Merge remote-tracking branch 'origin/master' into atp-ip

windows/security/information-protection/tpm/tpm-recommendations.md

@@ -9,7 +9,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 05/16/2018
+ms.date: 11/29/2018
 ---
 
 # TPM recommendations
@@ -64,6 +64,9 @@ TPM 2.0 products and systems have important security advantages over TPM 1.2, in
 
 -   While TPM 1.2 parts are discrete silicon components which are typically soldered on the motherboard, TPM 2.0 is available as a **discrete (dTPM)** silicon component in a single semiconductor package, an **integrated** component incorporated in one or more semiconductor packages - alongside other logic units in the same package(s) - and as a **firmware (fTPM)** based component running in a trusted execution environment (TEE) on a general purpose SoC.
 
+> [!NOTE]
+> TPM 2.0 requires UEFI firmware. A computer with legacy BIOS and TPM 2.0 won't work as expected.
+
 ## Discrete, Integrated or Firmware TPM?
 
 There are three implementation options for TPMs:
@@ -113,6 +116,10 @@ The following table defines which Windows features require TPM support.
 | TPM Platform Crypto Provider Key Storage Provider| Yes | Yes| Yes                |          |
 | Virtual Smart Card      | Yes           | Yes               | Yes                |          |
 | Certificate storage     | No            | Yes               | Yes                | TPM is only required when the certificate is stored in the TPM. |
+| Autopilot               | Yes           | No                | Yes                | TPM 2.0 and UEFI firmware is required. |
+| SecureBIO               | Yes           | No                | Yes                | TPM 2.0 and UEFI firmware is required. |
+| DRTM                    | Yes           | No                | Yes                | TPM 2.0 and UEFI firmware is required. |
+
 
 ## OEM Status on TPM 2.0 system availability and certified parts
 

windows/security/information-protection/tpm/trusted-platform-module-overview.md

@@ -9,7 +9,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms-author: v-anbic
-ms.date: 08/21/2018
+ms.date: 11/29/2018
 ---
 
 # Trusted Platform Module Technology Overview
@@ -69,7 +69,7 @@ Some things that you can check on the device are:
 -   Is SecureBoot supported and enabled?
 
 > [!NOTE]
->  Windows 10 and Windows Server 2016 support Device Health Attestation with TPM 2.0. Support for TPM 1.2 was added beginning with Windows version 1607 (RS1).
+>  Windows 10 and Windows Server 2016 support Device Health Attestation with TPM 2.0. Support for TPM 1.2 was added beginning with Windows version 1607 (RS1). TPM 2.0 requires UEFI firmware. A computer with legacy BIOS and TPM 2.0 won't work as expected.
 
 ## Supported versions for device health attestation
 

windows/security/threat-protection/windows-defender-atp/use-apis.md

@@ -10,7 +10,7 @@ ms.pagetype: security
 ms.author: macapara
 author: mjcaparas
 ms.localizationpriority: medium
-ms.date: 10/23/2017
+ms.date: 11/28/2018
 ---
 
 # Use the Windows Defender ATP exposed APIs
@@ -21,6 +21,6 @@ ms.date: 10/23/2017
 ## In this section
 Topic | Description
 :---|:---
-Create your app | Learn how to create an application to get programmatical access to Windows Defender ATP on behalf of a user or without a user.
-Supported Windows Defender ATP APIs | Learn more about the individual supported entities where you can run API calls to and details such as HTTP request values, request headers and expected responses.
-How to use APIs - Samples | Learn how to use Advanced hunting APIs and multiple APIs such as PowerShell.
+Create your app | Learn how to create an application to get programmatical access to Windows Defender ATP [on behalf of a user](exposed-apis-create-app-nativeapp.md) or [without a user](exposed-apis-create-app-webapp.md).
+Supported Windows Defender ATP APIs | Learn more about the individual supported entities where you can run API calls to and details such as HTTP request values, request headers and expected responses. Examples include APIs for [alert resource type](alerts-windows-defender-advanced-threat-protection-new.md), [domain related alerts](get-domain-related-alerts-windows-defender-advanced-threat-protection-new.md), or even actions such as [isolate machine](isolate-machine-windows-defender-advanced-threat-protection-new.md).
+How to use APIs - Samples | Learn how to use Advanced hunting APIs and multiple APIs such as PowerShell. Other examples include [schedule advanced hunting using Microsoft Flow](run-advanced-query-sample-ms-flow.md) or [OData queries](exposed-apis-odata-samples.md).

windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md

@@ -11,7 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 11/27/2018
+ms.date: 11/29/2018
 ---
 
 # Reduce attack surfaces with attack surface reduction rules 
@@ -31,6 +31,8 @@ Attack surface reduction rules help prevent actions and apps that are typically
 
 When an attack surface reduction rule is triggered, a notification displays from the Action Center on the user's computer. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information.
 
+Attack surface reduction is supported on Windows 10, version 1709 and later and Windows Server 2019.
+
 ## Requirements
 
 Attack surface reduction rules are a feature of Windows Defender ATP and require Windows 10 Enterprise E5 and [Windows Defender AV real-time protection](../windows-defender-antivirus/configure-real-time-protection-windows-defender-antivirus.md).

windows/security/threat-protection/windows-defender-exploit-guard/audit-windows-defender-exploit-guard.md

@@ -21,7 +21,7 @@ ms.date: 09/18/2018
 
 - [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
 
-You can enable attack surface reduction rules, eploit protection, network protection, and controlled folder access in audit mode. This lets you see a record of what *would* have happened if you had enabled the feature.
+You can enable attack surface reduction rules, exploit protection, network protection, and controlled folder access in audit mode. This lets you see a record of what *would* have happened if you had enabled the feature.
 
 You might want to do this when testing how the features will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how many suspicious file modification attempts generally occur over a certain period.
 
@@ -69,4 +69,4 @@ You can also use the a custom PowerShell script that enables the features in aud
 - [Protect devices from exploits](exploit-protection-exploit-guard.md) 
 - [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction-exploit-guard.md) 
 - [Protect your network](network-protection-exploit-guard.md) 
-- [Protect important folders](controlled-folders-exploit-guard.md)
+- [Protect important folders](controlled-folders-exploit-guard.md)

windows/security/threat-protection/windows-defender-exploit-guard/controlled-folders-exploit-guard.md

@@ -11,7 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 10/02/2018
+ms.date: 11/29/2018
 ---
 
 # Protect important folders with controlled folder access
@@ -33,6 +33,7 @@ The protected folders include common system folders, and you can [add additional
 
 You can use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
 
+Controlled folder access is supported on Windows 10, version 1709 and later and Windows Server 2019.
 
 ## Requirements
 

windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard.md

@@ -144,30 +144,30 @@ You can access these events in Windows Event viewer:
 
 Feature | Provider/source | Event ID | Description
 :-|:-|:-:|:-
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 1 | ACG audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 2 | ACG enforce
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 3 | Do not allow child processes audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 4 | Do not allow child processes block
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 5 | Block low integrity images audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 6 | Block low integrity images block
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 7 | Block remote images audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 8 | Block remote images block
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 9 | Disable win32k system calls audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 10 | Disable win32k system calls block
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 11 | Code integrity guard audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 12 | Code integrity guard block
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 13 | EAF audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 14 | EAF enforce
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 15 | EAF+ audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 16 | EAF+ enforce
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 17 | IAF audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 18 | IAF enforce
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 19 | ROP StackPivot audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 20 | ROP StackPivot enforce
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 21 | ROP CallerCheck audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 22 | ROP CallerCheck enforce
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 23 | ROP SimExec audit
-Exploit protection | Security-Mitigations (Kernal Mode/User Mode) | 24 | ROP SimExec enforce
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 1 | ACG audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 2 | ACG enforce
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 3 | Do not allow child processes audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 4 | Do not allow child processes block
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 5 | Block low integrity images audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 6 | Block low integrity images block
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 7 | Block remote images audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 8 | Block remote images block
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 9 | Disable win32k system calls audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 10 | Disable win32k system calls block
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 11 | Code integrity guard audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 12 | Code integrity guard block
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 13 | EAF audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 14 | EAF enforce
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 15 | EAF+ audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 16 | EAF+ enforce
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 17 | IAF audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 18 | IAF enforce
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 19 | ROP StackPivot audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 20 | ROP StackPivot enforce
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 21 | ROP CallerCheck audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 22 | ROP CallerCheck enforce
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 23 | ROP SimExec audit
+Exploit protection | Security-Mitigations (Kernel Mode/User Mode) | 24 | ROP SimExec enforce
 Exploit protection | WER-Diagnostics | 5 | CFG Block
 Exploit protection | Win32K (Operational) | 260 | Untrusted Font
 Network protection | Windows Defender (Operational) | 5007 | Event when settings are changed
@@ -180,4 +180,4 @@ Controlled folder access | Windows Defender (Operational) | 1127 | Blocked Contr
 Controlled folder access | Windows Defender (Operational) | 1128 | Audited Controlled folder access sector write block event
 Attack surface reduction | Windows Defender (Operational) | 5007 | Event when settings are changed
 Attack surface reduction | Windows Defender (Operational) | 1122 | Event when rule fires in Audit-mode 
-Attack surface reduction | Windows Defender (Operational) | 1121 | Event when rule fires in Block-mode 
+Attack surface reduction | Windows Defender (Operational) | 1121 | Event when rule fires in Block-mode 

windows/security/threat-protection/windows-defender-exploit-guard/exploit-protection-exploit-guard.md

@@ -11,7 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 08/09/2018
+ms.date: 11/29/2018
 ---
 
 # Protect devices from exploits
@@ -22,10 +22,10 @@ ms.date: 08/09/2018
 
 Exploit protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps. 
 
-It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md).
+It is part of [Windows Defender Exploit Guard](windows-defender-exploit-guard.md). Exploit protection is supported on Windows 10, version 1709 and later and Windows Server 2016, version 1803 or later.
 
 >[!TIP]
->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
+>You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
 
 Exploit protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md) - which gives you detailed reporting into exploit protection events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).
 

windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md

@@ -11,7 +11,7 @@ ms.pagetype: security
 ms.localizationpriority: medium
 author: andreabichsel
 ms.author: v-anbic
-ms.date: 08/09/2018
+ms.date: 11/29/2018
 ---
 
 # Protect your network
@@ -24,8 +24,10 @@ Network protection helps reduce the attack surface of your devices from Internet
 
 It expands the scope of [Windows Defender SmartScreen](../windows-defender-smartscreen/windows-defender-smartscreen-overview.md) to block all outbound HTTP(s) traffic that attempts to connect to low-reputation sources (based on the domain or hostname).
 
+Network protection is supported on Windows 10, version 1709 and later and Windows Server 2016, version 1803 or later.
+
 >[!TIP]
->You can also visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
+>You can visit the Windows Defender Testground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
 
 Network protection works best with [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md), which gives you detailed reporting into Windows Defender EG events and blocks as part of the usual [alert investigation scenarios](../windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md).