deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-13 22:07:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

update allowed blocked lists

Browse Source
This commit is contained in:
Joey Caparas 2018-06-14 17:07:02 -07:00
parent 61caeb1d93
commit b4295544c7
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
windows/security/threat-protection/windows-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection.md
View File

@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara ms.author: macapara
author: mjcaparas author: mjcaparas
ms.localizationpriority: high ms.localizationpriority: high
ms.date: 04/24/2018 ms.date: 06/13/2018
--- ---
# Query data using Advanced hunting in Windows Defender ATP # Query data using Advanced hunting in Windows Defender ATP
@ -54,6 +54,8 @@ We then add a filter on the _FileName_ to contain only instances of _powershell
Afterwards, we add a filter on the _ProcessCommandLine_ Afterwards, we add a filter on the _ProcessCommandLine_
Finally, we project only the columns we're interested in exploring and limit the results to 100 and click **Run query**. Finally, we project only the columns we're interested in exploring and limit the results to 100 and click **Run query**.
You have the option of expanding the screen view so you can focus on your hunting query and related results.
### Use operators ### Use operators
The query language is very powerful and has a lot of available operators, some of them are - The query language is very powerful and has a lot of available operators, some of them are -

4
windows/security/threat-protection/windows-defender-atp/manage-automation-allowed-blocked-list-windows-defender-advanced-threat-protection.md
View File

@ -10,7 +10,7 @@ ms.pagetype: security
ms.author: macapara ms.author: macapara
author: mjcaparas author: mjcaparas
ms.localizationpriority: high ms.localizationpriority: high
ms.date: 06/11/2018 ms.date: 06/14/2018
--- ---
# Manage automation allowed/blocked lists # Manage automation allowed/blocked lists
@ -43,8 +43,6 @@ You can define the conditions for when entities are identified as malicious or s
- Certificate - Certificate
- IP address - IP address
- DNS - DNS
- Email
- Process memory
3. Click **Add system exclusion**. 3. Click **Add system exclusion**.