privacy-windows-defender-advanced-threat-protection.md
View File

@ -6,7 +6,6 @@ search.product: eADQiWindows 10XVcnh
ms.prod: W10
ms.mktglfcycl: deploy
ms.sitesec: library
author: DulceMV
---
# Windows Defender ATP data storage and privacy

2
windows/keep-secure/minimum-requirements-windows-defender-advanced-threat-protection.md
View File

@ -22,7 +22,7 @@ There are some minimum requirements for onboarding your network and endpoints.
### Network and data storage and configuration requirements
Your organization must use Azure Active Directory (AAD) to manage users. AAD is used during
service onboarding to manage user-based access to the [Windows Defender ATP portal](https://seville.windows.com/).
service onboarding to manage user-based access to the [Windows Defender ATP portal](https://securitycenter.windows.com/).
<!--If you’d like help with using AAD to set up user access, contact the
[Windows Defender ATP Yammer group](https://www.yammer.com/wsscengineering/\#/threads/inGroup?type=in\_group&feedId=7108776&view=all)

4
windows/keep-secure/monitor-onboarding-windows-defender-advanced-threat-protection.md
View File

@ -25,7 +25,7 @@ Monitoring can be done directly on the portal, or by using System Center Configu
## Monitor with the portal
1. Go to the [Windows Defender ATP portal](https://seville.windows.com).
1. Go to the [Windows Defender ATP portal](https://securitycenter.windows.com/).
2. Click **Machines view**.
@ -48,7 +48,7 @@ Monitoring with SCCM consists of two parts:
2. Click **Overview** and then **Deployments**.
3. Click on the deployment with the package name.
3. Click on the deployment with the package name.
4. Review the status indicators under **Completion Statistics** and **Content Status**.

2
windows/keep-secure/portal-overview-windows-defender-advanced-threat-protection.md
View File

@ -20,7 +20,7 @@ author: DulceMV
Enterprise security teams can use the portal to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches.
You can use the [Windows Defender ATP portal](https://seville.windows.com/) to:
You can use the [Windows Defender ATP portal](https://securitycenter.windows.com/) to:
- View, sort, and triage alerts from your endpoints
- Search for more information on observed indicators such as files and IP Addresses
- Change Windows Defender ATP settings, including time zone and alert suppression rules

4
windows/keep-secure/service-onboarding-windows-defender-advanced-threat-protection.md
View File

@ -22,7 +22,7 @@ You have to assign users to the Windows ATP Service application in Azure Active
**Manage user access to the Windows Defender ATP portal**:
1. When you first go to the [Windows Defender ATP portal](https://seville.windows.com/) and your directory does not
1. When you first go to the [Windows Defender ATP portal](https://securitycenter.windows.com/) and your directory does not
have users assigned to the Windows ATP Service application, you will
be directed to open the [Microsoft Azure Dashboard](https://portal.azure.com) to manage user access.
@ -105,7 +105,7 @@ You have to assign users to the Windows ATP Service application in Azure Active
> **Note**&nbsp;&nbsp; You need to assign roles for every user in your organization that requires access to the Windows Defender ATP portal. You can assign roles at any time by going to the Azure Management Portal, clicking **Active Directory**, and then finding your directory in the list and following the steps above.
When you have finished assigning roles, return to the [Windows Defender ATP portal](https://seville.windows.com) and refresh the
When you have finished assigning roles, return to the [Windows Defender ATP portal](https://securitycenter.windows.com) and refresh the
page.
Follow the steps in the onboarding wizard to complete the onboarding process.

43
windows/keep-secure/troubleshoot-onboarding-windows-defender-advanced-threat-protection.md
View File

@ -87,7 +87,7 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi
b. Right-click **Command prompt** and select **Run as administrator**.
2. Enter the following command and press **Enter**:
2. Enter the following command and press **Enter**:
```
sc qc sense
```
@ -95,11 +95,11 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi
![Result of the sq query sense command](images/sc-query-sense-autostart.png)
3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**:
3. If the service **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**:
```
sc config sense start=auto
```
4. A success message is displayed. Verify the change by entering the following command and press **Enter**:
4. A success message is displayed. Verify the change by entering the following command and press **Enter**:
```
sc qc sense
```
@ -112,19 +112,19 @@ If the endpoints aren't reporting correctly, you might need to check that the Wi
b. Right-click **Command prompt** and select **Run as administrator**.
2. Enter the following command and press **Enter**:
2. Enter the following command and press **Enter**:
```
sc query sense
```
If the service is running, the result should look like the following screenshot:
![Result of the sc query sense command](images/sc-query-sense-running.png)
3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**:
3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**:
```
sc start sense
```
4. A success message is displayed. Verify the change by entering the following command and press **Enter**:
4. A success message is displayed. Verify the change by entering the following command and press **Enter**:
```
sc qc sense
```
@ -144,24 +144,24 @@ There are two ways to check the startup type for the service: from the command l
b. Right-click **Command prompt** and select **Run as administrator**.
2. Enter the following command and press **Enter**:
2. Enter the following command and press **Enter**:
```
sc qc diagtrack
```
If the service is enabled, then the result should look like the following screenshot:
![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png)
4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**:
4. If the **START_TYPE** is not set to **AUTO_START**, then you'll need to enter the following command and press **Enter**:
```
sc config diagtrack start=auto
```
5. A success message is displayed. Verify the change by entering the following command and press **Enter**:
5. A success message is displayed. Verify the change by entering the following command and press **Enter**:
```
sc qc diagtrack
```
**Check the startup type in the services console**:
1. Open the services console:
@ -184,20 +184,20 @@ There are two ways to check the startup type for the service: from the command l
b. Right-click **Command prompt** and select **Run as administrator**.
2. Enter the following command and press **Enter**:
2. Enter the following command and press **Enter**:
```
sc query diagtrack
```
If the service is running, the result should look like the following screenshot:
![Result of the sc query command for sc query diagtrack](images/windefatp-sc-query-diagtrack.png)
3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**:
3. If the service **STATE** is not set to **RUNNING**, then you'll need to enter the following command and press **Enter**:
```
sc start diagtrack
```
4. A success message is displayed. Verify the change by entering the following command and press **Enter**:
4. A success message is displayed. Verify the change by entering the following command and press **Enter**:
```
sc query diagtrack
```
@ -230,14 +230,14 @@ If you don't see any users in the [Azure Management Portal](https://manage.windo
4. Select the type of user and enter their details. There might be multiple steps in the **Add user** dialog box depending on the type of user. When you're done, click **Complete** ![Check icon](images/check-icon.png) or **OK**.
5. Continue to add users. They will now appear in the **Users** section of the **Windows ATP Service** application. You must assign the user a role before they can access the [Windows Defender ATP portal](https://seville.windows.com/).
5. Continue to add users. They will now appear in the **Users** section of the **Windows ATP Service** application. You must assign the user a role before they can access the [Windows Defender ATP portal](https://securitycenter.windows.com/).
## Manage access for all users in Azure Active Directory
If you remove access for all users to the Windows ATP Service application (by clicking Manage access), you will not see the application in the list of applications in your directory in the [Azure Management Portal](https://manage.windowsazure.com/).
Log in to the application in the Azure Management Portal again:
1. Sign in to the [Windows Defender ATP portal](https://seville.windows.com/) with the user account you want to give access to.
1. Sign in to the [Windows Defender ATP portal](https://securitycenter.windows.com/) with the user account you want to give access to.
2. Confirm that you have signed in with the correct details, and click **Accept**.
@ -246,7 +246,7 @@ Log in to the application in the Azure Management Portal again:
## Review events and errors on endpoints with Event Viewer
You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/en-US/library/aa745633(v=bts.10).aspx) on individual endpoints, or check the status of machines from the [Windows Defender ATP portal](https://seville.windows.com/).
You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/en-US/library/aa745633(v=bts.10).aspx) on individual endpoints, or check the status of machines from the [Windows Defender ATP portal](https://securitycenter.windows.com/).
For example, if endpoints are not appearing in the **Machines view** list, you might need to look for event IDs on the endpoints.
@ -263,7 +263,7 @@ For example, if endpoints are not appearing in the **Machines view** list, you m
<table>
<tbody style="vertical-align:top;">
<tr>
<tr>
<th>Event ID</th>
<th>Message</th>
<th>Description</th>
@ -485,4 +485,3 @@ See [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defen
- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
- [Additional Windows Defender ATP configuration settings](additional-configuration-windows-defender-advanced-threat-protection.md)
- [Monitor the Windows Defender ATP onboarding](monitor-onboarding-windows-defender-advanced-threat-protection.md)

4
windows/keep-secure/windows-defender-advanced-threat-protection.md
View File

@ -25,7 +25,7 @@ Windows Defender ATP uses the following combination of technology built into Win
collect and process behavioral signals from the operating system
(for example, process, registry, file, and network communications)
and sends this telemetry to your private, isolated, cloud instance of Windows Defender ATP.
- **Cloud security analytics**: Leveraging big-data, machine-learning, and
unique Microsoft optics across the Windows ecosystem (such as the
@ -49,7 +49,7 @@ components:
Endpoint investigation capabilities in this service let you drill down
into security alerts and understand the scope and nature of a potential
breach. You can submit files for deep analysis and receive the results
without leaving the [Windows Defender ATP portal](https://seville.windows.com).
without leaving the [Windows Defender ATP portal](https://securitycenter.windows.com).
Windows Defender ATP works with existing Windows security technologies
on endpoints, such as Windows Defender, AppLocker, and Device Guard. It