mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-18 16:27:22 +00:00
updated-4567381-batch13
rebranding
This commit is contained in:
Lovina Saldanha
parent
d4acc99d95
commit
c7dc0cc6df
@ -25,15 +25,15 @@ ms.topic: conceptual
|
|||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
Microsoft Defender ATP endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats.
|
Defender for Endpoint endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats.
|
||||||
|
|
||||||
When a threat is detected, alerts are created in the system for an analyst to investigate. Alerts with the same attack techniques or attributed to the same attacker are aggregated into an entity called an _incident_. Aggregating alerts in this manner makes it easy for analysts to collectively investigate and respond to threats.
|
When a threat is detected, alerts are created in the system for an analyst to investigate. Alerts with the same attack techniques or attributed to the same attacker are aggregated into an entity called an _incident_. Aggregating alerts in this manner makes it easy for analysts to collectively investigate and respond to threats.
|
||||||
|
|
||||||
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4o1j5]
|
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4o1j5]
|
||||||
|
|
||||||
Inspired by the "assume breach" mindset, Microsoft Defender ATP continuously collects behavioral cyber telemetry. This includes process information, network activities, deep optics into the kernel and memory manager, user login activities, registry and file system changes, and others. The information is stored for six months, enabling an analyst to travel back in time to the start of an attack. The analyst can then pivot in various views and approach an investigation through multiple vectors.
|
Inspired by the "assume breach" mindset, Defender for Endpoint continuously collects behavioral cyber telemetry. This includes process information, network activities, deep optics into the kernel and memory manager, user login activities, registry and file system changes, and others. The information is stored for six months, enabling an analyst to travel back in time to the start of an attack. The analyst can then pivot in various views and approach an investigation through multiple vectors.
|
||||||
|
|
||||||
The response capabilities give you the power to promptly remediate threats by acting on the affected entities.
|
The response capabilities give you the power to promptly remediate threats by acting on the affected entities.
|
||||||
|
|
||||||
|
|||||||
@ -18,21 +18,21 @@ ms.collection: M365-security-compliance
|
|||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
---
|
---
|
||||||
|
|
||||||
# Partner applications in Microsoft Defender ATP
|
# Partner applications in Microsoft Defender for Endpoint
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
|
|
||||||
Microsoft Defender ATP supports third-party applications to help enhance the detection, investigation, and threat intelligence capabilities of the platform.
|
Defender for Endpoint supports third-party applications to help enhance the detection, investigation, and threat intelligence capabilities of the platform.
|
||||||
|
|
||||||
|
|
||||||
The support for third-party solutions helps to further streamline, integrate, and orchestrate defenses from other vendors with Microsoft Defender ATP; enabling security teams to effectively respond better to modern threats.
|
The support for third-party solutions helps to further streamline, integrate, and orchestrate defenses from other vendors with Defender for Endpoint; enabling security teams to effectively respond better to modern threats.
|
||||||
|
|
||||||
Microsoft Defender ATP seamlessly integrates with existing security solutions. The integration provides integration with the following solutions such as:
|
Defender for Endpoint seamlessly integrates with existing security solutions. The integration provides integration with the following solutions such as:
|
||||||
- SIEM
|
- SIEM
|
||||||
- Ticketing and IT service management solutions
|
- Ticketing and IT service management solutions
|
||||||
- Managed security service providers (MSSP)
|
- Managed security service providers (MSSP)
|
||||||
@ -47,16 +47,16 @@ Microsoft Defender ATP seamlessly integrates with existing security solutions. T
|
|||||||
|
|
||||||
Logo |Partner name | Description
|
Logo |Partner name | Description
|
||||||
:---|:---|:---
|
:---|:---|:---
|
||||||
| [AttackIQ Platform](https://go.microsoft.com/fwlink/?linkid=2103502) | AttackIQ Platform validates Microsoft Defender ATP is configured properly by launching continuous attacks safely on production assets
|
| [AttackIQ Platform](https://go.microsoft.com/fwlink/?linkid=2103502) | AttackIQ Platform validates Defender for Endpoint is configured properly by launching continuous attacks safely on production assets
|
||||||
| [AzureSentinel](https://go.microsoft.com/fwlink/?linkid=2135705) | Stream alerts from Microsoft Defender Advanced Threat Protection into Azure Sentinel
|
| [AzureSentinel](https://go.microsoft.com/fwlink/?linkid=2135705) | Stream alerts from Defender for Endpoint into Azure Sentinel
|
||||||
 | [Cymulate](https://go.microsoft.com/fwlink/?linkid=2135574)| Correlate Microsoft Defender ATP findings with simulated attacks to validate accurate detection and effective response actions
|
 | [Cymulate](https://go.microsoft.com/fwlink/?linkid=2135574)| Correlate Defender for Endpoint findings with simulated attacks to validate accurate detection and effective response actions
|
||||||
 | [Elastic Security](https://go.microsoft.com/fwlink/?linkid=2139303) | Elastic Security is a free and open solution for preventing, detecting, and responding to threats
|
 | [Elastic Security](https://go.microsoft.com/fwlink/?linkid=2139303) | Elastic Security is a free and open solution for preventing, detecting, and responding to threats
|
||||||
 | [IBM QRadar](https://go.microsoft.com/fwlink/?linkid=2113903) | Configure IBM QRadar to collect detections from Microsoft Defender ATP
|
 | [IBM QRadar](https://go.microsoft.com/fwlink/?linkid=2113903) | Configure IBM QRadar to collect detections from Defender for Endpoint
|
||||||
 | [Micro Focus ArcSight](https://go.microsoft.com/fwlink/?linkid=2113548) | Use Micro Focus ArcSight to pull Microsoft Defender ATP detections
|
 | [Micro Focus ArcSight](https://go.microsoft.com/fwlink/?linkid=2113548) | Use Micro Focus ArcSight to pull Defender for Endpoint detections
|
||||||
 | [RSA NetWitness](https://go.microsoft.com/fwlink/?linkid=2118566) | Stream Microsoft Defender ATP Alerts to RSA NetWitness leveraging Microsoft Graph Security API
|
 | [RSA NetWitness](https://go.microsoft.com/fwlink/?linkid=2118566) | Stream Defender for Endpoint Alerts to RSA NetWitness leveraging Microsoft Graph Security API
|
||||||
 | [SafeBreach](https://go.microsoft.com/fwlink/?linkid=2114114)| Gain visibility into Microsoft Defender ATP security events that are automatically correlated with SafeBreach simulations
|
 | [SafeBreach](https://go.microsoft.com/fwlink/?linkid=2114114)| Gain visibility into Defender for Endpoint security events that are automatically correlated with SafeBreach simulations
|
||||||
 | [Skybox Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2127467) | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network, and threat context to uncover your riskiest vulnerabilities
|
 | [Skybox Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2127467) | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network, and threat context to uncover your riskiest vulnerabilities
|
||||||
 | [Splunk](https://go.microsoft.com/fwlink/?linkid=2129805) | The Microsoft Defender ATP Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk
|
 | [Splunk](https://go.microsoft.com/fwlink/?linkid=2129805) | The Defender for Endpoint Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk
|
||||||
 | [XM Cyber](https://go.microsoft.com/fwlink/?linkid=2136700) | Prioritize your response to an alert based on risk factors and high value assets
|
 | [XM Cyber](https://go.microsoft.com/fwlink/?linkid=2136700) | Prioritize your response to an alert based on risk factors and high value assets
|
||||||
|
|
||||||
### Orchestration and automation
|
### Orchestration and automation
|
||||||
@ -64,31 +64,31 @@ Logo |Partner name | Description
|
|||||||
|
|
||||||
Logo |Partner name | Description
|
Logo |Partner name | Description
|
||||||
:---|:---|:---
|
:---|:---|:---
|
||||||
 | [CyberSponse CyOps](https://go.microsoft.com/fwlink/?linkid=2115943) | CyOps integrates with Microsoft Defender ATP to automate customers' high-speed incident response playbooks
|
 | [CyberSponse CyOps](https://go.microsoft.com/fwlink/?linkid=2115943) | CyOps integrates with Defender for Endpoint to automate customers' high-speed incident response playbooks
|
||||||
 | [Delta Risk ActiveEye](https://go.microsoft.com/fwlink/?linkid=2127468) | Delta Risk, a leading provider of SOC-as-a-Service and security services, integrate Microsoft Defender ATP with its cloud-native SOAR platform, ActiveEye.
|
 | [Delta Risk ActiveEye](https://go.microsoft.com/fwlink/?linkid=2127468) | Delta Risk, a leading provider of SOC-as-a-Service and security services, integrate Defender for Endpoint with its cloud-native SOAR platform, ActiveEye.
|
||||||
 | [Demisto, a Palo Alto Networks Company](https://go.microsoft.com/fwlink/?linkid=2108414) | Demisto integrates with Microsoft Defender ATP to enable security teams to orchestrate and automate endpoint security monitoring, enrichment, and response
|
 | [Demisto, a Palo Alto Networks Company](https://go.microsoft.com/fwlink/?linkid=2108414) | Demisto integrates with Defender for Endpoint to enable security teams to orchestrate and automate endpoint security monitoring, enrichment, and response
|
||||||
 | [Microsoft Flow & Azure Functions](https://go.microsoft.com/fwlink/?linkid=2114300) | Use the Microsoft Defender ATP connectors for Azure Logic Apps & Microsoft Flow to automating security procedures
|
 | [Microsoft Flow & Azure Functions](https://go.microsoft.com/fwlink/?linkid=2114300) | Use the Defender for Endpoint connectors for Azure Logic Apps & Microsoft Flow to automating security procedures
|
||||||
 | [Rapid7 InsightConnect](https://go.microsoft.com/fwlink/?linkid=2116040) | InsightConnect integrates with Microsoft Defender ATP to accelerate, streamline, and integrate your time-intensive security processes
|
 | [Rapid7 InsightConnect](https://go.microsoft.com/fwlink/?linkid=2116040) | InsightConnect integrates with Defender for Endpoint to accelerate, streamline, and integrate your time-intensive security processes
|
||||||
 | [ServiceNow](https://go.microsoft.com/fwlink/?linkid=2135621) | Ingest alerts into ServiceNow Security Operations solution based on Microsoft Graph API integration
|
 | [ServiceNow](https://go.microsoft.com/fwlink/?linkid=2135621) | Ingest alerts into ServiceNow Security Operations solution based on Microsoft Graph API integration
|
||||||
 | [Swimlane](https://go.microsoft.com/fwlink/?linkid=2113902) | Maximize incident response capabilities utilizing Swimlane and Microsoft Defender ATP together
|
 | [Swimlane](https://go.microsoft.com/fwlink/?linkid=2113902) | Maximize incident response capabilities utilizing Swimlane and Defender for Endpoint together
|
||||||
|
|
||||||
|
|
||||||
### Threat intelligence
|
### Threat intelligence
|
||||||
|
|
||||||
Logo |Partner name | Description
|
Logo |Partner name | Description
|
||||||
:---|:---|:---
|
:---|:---|:---
|
||||||
 | [MISP (Malware Information Sharing Platform)](https://go.microsoft.com/fwlink/?linkid=2127543) | Integrate threat indicators from the Open Source Threat Intelligence Sharing Platform into your Microsoft Defender ATP environment
|
 | [MISP (Malware Information Sharing Platform)](https://go.microsoft.com/fwlink/?linkid=2127543) | Integrate threat indicators from the Open Source Threat Intelligence Sharing Platform into your Defender for Endpoint environment
|
||||||
 | [Palo Alto Networks](https://go.microsoft.com/fwlink/?linkid=2099582) | Enrich your endpoint protection by extending Autofocus and other threat feeds to Microsoft Defender ATP using MineMeld
|
 | [Palo Alto Networks](https://go.microsoft.com/fwlink/?linkid=2099582) | Enrich your endpoint protection by extending Autofocus and other threat feeds to Defender for Endpoint using MineMeld
|
||||||
 | [ThreatConnect](https://go.microsoft.com/fwlink/?linkid=2114115) | Alert and/or block on custom threat intelligence from ThreatConnect Playbooks using Microsoft Defender ATP indicators
|
 | [ThreatConnect](https://go.microsoft.com/fwlink/?linkid=2114115) | Alert and/or block on custom threat intelligence from ThreatConnect Playbooks using Defender for Endpoint indicators
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
### Network security
|
### Network security
|
||||||
Logo |Partner name | Description
|
Logo |Partner name | Description
|
||||||
:---|:---|:---
|
:---|:---|:---
|
||||||
 | [Aruba ClearPass Policy Manager](https://go.microsoft.com/fwlink/?linkid=2127544) | Ensure Microsoft Defender ATP is installed and updated on each endpoint before allowing access to the network
|
 | [Aruba ClearPass Policy Manager](https://go.microsoft.com/fwlink/?linkid=2127544) | Ensure Defender for Endpoint is installed and updated on each endpoint before allowing access to the network
|
||||||
 | [Blue Hexagon for Network](https://go.microsoft.com/fwlink/?linkid=2104613) | Blue Hexagon has built the industry's first real-time deep learning platform for network threat protection
|
 | [Blue Hexagon for Network](https://go.microsoft.com/fwlink/?linkid=2104613) | Blue Hexagon has built the industry's first real-time deep learning platform for network threat protection
|
||||||
 | [CyberMDX](https://go.microsoft.com/fwlink/?linkid=2135620) | Cyber MDX integrates comprehensive healthcare assets visibility, threat prevention and repose into your Microsoft Defender ATP environment
|
 | [CyberMDX](https://go.microsoft.com/fwlink/?linkid=2135620) | Cyber MDX integrates comprehensive healthcare assets visibility, threat prevention and repose into your Defender for Endpoint environment
|
||||||
 |[Vectra Network Detection and Response (NDR)](https://go.microsoft.com/fwlink/?linkid=866934)| Vectra applies AI & security research to detect and respond to cyber-attacks in real time
|
 |[Vectra Network Detection and Response (NDR)](https://go.microsoft.com/fwlink/?linkid=866934)| Vectra applies AI & security research to detect and respond to cyber-attacks in real time
|
||||||
|
|
||||||
|
|
||||||
@ -100,13 +100,13 @@ Logo |Partner name | Description
|
|||||||
| [Corrata](https://go.microsoft.com/fwlink/?linkid=2081148) | Mobile solution — Protect your mobile devices with granular visibility and control from Corrata
|
| [Corrata](https://go.microsoft.com/fwlink/?linkid=2081148) | Mobile solution — Protect your mobile devices with granular visibility and control from Corrata
|
||||||
| [Lookout](https://go.microsoft.com/fwlink/?linkid=866935)| Get Lookout Mobile Threat Protection telemetry for Android and iOS mobile devices
|
| [Lookout](https://go.microsoft.com/fwlink/?linkid=866935)| Get Lookout Mobile Threat Protection telemetry for Android and iOS mobile devices
|
||||||
 | [Symantec Endpoint Protection Mobile](https://go.microsoft.com/fwlink/?linkid=2090992)| SEP Mobile helps businesses predict, detect, and prevent security threats and vulnerabilities on mobile devices
|
 | [Symantec Endpoint Protection Mobile](https://go.microsoft.com/fwlink/?linkid=2090992)| SEP Mobile helps businesses predict, detect, and prevent security threats and vulnerabilities on mobile devices
|
||||||
| [Zimperium](https://go.microsoft.com/fwlink/?linkid=2118044)|Extend your Microsoft Defender ATP to iOS and Android with Machine Learning-based Mobile Threat Defense
|
| [Zimperium](https://go.microsoft.com/fwlink/?linkid=2118044)|Extend your Defender for Endpoint to iOS and Android with Machine Learning-based Mobile Threat Defense
|
||||||
|
|
||||||
|
|
||||||
## Additional integrations
|
## Additional integrations
|
||||||
Logo |Partner name | Description
|
Logo |Partner name | Description
|
||||||
:---|:---|:---
|
:---|:---|:---
|
||||||
| [Cyren Web Filter](https://go.microsoft.com/fwlink/?linkid=2108221)| Enhance your Microsoft Defender ATP with advanced Web Filtering
|
| [Cyren Web Filter](https://go.microsoft.com/fwlink/?linkid=2108221)| Enhance your Defender for Endpoint with advanced Web Filtering
|
||||||
| [Morphisec](https://go.microsoft.com/fwlink/?linkid=2086215)| Provides Moving Target Defense-powered advanced threat prevention and integrates forensics data directly into WD Security Center dashboards to help prioritize alerts, determine device at-risk score and visualize full attack timeline including internal memory information
|
| [Morphisec](https://go.microsoft.com/fwlink/?linkid=2086215)| Provides Moving Target Defense-powered advanced threat prevention and integrates forensics data directly into WD Security Center dashboards to help prioritize alerts, determine device at-risk score and visualize full attack timeline including internal memory information
|
||||||
| [THOR Cloud](https://go.microsoft.com/fwlink/?linkid=862988)| Provides on-demand live forensics scans using a signature base with focus on persistent threats
|
| [THOR Cloud](https://go.microsoft.com/fwlink/?linkid=862988)| Provides on-demand live forensics scans using a signature base with focus on persistent threats
|
||||||
|
|
||||||
@ -114,27 +114,27 @@ Logo |Partner name | Description
|
|||||||
|
|
||||||
|
|
||||||
## SIEM integration
|
## SIEM integration
|
||||||
Microsoft Defender ATP supports SIEM integration through a variety of methods — specialized SIEM system interface with out of the box connectors, a generic alert API enabling custom implementations, and an action API enabling alert status management. For more information, see [Enable SIEM integration](enable-siem-integration.md).
|
Defender for Endpoint supports SIEM integration through a variety of methods — specialized SIEM system interface with out of the box connectors, a generic alert API enabling custom implementations, and an action API enabling alert status management. For more information, see [Enable SIEM integration](enable-siem-integration.md).
|
||||||
|
|
||||||
## Ticketing and IT service management
|
## Ticketing and IT service management
|
||||||
Ticketing solution integration helps to implement manual and automatic response processes. Microsoft Defender ATP can help to create tickets automatically when an alert is generated and resolve the alerts when tickets are closed using the alerts API.
|
Ticketing solution integration helps to implement manual and automatic response processes. Defender for Endpoint can help to create tickets automatically when an alert is generated and resolve the alerts when tickets are closed using the alerts API.
|
||||||
|
|
||||||
## Security orchestration and automation response (SOAR) integration
|
## Security orchestration and automation response (SOAR) integration
|
||||||
Orchestration solutions can help build playbooks and integrate the rich data model and actions that Microsoft Defender ATP APIs expose to orchestrate responses, such as query for device data, trigger device isolation, block/allow, resolve alert and others.
|
Orchestration solutions can help build playbooks and integrate the rich data model and actions that Defender for Endpoint APIs expose to orchestrate responses, such as query for device data, trigger device isolation, block/allow, resolve alert and others.
|
||||||
|
|
||||||
## External alert correlation and Automated investigation and remediation
|
## External alert correlation and Automated investigation and remediation
|
||||||
Microsoft Defender ATP offers unique automated investigation and remediation capabilities to drive incident response at scale.
|
Defender for Endpoint offers unique automated investigation and remediation capabilities to drive incident response at scale.
|
||||||
|
|
||||||
Integrating the automated investigation and response capability with other solutions such as IDS and firewalls help to address alerts and minimize the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices.
|
Integrating the automated investigation and response capability with other solutions such as IDS and firewalls help to address alerts and minimize the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices.
|
||||||
|
|
||||||
External alerts can be pushed into Microsoft Defender ATP and is presented side by side with additional device-based alerts from Microsoft Defender ATP. This view provides a full context of the alert — with the real process and the full story of attack.
|
External alerts can be pushed into Defender for Endpoint and is presented side by side with additional device-based alerts from Defender for Endpoint. This view provides a full context of the alert — with the real process and the full story of attack.
|
||||||
|
|
||||||
## Indicators matching
|
## Indicators matching
|
||||||
You can use threat-intelligence from providers and aggregators to maintain and use indicators of compromise (IOCs).
|
You can use threat-intelligence from providers and aggregators to maintain and use indicators of compromise (IOCs).
|
||||||
|
|
||||||
Microsoft Defender ATP allows you to integrate with such solutions and act on IoCs by correlating its rich telemetry and creating alerts when there's a match; leveraging prevention and automated response capabilities to block execution and take remediation actions when there's a match.
|
Defender for Endpoint allows you to integrate with such solutions and act on IoCs by correlating its rich telemetry and creating alerts when there's a match; leveraging prevention and automated response capabilities to block execution and take remediation actions when there's a match.
|
||||||
|
|
||||||
Microsoft Defender ATP currently supports IOC matching and remediation for file and network indicators. Blocking is supported for file indicators.
|
Defender for Endpoint currently supports IOC matching and remediation for file and network indicators. Blocking is supported for file indicators.
|
||||||
|
|
||||||
## Support for non-Windows platforms
|
## Support for non-Windows platforms
|
||||||
Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms, including mobile devices. You'll be able to see alerts from various supported operating systems (OS) in the portal and better protect your organization's network.
|
Defender for Endpoint provides a centralized security operations experience for Windows as well as non-Windows platforms, including mobile devices. You'll be able to see alerts from various supported operating systems (OS) in the portal and better protect your organization's network.
|
||||||
|
|||||||
@ -18,42 +18,42 @@ ms.collection: M365-security-compliance
|
|||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
---
|
---
|
||||||
|
|
||||||
# Microsoft Defender ATP partner opportunities and scenarios
|
# Microsoft Defender for Endpoint partner opportunities and scenarios
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||||
|
|
||||||
|
|
||||||
Partners can easily extend their existing security offerings on top of the open framework and a rich and complete set of APIs to build extensions and integrations with Microsoft Defender ATP.
|
Partners can easily extend their existing security offerings on top of the open framework and a rich and complete set of APIs to build extensions and integrations with Defender for Endpoint.
|
||||||
|
|
||||||
The APIs span functional areas including detection, management, response, vulnerabilities, and intelligence-wide range of use cases. Based on the use case and need, partners can either stream or query data from Microsoft Defender ATP.
|
The APIs span functional areas including detection, management, response, vulnerabilities, and intelligence-wide range of use cases. Based on the use case and need, partners can either stream or query data from Defender for Endpoint.
|
||||||
|
|
||||||
|
|
||||||
## Scenario 1: External alert correlation and Automated investigation and remediation
|
## Scenario 1: External alert correlation and Automated investigation and remediation
|
||||||
Microsoft Defender ATP offers unique automated investigation and remediation capabilities to drive incident response at scale.
|
Defender for Endpoint offers unique automated investigation and remediation capabilities to drive incident response at scale.
|
||||||
|
|
||||||
Integrating the automated investigation and response capability with other solutions such as network security products or other endpoint security products will help to address alerts. The integration also minimizes the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices.
|
Integrating the automated investigation and response capability with other solutions such as network security products or other endpoint security products will help to address alerts. The integration also minimizes the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices.
|
||||||
|
|
||||||
Microsoft Defender ATP adds support for this scenario in the following forms:
|
Defender for Endpoint adds support for this scenario in the following forms:
|
||||||
|
|
||||||
- External alerts can be pushed into Microsoft Defender ATP and presented side by side with additional device-based alerts from Microsoft Defender ATP. This view provides the full context of the alert - with the real process and the full story of attack.
|
- External alerts can be pushed into Defender for Endpoint and presented side by side with additional device-based alerts from Defender for Endpoint. This view provides the full context of the alert - with the real process and the full story of attack.
|
||||||
|
|
||||||
- Once an alert is generated, the signal is shared across all Microsoft Defender ATP protected endpoints in the enterprise. Microsoft Defender ATP takes immediate automated or operator-assisted response to address the alert.
|
- Once an alert is generated, the signal is shared across all Defender for Endpoint protected endpoints in the enterprise. Defender for Endpoint takes immediate automated or operator-assisted response to address the alert.
|
||||||
|
|
||||||
## Scenario 2: Security orchestration and automation response (SOAR) integration
|
## Scenario 2: Security orchestration and automation response (SOAR) integration
|
||||||
Orchestration solutions can help build playbooks and integrate the rich data model and actions that Microsoft Defender ATP APIs expose to orchestrate responses, such as query for device data, trigger device isolation, block/allow, resolve alert and others.
|
Orchestration solutions can help build playbooks and integrate the rich data model and actions that Defender for Endpoint APIs expose to orchestrate responses, such as query for device data, trigger device isolation, block/allow, resolve alert and others.
|
||||||
|
|
||||||
## Scenario 3: Indicators matching
|
## Scenario 3: Indicators matching
|
||||||
Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives the ability to set a list of indicators for prevention, detection, and exclusion of entities. One can define the action to be taken as well as the duration for when to apply the action.
|
Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Defender for Endpoint and gives the ability to set a list of indicators for prevention, detection, and exclusion of entities. One can define the action to be taken as well as the duration for when to apply the action.
|
||||||
|
|
||||||
The above scenarios serve as examples of the extensibility of the platform. You are not limited to the examples and we certainly encourage you to leverage the open framework to discover and explore other scenarios.
|
The above scenarios serve as examples of the extensibility of the platform. You are not limited to the examples and we certainly encourage you to leverage the open framework to discover and explore other scenarios.
|
||||||
|
|
||||||
Follow the steps in [Become a Microsoft Defender ATP partner](get-started-partner-integration.md) to integrate your solution in Microsoft Defender ATP.
|
Follow the steps in [Become a Microsoft Defender for Endpoint partner](get-started-partner-integration.md) to integrate your solution in Defender for Endpoint.
|
||||||
|
|
||||||
## Related topic
|
## Related topic
|
||||||
- [Overview of management and APIs](management-apis.md)
|
- [Overview of management and APIs](management-apis.md)
|
||||||
|
|||||||
@ -23,9 +23,9 @@ ms.topic: conceptual
|
|||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
|
||||||
|
|
||||||
Enterprise security teams can use Microsoft Defender Security Center to monitor and assist in responding to alerts of potential advanced persistent threat activity or data breaches.
|
Enterprise security teams can use Microsoft Defender Security Center to monitor and assist in responding to alerts of potential advanced persistent threat activity or data breaches.
|
||||||
|
|
||||||
@ -33,7 +33,7 @@ You can use [Microsoft Defender Security Center](https://securitycenter.windows.
|
|||||||
|
|
||||||
- View, sort, and triage alerts from your endpoints
|
- View, sort, and triage alerts from your endpoints
|
||||||
- Search for more information on observed indicators such as files and IP Addresses
|
- Search for more information on observed indicators such as files and IP Addresses
|
||||||
- Change Microsoft Defender ATP settings, including time zone and review licensing information
|
- Change Microsoft Defender for Endpoint settings, including time zone and review licensing information
|
||||||
|
|
||||||
## Microsoft Defender Security Center
|
## Microsoft Defender Security Center
|
||||||
|
|
||||||
@ -42,7 +42,7 @@ When you open the portal, you'll see:
|
|||||||
- (1) Navigation pane (select the horizontal lines at the top of the navigation pane to show or hide it)
|
- (1) Navigation pane (select the horizontal lines at the top of the navigation pane to show or hide it)
|
||||||
- (2) Search, Community center, Localization, Help and support, Feedback
|
- (2) Search, Community center, Localization, Help and support, Feedback
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> Malware related detections will only appear if your devices are using Microsoft Defender Antivirus as the default real-time protection antimalware product.
|
> Malware related detections will only appear if your devices are using Microsoft Defender Antivirus as the default real-time protection antimalware product.
|
||||||
@ -54,29 +54,29 @@ Area | Description
|
|||||||
**(1) Navigation pane** | Use the navigation pane to move between **Dashboards**, **Incidents**, **Devices list**, **Alerts queue**, **Automated investigations**, **Advanced hunting**, **Reports**, **Partners & APIs**, **Threat & Vulnerability Management**, **Evaluation and tutorials**, **Service health**, **Configuration management**, and **Settings**. Select the horizontal lines at the top of the navigation pane to show or hide it.
|
**(1) Navigation pane** | Use the navigation pane to move between **Dashboards**, **Incidents**, **Devices list**, **Alerts queue**, **Automated investigations**, **Advanced hunting**, **Reports**, **Partners & APIs**, **Threat & Vulnerability Management**, **Evaluation and tutorials**, **Service health**, **Configuration management**, and **Settings**. Select the horizontal lines at the top of the navigation pane to show or hide it.
|
||||||
**Dashboards** | Access the active automated investigations, active alerts, automated investigations statistics, devices at risk, users at risk, devices with sensor issues, service health, detection sources, and daily devices reporting dashboards.
|
**Dashboards** | Access the active automated investigations, active alerts, automated investigations statistics, devices at risk, users at risk, devices with sensor issues, service health, detection sources, and daily devices reporting dashboards.
|
||||||
**Incidents** | View alerts that have been aggregated as incidents.
|
**Incidents** | View alerts that have been aggregated as incidents.
|
||||||
**Devices list** | Displays the list of devices that are onboarded to Microsoft Defender ATP, some information about them, and their exposure and risk levels.
|
**Devices list** | Displays the list of devices that are onboarded to Defender for Endpoint, some information about them, and their exposure and risk levels.
|
||||||
**Alerts queue** | View alerts generated from devices in your organizations.
|
**Alerts queue** | View alerts generated from devices in your organizations.
|
||||||
**Automated investigations** | Displays automated investigations that have been conducted in the network, triggering alert, the status of each investigation and other details such as when the investigation started and the duration of the investigation.
|
**Automated investigations** | Displays automated investigations that have been conducted in the network, triggering alert, the status of each investigation and other details such as when the investigation started and the duration of the investigation.
|
||||||
**Advanced hunting** | Advanced hunting allows you to proactively hunt and investigate across your organization using a powerful search and query tool.
|
**Advanced hunting** | Advanced hunting allows you to proactively hunt and investigate across your organization using a powerful search and query tool.
|
||||||
**Reports** | View graphs detailing threat protection, device health and compliance, web protection, and vulnerability.
|
**Reports** | View graphs detailing threat protection, device health and compliance, web protection, and vulnerability.
|
||||||
**Partners & APIs** | View supported partner connections, which enhance the detection, investigation, and threat intelligence capabilities of the platform. You can also view connected applications, the API explorer, API usage overview, and data export settings.
|
**Partners & APIs** | View supported partner connections, which enhance the detection, investigation, and threat intelligence capabilities of the platform. You can also view connected applications, the API explorer, API usage overview, and data export settings.
|
||||||
**Threat & Vulnerability management** | View your Microsoft Secure Score for Devices, exposure score, exposed devices, vulnerable software, and take action on top security recommendations.
|
**Threat & Vulnerability management** | View your Microsoft Secure Score for Devices, exposure score, exposed devices, vulnerable software, and take action on top security recommendations.
|
||||||
**Evaluation and tutorials** | Manage test devices, attack simulations, and reports. Learn and experience the Microsoft Defender ATP capabilities through a guided walk-through in a trial environment.
|
**Evaluation and tutorials** | Manage test devices, attack simulations, and reports. Learn and experience the Defender for Endpoint capabilities through a guided walk-through in a trial environment.
|
||||||
**Service health** | Provides information on the current status of the Microsoft Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues.
|
**Service health** | Provides information on the current status of the Defender for Endpoint service. You'll be able to verify that the service health is healthy or if there are current issues.
|
||||||
**Configuration management** | Displays on-boarded devices, your organizations' security baseline, predictive analysis, web protection coverage, and allows you to perform attack surface management on your devices.
|
**Configuration management** | Displays on-boarded devices, your organizations' security baseline, predictive analysis, web protection coverage, and allows you to perform attack surface management on your devices.
|
||||||
**Settings** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as permissions, APIs, rules, device management, IT service management, and network assessments.
|
**Settings** | Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as permissions, APIs, rules, device management, IT service management, and network assessments.
|
||||||
**(2) Search, Community center, Localization, Help and support, Feedback** | **Search** - search by device, file, user, URL, IP, vulnerability, software, and recommendation. </br></br> **Community center** - Access the Community center to learn, collaborate, and share experiences about the product. </br></br> **Localization** - Set time zones. </br></br> **Help and support** - Access the Microsoft Defender ATP guide, Microsoft and Microsoft Premier support, license information, simulations & tutorials, Microsoft Defender ATP evaluation lab, consult a threat expert.</br></br> **Feedback** - Provide comments about what you like or what we can do better.
|
**(2) Search, Community center, Localization, Help and support, Feedback** | **Search** - search by device, file, user, URL, IP, vulnerability, software, and recommendation. </br></br> **Community center** - Access the Community center to learn, collaborate, and share experiences about the product. </br></br> **Localization** - Set time zones. </br></br> **Help and support** - Access the Defender for Endpoint guide, Microsoft and Microsoft Premier support, license information, simulations & tutorials, Defender for Endpoint evaluation lab, consult a threat expert.</br></br> **Feedback** - Provide comments about what you like or what we can do better.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> For devices with high resolution DPI scaling issues, please see [Windows scaling issues for high-DPI devices](https://support.microsoft.com/help/3025083/windows-scaling-issues-for-high-dpi-devices) for possible solutions.
|
> For devices with high resolution DPI scaling issues, please see [Windows scaling issues for high-DPI devices](https://support.microsoft.com/help/3025083/windows-scaling-issues-for-high-dpi-devices) for possible solutions.
|
||||||
|
|
||||||
## Microsoft Defender ATP icons
|
## Microsoft Defender for Endpoint icons
|
||||||
|
|
||||||
The following table provides information on the icons used all throughout the portal:
|
The following table provides information on the icons used all throughout the portal:
|
||||||
|
|
||||||
Icon | Description
|
Icon | Description
|
||||||
:---|:---
|
:---|:---
|
||||||
| Microsoft Defender ATP logo
|
| Microsoft Defender for Endpoint logo
|
||||||
| Alert – Indication of an activity correlated with advanced attacks.
|
| Alert – Indication of an activity correlated with advanced attacks.
|
||||||
| Detection – Indication of a malware threat detection.
|
| Detection – Indication of a malware threat detection.
|
||||||
| Active threat – Threats actively executing at the time of detection.
|
| Active threat – Threats actively executing at the time of detection.
|
||||||
|
|||||||
@ -21,9 +21,9 @@ ms.topic: article
|
|||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
**Applies to:** [Microsoft Defender for Endpoint]https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||||
|
|
||||||
|
|
||||||
## API description
|
## API description
|
||||||
|
|||||||
@ -23,9 +23,9 @@ ms.topic: article
|
|||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-prefsettings-abovefoldlink)
|
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-prefsettings-abovefoldlink)
|
||||||
|
|
||||||
Use the **Settings** menu to modify general settings, advanced features, enable the preview experience, email notifications, and the custom threat intelligence feature.
|
Use the **Settings** menu to modify general settings, advanced features, enable the preview experience, email notifications, and the custom threat intelligence feature.
|
||||||
|
|
||||||
|
|||||||
@ -20,30 +20,30 @@ ms.collection:
|
|||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# Prepare Microsoft Defender ATP deployment
|
# Prepare Microsoft Defender for Endpoint deployment
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
Deploying Microsoft Defender ATP is a three-phase process:
|
Deploying Defender for Endpoint is a three-phase process:
|
||||||
|
|
||||||
<br>
|
<br>
|
||||||
<table border="0" width="100%" align="center">
|
<table border="0" width="100%" align="center">
|
||||||
<tr style="text-align:center;">
|
<tr style="text-align:center;">
|
||||||
<td align="center" style="width:25%; border:0;" bgcolor="#d5f5e3">
|
<td align="center" style="width:25%; border:0;" bgcolor="#d5f5e3">
|
||||||
<a href= "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment">
|
<a href= "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment">
|
||||||
<img src="images/prepare.png" alt="Plan to deploy Microsoft Defender ATP" title="Plan" />
|
<img src="images/prepare.png" alt="Plan to deploy Microsoft Defender for Endpoint" title="Plan" />
|
||||||
<br/>Phase 1: Prepare </a><br>
|
<br/>Phase 1: Prepare </a><br>
|
||||||
</td>
|
</td>
|
||||||
<td align="center" >
|
<td align="center" >
|
||||||
<a href="https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment">
|
<a href="https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment">
|
||||||
<img src="images/setup.png" alt="Onboard to the Microsoft Defender ATP service" title="Setup the Microsoft Defender ATP service" />
|
<img src="images/setup.png" alt="Onboard to the Defender for Endpoint service" title="Setup the Defender for Endpoint service" />
|
||||||
<br/>Phase 2: Set up </a><br>
|
<br/>Phase 2: Set up </a><br>
|
||||||
</td>
|
</td>
|
||||||
<td align="center">
|
<td align="center">
|
||||||
@ -68,7 +68,7 @@ Deploying Microsoft Defender ATP is a three-phase process:
|
|||||||
You are currently in the preparation phase.
|
You are currently in the preparation phase.
|
||||||
|
|
||||||
|
|
||||||
Preparation is key to any successful deployment. In this article, you'll be guided on the points you'll need to consider as you prepare to deploy Microsoft Defender ATP.
|
Preparation is key to any successful deployment. In this article, you'll be guided on the points you'll need to consider as you prepare to deploy Defender for Endpoint.
|
||||||
|
|
||||||
|
|
||||||
## Stakeholders and approval
|
## Stakeholders and approval
|
||||||
@ -111,8 +111,7 @@ required in technologies or processes.
|
|||||||
|
|
||||||
## Role-based access control
|
## Role-based access control
|
||||||
|
|
||||||
Microsoft recommends using the concept of least privileges. Microsoft Defender
|
Microsoft recommends using the concept of least privileges. Defender for Endpoint leverages built-in roles within Azure Active Directory. Microsoft recommends
|
||||||
ATP leverages built-in roles within Azure Active Directory. Microsoft recommends
|
|
||||||
[review the different roles that are
|
[review the different roles that are
|
||||||
available](https://docs.microsoft.com/azure/active-directory/active-directory-assign-admin-roles-azure-portal)
|
available](https://docs.microsoft.com/azure/active-directory/active-directory-assign-admin-roles-azure-portal)
|
||||||
and choose the right one to solve your needs for each persona for this
|
and choose the right one to solve your needs for each persona for this
|
||||||
@ -132,7 +131,7 @@ Management](https://docs.microsoft.com/azure/active-directory/active-directory-p
|
|||||||
to manage your roles to provide additional auditing, control, and access review
|
to manage your roles to provide additional auditing, control, and access review
|
||||||
for users with directory permissions.
|
for users with directory permissions.
|
||||||
|
|
||||||
Microsoft Defender ATP supports two ways to manage permissions:
|
Defender for Endpoint supports two ways to manage permissions:
|
||||||
|
|
||||||
- **Basic permissions management**: Set permissions to either full access or
|
- **Basic permissions management**: Set permissions to either full access or
|
||||||
read-only. In the case of basic permissions management users with Global
|
read-only. In the case of basic permissions management users with Global
|
||||||
@ -144,7 +143,7 @@ Microsoft Defender ATP supports two ways to manage permissions:
|
|||||||
groups access to device groups. For more information. see [Manage portal access using role-based access control](rbac.md).
|
groups access to device groups. For more information. see [Manage portal access using role-based access control](rbac.md).
|
||||||
|
|
||||||
Microsoft recommends leveraging RBAC to ensure that only users that have a
|
Microsoft recommends leveraging RBAC to ensure that only users that have a
|
||||||
business justification can access Microsoft Defender ATP.
|
business justification can access Defender for Endpoint.
|
||||||
|
|
||||||
You can find details on permission guidelines
|
You can find details on permission guidelines
|
||||||
[here](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group).
|
[here](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/user-roles#create-roles-and-assign-the-role-to-an-azure-active-directory-group).
|
||||||
@ -167,16 +166,16 @@ place. The bare minimum every organization should have been an antivirus solutio
|
|||||||
|
|
||||||
Historically, replacing any security solution used to be time intensive and difficult
|
Historically, replacing any security solution used to be time intensive and difficult
|
||||||
to achieve due to the tight hooks into the application layer and infrastructure
|
to achieve due to the tight hooks into the application layer and infrastructure
|
||||||
dependencies. However, because Microsoft Defender ATP is built into the
|
dependencies. However, because Defender for Endpoint is built into the
|
||||||
operating system, replacing third-party solutions is now easy to achieve.
|
operating system, replacing third-party solutions is now easy to achieve.
|
||||||
|
|
||||||
Choose the component of Microsoft Defender ATP to be used and remove the ones
|
Choose the component of Defender for Endpoint to be used and remove the ones
|
||||||
that do not apply. The table below indicates the order Microsoft recommends for
|
that do not apply. The table below indicates the order Microsoft recommends for
|
||||||
how the endpoint security suite should be enabled.
|
how the endpoint security suite should be enabled.
|
||||||
|
|
||||||
| Component | Description | Adoption Order Rank |
|
| Component | Description | Adoption Order Rank |
|
||||||
|-----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------|
|
|-----------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------|
|
||||||
| Endpoint Detection & Response (EDR) | Microsoft Defender ATP endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response) | 1 |
|
| Endpoint Detection & Response (EDR) | Defender for Endpoint endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response) | 1 |
|
||||||
|Threat & Vulnerability Management (TVM)|Threat & Vulnerability Management is a component of Microsoft Defender ATP, and provides both security administrators and security operations teams with unique value, including: <br> - Real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities <br> - Invaluable device vulnerability context during incident investigations <br> - Built-in remediation processes through Microsoft Intune and Microsoft System Center Configuration Manager <br> [Learn more](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Introducing-a-risk-based-approach-to-threat-and-vulnerability/ba-p/377845).| 2 |
|
|Threat & Vulnerability Management (TVM)|Threat & Vulnerability Management is a component of Microsoft Defender ATP, and provides both security administrators and security operations teams with unique value, including: <br> - Real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities <br> - Invaluable device vulnerability context during incident investigations <br> - Built-in remediation processes through Microsoft Intune and Microsoft System Center Configuration Manager <br> [Learn more](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Introducing-a-risk-based-approach-to-threat-and-vulnerability/ba-p/377845).| 2 |
|
||||||
| Next-generation protection (NGP) | Microsoft Defender Antivirus is a built-in antimalware solution that provides next-generation protection for desktops, portable computers, and servers. Microsoft Defender Antivirus includes: <br> -Cloud-delivered protection for near-instant detection and blocking of new and emerging threats. Along with machine learning and the Intelligent Security Graph, cloud-delivered protection is part of the next-gen technologies that power Microsoft Defender Antivirus. <br> - Always-on scanning using advanced file and process behavior monitoring and other heuristics (also known as "real-time protection"). <br> - Dedicated protection updates based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research. <br> [Learn more](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10). |3 |
|
| Next-generation protection (NGP) | Microsoft Defender Antivirus is a built-in antimalware solution that provides next-generation protection for desktops, portable computers, and servers. Microsoft Defender Antivirus includes: <br> -Cloud-delivered protection for near-instant detection and blocking of new and emerging threats. Along with machine learning and the Intelligent Security Graph, cloud-delivered protection is part of the next-gen technologies that power Microsoft Defender Antivirus. <br> - Always-on scanning using advanced file and process behavior monitoring and other heuristics (also known as "real-time protection"). <br> - Dedicated protection updates based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research. <br> [Learn more](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10). |3 |
|
||||||
| Attack Surface Reduction (ASR) | Attack surface reduction capabilities in Microsoft Defender ATP help protect the devices and applications in the organization from new and emerging threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) | 4 |
|
| Attack Surface Reduction (ASR) | Attack surface reduction capabilities in Microsoft Defender ATP help protect the devices and applications in the organization from new and emerging threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) | 4 |
|
||||||
|
|||||||
@ -16,15 +16,15 @@ audience: ITPro
|
|||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
# Turn on the preview experience in Microsoft Defender ATP
|
# Turn on the preview experience in Microsoft Defender for Endpoint
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-previewsettings-abovefoldlink)
|
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-previewsettings-abovefoldlink)
|
||||||
|
|
||||||
Turn on the preview experience setting to be among the first to try upcoming features.
|
Turn on the preview experience setting to be among the first to try upcoming features.
|
||||||
|
|
||||||
@ -36,8 +36,8 @@ Turn on the preview experience setting to be among the first to try upcoming fea
|
|||||||
2. Toggle the setting between **On** and **Off** and select **Save preferences**.
|
2. Toggle the setting between **On** and **Off** and select **Save preferences**.
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
- [Update general settings in Microsoft Defender ATP](data-retention-settings.md)
|
- [Update general settings in Microsoft Defender for Endpoint](data-retention-settings.md)
|
||||||
- [Turn on advanced features in Microsoft Defender ATP](advanced-features.md)
|
- [Turn on advanced features in Microsoft Defender for Endpoint](advanced-features.md)
|
||||||
- [Configure email notifications in Microsoft Defender ATP](configure-email-notifications.md)
|
- [Configure email notifications in Microsoft Defender for Endpoint](configure-email-notifications.md)
|
||||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
- [Enable SIEM integration in Microsoft Defender for Endpoint](enable-siem-integration.md)
|
||||||
|
|
||||||
|
|||||||
@ -19,7 +19,7 @@ ms.collection:
|
|||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
---
|
---
|
||||||
|
|
||||||
# Microsoft Defender ATP preview features
|
# Microsoft Defender for Endpoint preview features
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
@ -27,19 +27,19 @@ ms.topic: conceptual
|
|||||||
>The preview versions are provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities.
|
>The preview versions are provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities.
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
The Microsoft Defender ATP service is constantly being updated to include new feature enhancements and capabilities.
|
The Defender for Endpoint service is constantly being updated to include new feature enhancements and capabilities.
|
||||||
|
|
||||||
> [!TIP]
|
> [!TIP]
|
||||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-preview-abovefoldlink)
|
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-preview-abovefoldlink)
|
||||||
|
|
||||||
Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience.
|
Learn about new features in the Defender for Endpoint preview release and be among the first to try upcoming features by turning on the preview experience.
|
||||||
|
|
||||||
>[!TIP]
|
>[!TIP]
|
||||||
>Get notified when this page is updated by copying and pasting the following URL into your feed reader: `https://docs.microsoft.com/api/search/rss?search=%22Microsoft+Defender+ATP+preview+features%22&locale=en-us`
|
>Get notified when this page is updated by copying and pasting the following URL into your feed reader: `https://docs.microsoft.com/api/search/rss?search=%22Microsoft+Defender+ATP+preview+features%22&locale=en-us`
|
||||||
|
|
||||||
For more information on new capabilities that are generally available, see [What's new in Microsoft Defender ATP](whats-new-in-microsoft-defender-atp.md).
|
For more information on new capabilities that are generally available, see [What's new in Defender for Endpoint](whats-new-in-microsoft-defender-atp.md).
|
||||||
|
|
||||||
## Turn on preview features
|
## Turn on preview features
|
||||||
|
|
||||||
@ -54,22 +54,22 @@ Turn on the preview experience setting to be among the first to try upcoming fea
|
|||||||
## Preview features
|
## Preview features
|
||||||
|
|
||||||
The following features are included in the preview release:
|
The following features are included in the preview release:
|
||||||
- [Microsoft Defender ATP for iOS](microsoft-defender-atp-ios.md) <br> Microsoft Defender ATP now adds support for iOS. Learn how to install, configure, and use Microsoft Defender ATP for iOS.
|
- [Microsoft Defender for Endpoint for iOS](microsoft-defender-atp-ios.md) <br> Microsoft Defender ATP now adds support for iOS. Learn how to install, configure, and use Microsoft Defender ATP for iOS.
|
||||||
|
|
||||||
- [Microsoft Defender ATP for Android](microsoft-defender-atp-android.md) <br> Microsoft Defender ATP now adds support for Android. Learn how to install, configure, and use Microsoft Defender ATP for Android.
|
- [Microsoft Defender for Endpoint for Android](microsoft-defender-atp-android.md) <br> Microsoft Defender for Endpoint now adds support for Android. Learn how to install, configure, and use Microsoft Defender for Endpoint for Android.
|
||||||
|
|
||||||
- [Web Content Filtering](web-content-filtering.md) <br> Web content filtering is part of web protection capabilities in Microsoft Defender ATP. It enables your organization to track and regulate access to websites based on their content categories. Many of these websites, while not malicious, might be problematic because of compliance regulations, bandwidth usage, or other concerns.
|
- [Web Content Filtering](web-content-filtering.md) <br> Web content filtering is part of web protection capabilities in Microsoft Defender for Endpoint. It enables your organization to track and regulate access to websites based on their content categories. Many of these websites, while not malicious, might be problematic because of compliance regulations, bandwidth usage, or other concerns.
|
||||||
|
|
||||||
- [Device health and compliance report](machine-reports.md) <br/> The device health and compliance report provides high-level information about the devices in your organization.
|
- [Device health and compliance report](machine-reports.md) <br/> The device health and compliance report provides high-level information about the devices in your organization.
|
||||||
|
|
||||||
- [Information protection](information-protection-in-windows-overview.md)<BR>
|
- [Information protection](information-protection-in-windows-overview.md)<BR>
|
||||||
Information protection is an integral part of Microsoft 365 Enterprise suite, providing intelligent protection to keep sensitive data secure while enabling productivity in the workplace. Microsoft Defender ATP is seamlessly integrated in Microsoft Threat Protection to provide a complete and comprehensive data loss prevention (DLP) solution for Windows devices.
|
Information protection is an integral part of Microsoft 365 Enterprise suite, providing intelligent protection to keep sensitive data secure while enabling productivity in the workplace. Microsoft Defender for Endpoint is seamlessly integrated in Microsoft Threat Protection to provide a complete and comprehensive data loss prevention (DLP) solution for Windows devices.
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>Partially available from Windows 10, version 1809.
|
>Partially available from Windows 10, version 1809.
|
||||||
|
|
||||||
- [Onboard Windows Server 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints#windows-server-version-1803-and-windows-server-2019) <BR> Microsoft Defender ATP now adds support for Windows Server 2019. You'll be able to onboard Windows Server 2019 in the same method available for Windows 10 client devices.
|
- [Onboard Windows Server 2019](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-server-endpoints#windows-server-version-1803-and-windows-server-2019) <BR> Microsoft Defender for Endpoint now adds support for Windows Server 2019. You'll be able to onboard Windows Server 2019 in the same method available for Windows 10 client devices.
|
||||||
|
|
||||||
|
|
||||||
> [!TIP]
|
> [!TIP]
|
||||||
> Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-preview-belowfoldlink)
|
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-preview-belowfoldlink)
|
||||||
|
|||||||
@ -20,28 +20,28 @@ ms.collection:
|
|||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# Set up Microsoft Defender ATP deployment
|
# Set up Microsoft Defender for Endpoint deployment
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
|
|
||||||
Deploying Microsoft Defender ATP is a three-phase process:
|
Deploying Defender for Endpoint is a three-phase process:
|
||||||
|
|
||||||
<br>
|
<br>
|
||||||
<table border="0" width="100%" align="center">
|
<table border="0" width="100%" align="center">
|
||||||
<tr style="text-align:center;">
|
<tr style="text-align:center;">
|
||||||
<td align="center" style="width:25%; border:0;" >
|
<td align="center" style="width:25%; border:0;" >
|
||||||
<a href= "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment">
|
<a href= "https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/prepare-deployment">
|
||||||
<img src="images/prepare.png" alt="Prepare to deploy Microsoft Defender ATP" title="Prepare" />
|
<img src="images/prepare.png" alt="Prepare to deploy Microsoft Defender for Endpoint" title="Prepare" />
|
||||||
<br/>Phase 1: Prepare </a><br>
|
<br/>Phase 1: Prepare </a><br>
|
||||||
</td>
|
</td>
|
||||||
<td align="center"bgcolor="#d5f5e3">
|
<td align="center"bgcolor="#d5f5e3">
|
||||||
<a href="https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment">
|
<a href="https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/production-deployment">
|
||||||
<img src="images/setup.png" alt="Onboard to the Microsoft Defender ATP service" title="Setup" />
|
<img src="images/setup.png" alt="Onboard to the Microsoft Defender for Endpoint service" title="Setup" />
|
||||||
<br/>Phase 2: Set up </a><br>
|
<br/>Phase 2: Set up </a><br>
|
||||||
</td>
|
</td>
|
||||||
<td align="center">
|
<td align="center">
|
||||||
@ -63,7 +63,7 @@ In this deployment scenario, you'll be guided through the steps on:
|
|||||||
|
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>For the purpose of guiding you through a typical deployment, this scenario will only cover the use of Microsoft Endpoint Configuration Manager. Microsoft Defender ATP supports the use of other onboarding tools but will not cover those scenarios in the deployment guide. For more information, see [Onboard devices to Microsoft Defender ATP](onboard-configure.md).
|
>For the purpose of guiding you through a typical deployment, this scenario will only cover the use of Microsoft Endpoint Configuration Manager. Defender for Endpoint supports the use of other onboarding tools but will not cover those scenarios in the deployment guide. For more information, see [Onboard devices to Microsoft Defender for Endpoint](onboard-configure.md).
|
||||||
|
|
||||||
## Check license state
|
## Check license state
|
||||||
|
|
||||||
@ -94,11 +94,11 @@ To gain access into which licenses are provisioned to your company, and to check
|
|||||||
|
|
||||||
## Tenant Configuration
|
## Tenant Configuration
|
||||||
|
|
||||||
When accessing Microsoft Defender Security Center for the first time, a wizard that will guide you through some initial steps. At the end of the setup wizard, there will be a dedicated cloud instance of Microsoft Defender ATP created. The easiest method is to perform these steps from a Windows 10 client device.
|
When accessing Microsoft Defender Security Center for the first time, a wizard that will guide you through some initial steps. At the end of the setup wizard, there will be a dedicated cloud instance of Defender for Endpoint created. The easiest method is to perform these steps from a Windows 10 client device.
|
||||||
|
|
||||||
1. From a web browser, navigate to <https://securitycenter.windows.com>.
|
1. From a web browser, navigate to <https://securitycenter.windows.com>.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
2. If going through a TRIAL license, go to the link (<https://signup.microsoft.com/Signup?OfferId=6033e4b5-c320-4008-a936-909c2825d83c&dl=WIN_DEF_ATP&pc=xxxxxxx-xxxxxx-xxx-x>)
|
2. If going through a TRIAL license, go to the link (<https://signup.microsoft.com/Signup?OfferId=6033e4b5-c320-4008-a936-909c2825d83c&dl=WIN_DEF_ATP&pc=xxxxxxx-xxxxxx-xxx-x>)
|
||||||
|
|
||||||
@ -128,11 +128,11 @@ When accessing Microsoft Defender Security Center for the first time, a wizard t
|
|||||||
If the organization does not require the endpoints to use a Proxy to access the
|
If the organization does not require the endpoints to use a Proxy to access the
|
||||||
Internet, skip this section.
|
Internet, skip this section.
|
||||||
|
|
||||||
The Microsoft Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to
|
The Microsoft Defender for Endpoint sensor requires Microsoft Windows HTTP (WinHTTP) to
|
||||||
report sensor data and communicate with the Microsoft Defender ATP service. The
|
report sensor data and communicate with the Microsoft Defender for Endpoint service. The
|
||||||
embedded Microsoft Defender ATP sensor runs in the system context using the
|
embedded Microsoft Defender for Endpoint sensor runs in the system context using the
|
||||||
LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP)
|
LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP)
|
||||||
to enable communication with the Microsoft Defender ATP cloud service. The
|
to enable communication with the Microsoft Defender for Endpoint cloud service. The
|
||||||
WinHTTP configuration setting is independent of the Windows Internet (WinINet)
|
WinHTTP configuration setting is independent of the Windows Internet (WinINet)
|
||||||
internet browsing proxy settings and can only discover a proxy server by using
|
internet browsing proxy settings and can only discover a proxy server by using
|
||||||
the following discovery methods:
|
the following discovery methods:
|
||||||
@ -145,7 +145,7 @@ the following discovery methods:
|
|||||||
|
|
||||||
If a Transparent proxy or WPAD has been implemented in the network topology,
|
If a Transparent proxy or WPAD has been implemented in the network topology,
|
||||||
there is no need for special configuration settings. For more information on
|
there is no need for special configuration settings. For more information on
|
||||||
Microsoft Defender ATP URL exclusions in the proxy, see the
|
Microsoft Defender for Endpoint URL exclusions in the proxy, see the
|
||||||
Appendix section in this document for the URLs allow list or on
|
Appendix section in this document for the URLs allow list or on
|
||||||
[Microsoft
|
[Microsoft
|
||||||
Docs](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server).
|
Docs](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/configure-proxy-internet-windows-defender-advanced-threat-protection#enable-access-to-windows-defender-atp-service-urls-in-the-proxy-server).
|
||||||
@ -163,8 +163,8 @@ Docs](https://docs.microsoft.com/windows/security/threat-protection/windows-defe
|
|||||||
|
|
||||||
### Configure the proxy server manually using a registry-based static proxy
|
### Configure the proxy server manually using a registry-based static proxy
|
||||||
|
|
||||||
Configure a registry-based static proxy to allow only Microsoft Defender ATP
|
Configure a registry-based static proxy to allow only Microsoft Defender for Endpoint
|
||||||
sensor to report diagnostic data and communicate with Microsoft Defender ATP
|
sensor to report diagnostic data and communicate with Microsoft Defender for Endpoint
|
||||||
services if a computer is not permitted to connect to the Internet. The static
|
services if a computer is not permitted to connect to the Internet. The static
|
||||||
proxy is configurable through Group Policy (GP). The group policy can be found
|
proxy is configurable through Group Policy (GP). The group policy can be found
|
||||||
under:
|
under:
|
||||||
@ -236,20 +236,20 @@ URLs that include v20 in them are only needed if you have Windows 10, version
|
|||||||
needed if the device is on Windows 10, version 1803 or later.
|
needed if the device is on Windows 10, version 1803 or later.
|
||||||
|
|
||||||
|
|
||||||
If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender ATP sensor is connecting from system context, make sure anonymous traffic is permitted in the listed URLs.
|
If a proxy or firewall is blocking anonymous traffic, as Microsoft Defender for Endpoint sensor is connecting from system context, make sure anonymous traffic is permitted in the listed URLs.
|
||||||
|
|
||||||
The following downloadable spreadsheet lists the services and their associated URLs that your network must be able to connect to. Ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them.
|
The following downloadable spreadsheet lists the services and their associated URLs that your network must be able to connect to. Ensure that there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an *allow* rule specifically for them.
|
||||||
|
|
||||||
|**Spreadsheet of domains list**|**Description**|
|
|**Spreadsheet of domains list**|**Description**|
|
||||||
|:-----|:-----|
|
|:-----|:-----|
|
||||||
|<br/> | Spreadsheet of specific DNS records for service locations, geographic locations, and OS. <br><br>[Download the spreadsheet here.](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)
|
|<br/> | Spreadsheet of specific DNS records for service locations, geographic locations, and OS. <br><br>[Download the spreadsheet here.](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/security/threat-protection/microsoft-defender-atp/downloads/mdatp-urls.xlsx)
|
||||||
|
|
||||||
|
|
||||||
### Microsoft Defender ATP service backend IP range
|
### Microsoft Defender for Endpoint service backend IP range
|
||||||
|
|
||||||
If you network devices don't support the URLs listed in the prior section, you can use the following information.
|
If you network devices don't support the URLs listed in the prior section, you can use the following information.
|
||||||
|
|
||||||
Microsoft Defender ATP is built on Azure cloud, deployed in the following regions:
|
Defender for Endpoint is built on Azure cloud, deployed in the following regions:
|
||||||
|
|
||||||
- \+\<Region Name="uswestcentral">
|
- \+\<Region Name="uswestcentral">
|
||||||
- \+\<Region Name="useast2">
|
- \+\<Region Name="useast2">
|
||||||
@ -267,4 +267,4 @@ You can find the Azure IP range on [Microsoft Azure Datacenter IP Ranges](https:
|
|||||||
## Next step
|
## Next step
|
||||||
|||
|
|||
|
||||||
|:-------|:-----|
|
|:-------|:-----|
|
||||||
| <br>[Phase 3: Onboard](onboarding.md) | Onboard devices to the service so that the Microsoft Defender ATP service can get sensor data from them.
|
| <br>[Phase 3: Onboard](onboarding.md) | Onboard devices to the service so that the Microsoft Defender for Endpoint service can get sensor data from them.
|
||||||
|
|||||||
@ -17,24 +17,24 @@ ms.collection: M365-security-compliance
|
|||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# Pull Microsoft Defender ATP detections using SIEM REST API
|
# Pull Microsoft Defender for Endpoint detections using SIEM REST API
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-pullalerts-abovefoldlink)
|
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-pullalerts-abovefoldlink)
|
||||||
|
|
||||||
>[!Note]
|
>[!Note]
|
||||||
>- [Microsoft Defender ATP Alert](alerts.md) is composed from one or more detections.
|
>- [Microsoft Defender for Endpoint Alert](alerts.md) is composed from one or more detections.
|
||||||
>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Device and its related Alert details.
|
>- [Microsoft Defender for Endpoint Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Device and its related Alert details.
|
||||||
>-The Microsoft Defender ATP Alert API is the latest API for alert consumption and contain a detailed list of related evidence for each alert. For more information, see [Alert methods and properties](alerts.md) and [List alerts](get-alerts.md).
|
>-The Microsoft Defender for Endpoint Alert API is the latest API for alert consumption and contain a detailed list of related evidence for each alert. For more information, see [Alert methods and properties](alerts.md) and [List alerts](get-alerts.md).
|
||||||
|
|
||||||
Microsoft Defender ATP supports the OAuth 2.0 protocol to pull detections from the API.
|
Microsoft Defender for Endpoint supports the OAuth 2.0 protocol to pull detections from the API.
|
||||||
|
|
||||||
In general, the OAuth 2.0 protocol supports four types of flows:
|
In general, the OAuth 2.0 protocol supports four types of flows:
|
||||||
- Authorization grant flow
|
- Authorization grant flow
|
||||||
@ -44,19 +44,19 @@ In general, the OAuth 2.0 protocol supports four types of flows:
|
|||||||
|
|
||||||
For more information about the OAuth specifications, see the [OAuth Website](http://www.oauth.net).
|
For more information about the OAuth specifications, see the [OAuth Website](http://www.oauth.net).
|
||||||
|
|
||||||
Microsoft Defender ATP supports the _Authorization grant flow_ and _Client credential flow_ to obtain access to pull detections, with Azure Active Directory (AAD) as the authorization server.
|
Microsoft Defender for Endpoint supports the _Authorization grant flow_ and _Client credential flow_ to obtain access to pull detections, with Azure Active Directory (AAD) as the authorization server.
|
||||||
|
|
||||||
The _Authorization grant flow_ uses user credentials to get an authorization code, which is then used to obtain an access token.
|
The _Authorization grant flow_ uses user credentials to get an authorization code, which is then used to obtain an access token.
|
||||||
|
|
||||||
The _Client credential flow_ uses client credentials to authenticate against the Microsoft Defender ATP endpoint URL. This flow is suitable for scenarios when an OAuth client creates requests to an API that doesn't require user credentials.
|
The _Client credential flow_ uses client credentials to authenticate against the Microsoft Defender for Endpoint endpoint URL. This flow is suitable for scenarios when an OAuth client creates requests to an API that doesn't require user credentials.
|
||||||
|
|
||||||
Use the following method in the Microsoft Defender ATP API to pull detections in JSON format.
|
Use the following method in the Microsoft Defender for Endpoint API to pull detections in JSON format.
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>Microsoft Defender Security Center merges similar alert detections into a single alert. This API pulls alert detections in its raw form based on the query parameters you set, enabling you to apply your own grouping and filtering.
|
>Microsoft Defender Security Center merges similar alert detections into a single alert. This API pulls alert detections in its raw form based on the query parameters you set, enabling you to apply your own grouping and filtering.
|
||||||
|
|
||||||
## Before you begin
|
## Before you begin
|
||||||
- Before calling the Microsoft Defender ATP endpoint to pull detections, you'll need to enable the SIEM integration application in Azure Active Directory (AAD). For more information, see [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md).
|
- Before calling the Microsoft Defender for Endpoint endpoint to pull detections, you'll need to enable the SIEM integration application in Azure Active Directory (AAD). For more information, see [Enable SIEM integration in Microsoft Defender for Endpoint](enable-siem-integration.md).
|
||||||
|
|
||||||
- Take note of the following values in your Azure application registration. You need these values to configure the OAuth flow in your service or daemon app:
|
- Take note of the following values in your Azure application registration. You need these values to configure the OAuth flow in your service or daemon app:
|
||||||
- Application ID (unique to your application)
|
- Application ID (unique to your application)
|
||||||
@ -67,7 +67,7 @@ Use the following method in the Microsoft Defender ATP API to pull detections in
|
|||||||
## Get an access token
|
## Get an access token
|
||||||
Before creating calls to the endpoint, you'll need to get an access token.
|
Before creating calls to the endpoint, you'll need to get an access token.
|
||||||
|
|
||||||
You'll use the access token to access the protected resource, which are detections in Microsoft Defender ATP.
|
You'll use the access token to access the protected resource, which are detections in Microsoft Defender for Endpoint.
|
||||||
|
|
||||||
To get an access token, you'll need to do a POST request to the token issuing endpoint. Here is a sample request:
|
To get an access token, you'll need to do a POST request to the token issuing endpoint. Here is a sample request:
|
||||||
|
|
||||||
@ -92,10 +92,10 @@ The response will include an access token and expiry information.
|
|||||||
"access_token":"eyJ0eXaioJJOIneiowiouqSuzNiZ345FYOVkaJL0625TueyaJasjhIjEnbMlWqP..."
|
"access_token":"eyJ0eXaioJJOIneiowiouqSuzNiZ345FYOVkaJL0625TueyaJasjhIjEnbMlWqP..."
|
||||||
}
|
}
|
||||||
```
|
```
|
||||||
You can now use the value in the *access_token* field in a request to the Microsoft Defender ATP API.
|
You can now use the value in the *access_token* field in a request to the Defender for Endpoint API.
|
||||||
|
|
||||||
## Request
|
## Request
|
||||||
With an access token, your app can make authenticated requests to the Microsoft Defender ATP API. Your app must append the access token to the Authorization header of each request.
|
With an access token, your app can make authenticated requests to the Microsoft Defender for Endpoint API. Your app must append the access token to the Authorization header of each request.
|
||||||
|
|
||||||
### Request syntax
|
### Request syntax
|
||||||
Method | Request URI
|
Method | Request URI
|
||||||
@ -200,7 +200,7 @@ Here is an example return value:
|
|||||||
|
|
||||||
## Code examples
|
## Code examples
|
||||||
### Get access token
|
### Get access token
|
||||||
The following code examples demonstrate how to obtain an access token for calling the Microsoft Defender ATP SIEM API.
|
The following code examples demonstrate how to obtain an access token for calling the Microsoft Defender for Endpoint SIEM API.
|
||||||
|
|
||||||
```csharp
|
```csharp
|
||||||
AuthenticationContext context = new AuthenticationContext(string.Format("https://login.windows.net/{0}", tenantId));
|
AuthenticationContext context = new AuthenticationContext(string.Format("https://login.windows.net/{0}", tenantId));
|
||||||
@ -250,7 +250,7 @@ echo ${tokenArr[1]} | cut -d "\"" -f2 | cut -d "\"" -f1 >> $scriptDir/LatestSIEM
|
|||||||
```
|
```
|
||||||
|
|
||||||
### Use token to connect to the detections endpoint
|
### Use token to connect to the detections endpoint
|
||||||
The following code examples demonstrate how to use an access token for calling the Microsoft Defender ATP SIEM API to get alerts.
|
The following code examples demonstrate how to use an access token for calling the Defender for Endpoint SIEM API to get alerts.
|
||||||
|
|
||||||
```csharp
|
```csharp
|
||||||
HttpClient httpClient = new HttpClient();
|
HttpClient httpClient = new HttpClient();
|
||||||
@ -318,7 +318,7 @@ echo $apiResponse
|
|||||||
```
|
```
|
||||||
|
|
||||||
## Error codes
|
## Error codes
|
||||||
The Microsoft Defender ATP REST API returns the following error codes caused by an invalid request.
|
The Microsoft Defender for Endpoint REST API returns the following error codes caused by an invalid request.
|
||||||
|
|
||||||
HTTP error code | Description
|
HTTP error code | Description
|
||||||
:---|:---
|
:---|:---
|
||||||
@ -327,8 +327,8 @@ HTTP error code | Description
|
|||||||
500 | Error in the service.
|
500 | Error in the service.
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
- [Enable SIEM integration in Microsoft Defender for Endpoint](enable-siem-integration.md)
|
||||||
- [Configure ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md)
|
- [Configure ArcSight to pull Microsoft Defender for Endpoint detections](configure-arcsight.md)
|
||||||
- [Configure Splunk to pull Microsoft Defender ATP detections](configure-splunk.md)
|
- [Configure Splunk to pull Microsoft Defender for Endpoint detections](configure-splunk.md)
|
||||||
- [Microsoft Defender ATP Detection fields](api-portal-mapping.md)
|
- [Microsoft Defender for Endpoint Detection fields](api-portal-mapping.md)
|
||||||
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
- [Troubleshoot SIEM tool integration issues](troubleshoot-siem.md)
|
||||||
|
|||||||
@ -17,16 +17,16 @@ ms.collection: M365-security-compliance
|
|||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# Configure Microsoft Defender ATP to stream Advanced Hunting events to your Azure Event Hubs
|
# Configure Microsoft Defender for Endpoint to stream Advanced Hunting events to your Azure Event Hubs
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
||||||
|
|
||||||
## Before you begin:
|
## Before you begin:
|
||||||
|
|
||||||
@ -65,7 +65,7 @@ Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://w
|
|||||||
|
|
||||||
- Each event hub message in Azure Event Hubs contains list of records.
|
- Each event hub message in Azure Event Hubs contains list of records.
|
||||||
- Each record contains the event name, the time Microsoft Defender ATP received the event, the tenant it belongs (you will only get events from your tenant), and the event in JSON format in a property called "**properties**".
|
- Each record contains the event name, the time Microsoft Defender ATP received the event, the tenant it belongs (you will only get events from your tenant), and the event in JSON format in a property called "**properties**".
|
||||||
- For more information about the schema of Microsoft Defender ATP events, see [Advanced Hunting overview](advanced-hunting-overview.md).
|
- For more information about the schema of Microsoft Defender for Endpoint events, see [Advanced Hunting overview](advanced-hunting-overview.md).
|
||||||
- In Advanced Hunting, the **DeviceInfo** table has a column named **MachineGroup** which contains the group of the device. Here every event will be decorated with this column as well. See [Device Groups](machine-groups.md) for more information.
|
- In Advanced Hunting, the **DeviceInfo** table has a column named **MachineGroup** which contains the group of the device. Here every event will be decorated with this column as well. See [Device Groups](machine-groups.md) for more information.
|
||||||
|
|
||||||
## Data types mapping:
|
## Data types mapping:
|
||||||
@ -88,6 +88,6 @@ To get the data types for event properties do the following:
|
|||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
- [Overview of Advanced Hunting](advanced-hunting-overview.md)
|
- [Overview of Advanced Hunting](advanced-hunting-overview.md)
|
||||||
- [Microsoft Defender ATP streaming API](raw-data-export.md)
|
- [Microsoft Defender for Endpoint streaming API](raw-data-export.md)
|
||||||
- [Stream Microsoft Defender ATP events to your Azure storage account](raw-data-export-storage.md)
|
- [Stream Microsoft Defender for Endpoint events to your Azure storage account](raw-data-export-storage.md)
|
||||||
- [Azure Event Hubs documentation](https://docs.microsoft.com/azure/event-hubs/)
|
- [Azure Event Hubs documentation](https://docs.microsoft.com/azure/event-hubs/)
|
||||||
|
|||||||
@ -17,16 +17,16 @@ ms.collection: M365-security-compliance
|
|||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# Configure Microsoft Defender ATP to stream Advanced Hunting events to your Storage account
|
# Configure Microsoft Defender for Endpoint to stream Advanced Hunting events to your Storage account
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
||||||
|
|
||||||
## Before you begin:
|
## Before you begin:
|
||||||
|
|
||||||
@ -36,7 +36,7 @@ Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://w
|
|||||||
|
|
||||||
## Enable raw data streaming:
|
## Enable raw data streaming:
|
||||||
|
|
||||||
1. Log in to [Microsoft Defender ATP portal](https://securitycenter.windows.com) with Global Admin user.
|
1. Log in to [Microsoft Defender for Endpoint portal](https://securitycenter.windows.com) with Global Admin user.
|
||||||
2. Go to [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center.
|
2. Go to [Data export settings page](https://securitycenter.windows.com/interoperability/dataexport) on Microsoft Defender Security Center.
|
||||||
3. Click on **Add data export settings**.
|
3. Click on **Add data export settings**.
|
||||||
4. Choose a name for your new settings.
|
4. Choose a name for your new settings.
|
||||||
@ -65,8 +65,8 @@ Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://w
|
|||||||
```
|
```
|
||||||
|
|
||||||
- Each blob contains multiple rows.
|
- Each blob contains multiple rows.
|
||||||
- Each row contains the event name, the time Microsoft Defender ATP received the event, the tenant it belongs (you will only get events from your tenant), and the event in JSON format in a property called "properties".
|
- Each row contains the event name, the time Defender for Endpoint received the event, the tenant it belongs (you will only get events from your tenant), and the event in JSON format in a property called "properties".
|
||||||
- For more information about the schema of Microsoft Defender ATP events, see [Advanced Hunting overview](advanced-hunting-overview.md).
|
- For more information about the schema of Microsoft Defender for Endpoint events, see [Advanced Hunting overview](advanced-hunting-overview.md).
|
||||||
- In Advanced Hunting, the **DeviceInfo** table has a column named **MachineGroup** which contains the group of the device. Here every event will be decorated with this column as well. See [Device Groups](machine-groups.md) for more information.
|
- In Advanced Hunting, the **DeviceInfo** table has a column named **MachineGroup** which contains the group of the device. Here every event will be decorated with this column as well. See [Device Groups](machine-groups.md) for more information.
|
||||||
|
|
||||||
## Data types mapping:
|
## Data types mapping:
|
||||||
@ -89,6 +89,6 @@ In order to get the data types for our events properties do the following:
|
|||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
- [Overview of Advanced Hunting](advanced-hunting-overview.md)
|
- [Overview of Advanced Hunting](advanced-hunting-overview.md)
|
||||||
- [Microsoft Defender Advanced Threat Protection Streaming API](raw-data-export.md)
|
- [Microsoft Defender for Endpoint Streaming API](raw-data-export.md)
|
||||||
- [Stream Microsoft Defender Advanced Threat Protection events to your Azure storage account](raw-data-export-storage.md)
|
- [Stream Microsoft Defender for Endpoint events to your Azure storage account](raw-data-export-storage.md)
|
||||||
- [Azure Storage Account documentation](https://docs.microsoft.com/azure/storage/common/storage-account-overview)
|
- [Azure Storage Account documentation](https://docs.microsoft.com/azure/storage/common/storage-account-overview)
|
||||||
|
|||||||
@ -24,13 +24,13 @@ ms.topic: article
|
|||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
||||||
|
|
||||||
## Stream Advanced Hunting events to Event Hubs and/or Azure storage account.
|
## Stream Advanced Hunting events to Event Hubs and/or Azure storage account.
|
||||||
|
|
||||||
Microsoft Defender ATP supports streaming all the events available through [Advanced Hunting](advanced-hunting-overview.md) to an [Event Hubs](https://docs.microsoft.com/azure/event-hubs/) and/or [Azure storage account](https://docs.microsoft.com/azure/event-hubs/).
|
Defender for Endpoint supports streaming all the events available through [Advanced Hunting](advanced-hunting-overview.md) to an [Event Hubs](https://docs.microsoft.com/azure/event-hubs/) and/or [Azure storage account](https://docs.microsoft.com/azure/event-hubs/).
|
||||||
|
|
||||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4r4ga]
|
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4r4ga]
|
||||||
|
|
||||||
@ -39,8 +39,8 @@ Microsoft Defender ATP supports streaming all the events available through [Adva
|
|||||||
|
|
||||||
Topic | Description
|
Topic | Description
|
||||||
:---|:---
|
:---|:---
|
||||||
[Stream Microsoft Defender ATP events to Azure Event Hubs](raw-data-export-event-hub.md)| Learn about enabling the streaming API in your tenant and configure Microsoft Defender ATP to stream [Advanced Hunting](advanced-hunting-overview.md) to Event Hubs.
|
[Stream Microsoft Defender for Endpoint events to Azure Event Hubs](raw-data-export-event-hub.md)| Learn about enabling the streaming API in your tenant and configure Defender for Endpoint to stream [Advanced Hunting](advanced-hunting-overview.md) to Event Hubs.
|
||||||
[Stream Microsoft Defender ATP events to your Azure storage account](raw-data-export-storage.md)| Learn about enabling the streaming API in your tenant and configure Microsoft Defender ATP to stream [Advanced Hunting](advanced-hunting-overview.md) to your Azure storage account.
|
[Stream Defender for Endpoint events to your Azure storage account](raw-data-export-storage.md)| Learn about enabling the streaming API in your tenant and configure Defender for Endpoint to stream [Advanced Hunting](advanced-hunting-overview.md) to your Azure storage account.
|
||||||
|
|
||||||
|
|
||||||
## Related topics
|
## Related topics
|
||||||
|
|||||||
@ -24,9 +24,9 @@ ms.topic: article
|
|||||||
**Applies to:**
|
**Applies to:**
|
||||||
- Azure Active Directory
|
- Azure Active Directory
|
||||||
- Office 365
|
- Office 365
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-rbac-abovefoldlink)
|
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-rbac-abovefoldlink)
|
||||||
|
|
||||||
|
|
||||||
Using role-based access control (RBAC), you can create roles and groups within your security operations team to grant appropriate access to the portal. Based on the roles and groups you create, you have fine-grained control over what users with access to the portal can see and do.
|
Using role-based access control (RBAC), you can create roles and groups within your security operations team to grant appropriate access to the portal. Based on the roles and groups you create, you have fine-grained control over what users with access to the portal can see and do.
|
||||||
@ -41,10 +41,10 @@ Tier 1 | **Local security operations team / IT team** <br> This team usually tri
|
|||||||
Tier 2 | **Regional security operations team** <br> This team can see all the devices for their region and perform remediation actions.
|
Tier 2 | **Regional security operations team** <br> This team can see all the devices for their region and perform remediation actions.
|
||||||
Tier 3 | **Global security operations team** <br> This team consists of security experts and are authorized to see and perform all actions from the portal.
|
Tier 3 | **Global security operations team** <br> This team consists of security experts and are authorized to see and perform all actions from the portal.
|
||||||
|
|
||||||
Microsoft Defender ATP RBAC is designed to support your tier- or role-based model of choice and gives you granular control over what roles can see, devices they can access, and actions they can take. The RBAC framework is centered around the following controls:
|
Defender for Endpoint RBAC is designed to support your tier- or role-based model of choice and gives you granular control over what roles can see, devices they can access, and actions they can take. The RBAC framework is centered around the following controls:
|
||||||
|
|
||||||
- **Control who can take specific action**
|
- **Control who can take specific action**
|
||||||
- Create custom roles and control what Microsoft Defender ATP capabilities they can access with granularity.
|
- Create custom roles and control what Defender for Endpoint capabilities they can access with granularity.
|
||||||
|
|
||||||
- **Control who can see information on specific device group or groups**
|
- **Control who can see information on specific device group or groups**
|
||||||
- [Create device groups](machine-groups.md) by specific criteria such as names, tags, domains, and others, then grant role access to them using a specific Azure Active Directory (Azure AD) user group.
|
- [Create device groups](machine-groups.md) by specific criteria such as names, tags, domains, and others, then grant role access to them using a specific Azure Active Directory (Azure AD) user group.
|
||||||
@ -61,18 +61,18 @@ Before using RBAC, it's important that you understand the roles that can grant p
|
|||||||
|
|
||||||
When you first log in to Microsoft Defender Security Center, you're granted either full access or read only access. Full access rights are granted to users with Security Administrator or Global Administrator roles in Azure AD. Read only access is granted to users with a Security Reader role in Azure AD.
|
When you first log in to Microsoft Defender Security Center, you're granted either full access or read only access. Full access rights are granted to users with Security Administrator or Global Administrator roles in Azure AD. Read only access is granted to users with a Security Reader role in Azure AD.
|
||||||
|
|
||||||
Someone with a Microsoft Defender ATP Global administrator role has unrestricted access to all devices, regardless of their device group association and the Azure AD user groups assignments
|
Someone with a Defender for Endpoint Global administrator role has unrestricted access to all devices, regardless of their device group association and the Azure AD user groups assignments
|
||||||
|
|
||||||
> [!WARNING]
|
> [!WARNING]
|
||||||
> Initially, only those with Azure AD Global Administrator or Security Administrator rights will be able to create and assign roles in Microsoft Defender Security Center, therefore, having the right groups ready in Azure AD is important.
|
> Initially, only those with Azure AD Global Administrator or Security Administrator rights will be able to create and assign roles in Microsoft Defender Security Center, therefore, having the right groups ready in Azure AD is important.
|
||||||
>
|
>
|
||||||
> **Turning on role-based access control will cause users with read-only permissions (for example, users assigned to Azure AD Security reader role) to lose access until they are assigned to a role.**
|
> **Turning on role-based access control will cause users with read-only permissions (for example, users assigned to Azure AD Security reader role) to lose access until they are assigned to a role.**
|
||||||
>
|
>
|
||||||
>Users with admin permissions are automatically assigned the default built-in Microsoft Defender ATP global administrator role with full permissions. After opting in to use RBAC, you can assign additional users that are not Azure AD Global or Security Administrators to the Microsoft Defender ATP global administrator role.
|
>Users with admin permissions are automatically assigned the default built-in Defender for Endpoint global administrator role with full permissions. After opting in to use RBAC, you can assign additional users that are not Azure AD Global or Security Administrators to the Defender for Endpoint global administrator role.
|
||||||
>
|
>
|
||||||
> After opting in to use RBAC, you cannot revert to the initial roles as when you first logged into the portal.
|
> After opting in to use RBAC, you cannot revert to the initial roles as when you first logged into the portal.
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Related topic
|
## Related topic
|
||||||
- [Create and manage device groups in Microsoft Defender ATP](machine-groups.md)
|
- [Create and manage device groups in Microsoft Defender for Endpoint](machine-groups.md)
|
||||||
|
|||||||
@ -21,9 +21,9 @@ ms.topic: article
|
|||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||||
|
|
||||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||||
|
|
||||||
|
|||||||
@ -24,11 +24,11 @@ ms.topic: article
|
|||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
[!include[Prerelease information](../../includes/prerelease.md)]
|
[!include[Prerelease information](../../includes/prerelease.md)]
|
||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-responddile-abovefoldlink)
|
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-responddile-abovefoldlink)
|
||||||
|
|
||||||
Quickly respond to detected attacks by stopping and quarantining files or blocking a file. After taking action on files, you can check activity details in the Action center.
|
Quickly respond to detected attacks by stopping and quarantining files or blocking a file. After taking action on files, you can check activity details in the Action center.
|
||||||
|
|
||||||
@ -131,7 +131,7 @@ You can roll back and remove a file from quarantine if you’ve determined that
|
|||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> In some scenarios, the **ThreatName** may appear as: EUS:Win32/CustomEnterpriseBlock!cl.
|
> In some scenarios, the **ThreatName** may appear as: EUS:Win32/CustomEnterpriseBlock!cl.
|
||||||
>
|
>
|
||||||
> Microsoft Defender ATP will restore all custom blocked files that were quarantined on this device in the last 30 days.
|
> Defender for Endpoint will restore all custom blocked files that were quarantined on this device in the last 30 days.
|
||||||
|
|
||||||
## Add indicator to block or allow a file
|
## Add indicator to block or allow a file
|
||||||
|
|
||||||
@ -177,7 +177,7 @@ When you select this action, a fly-out will appear. From the fly-out, you can re
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
If a file is not already stored by Microsoft Defender ATP, you cannot download it. Instead, you will see a **Collect file** button in the same location. If a file has not been seen in the organization in the past 30 days, **Collect file** will be disabled.
|
If a file is not already stored by Defender for Endpoint, you cannot download it. Instead, you will see a **Collect file** button in the same location. If a file has not been seen in the organization in the past 30 days, **Collect file** will be disabled.
|
||||||
|
|
||||||
## Consult a threat expert
|
## Consult a threat expert
|
||||||
|
|
||||||
@ -216,7 +216,7 @@ Use the deep analysis feature to investigate the details of any file, usually du
|
|||||||
|
|
||||||
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4aAYy?rel=0]
|
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4aAYy?rel=0]
|
||||||
|
|
||||||
**Submit for deep analysis** is enabled when the file is available in the Microsoft Defender ATP backend sample collection, or if it was observed on a Windows 10 device that supports submitting to deep analysis.
|
**Submit for deep analysis** is enabled when the file is available in the Defender for Endpoint backend sample collection, or if it was observed on a Windows 10 device that supports submitting to deep analysis.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> Only files from Windows 10 can be automatically collected.
|
> Only files from Windows 10 can be automatically collected.
|
||||||
@ -224,9 +224,9 @@ Use the deep analysis feature to investigate the details of any file, usually du
|
|||||||
You can also manually submit a sample through the [Microsoft Security Center Portal](https://www.microsoft.com/security/portal/submission/submit.aspx) if the file was not observed on a Windows 10 device, and wait for **Submit for deep analysis** button to become available.
|
You can also manually submit a sample through the [Microsoft Security Center Portal](https://www.microsoft.com/security/portal/submission/submit.aspx) if the file was not observed on a Windows 10 device, and wait for **Submit for deep analysis** button to become available.
|
||||||
|
|
||||||
> [!NOTE]
|
> [!NOTE]
|
||||||
> Due to backend processing flows in the Microsoft Security Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Microsoft Defender ATP.
|
> Due to backend processing flows in the Microsoft Security Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Defender for Endpoint.
|
||||||
|
|
||||||
When the sample is collected, Microsoft Defender ATP runs the file in is a secure environment and creates a detailed report of observed behaviors and associated artifacts, such as files dropped on devices, communication to IPs, and registry modifications.
|
When the sample is collected, Defender for Endpoint runs the file in is a secure environment and creates a detailed report of observed behaviors and associated artifacts, such as files dropped on devices, communication to IPs, and registry modifications.
|
||||||
|
|
||||||
**Submit files for deep analysis:**
|
**Submit files for deep analysis:**
|
||||||
|
|
||||||
@ -249,7 +249,7 @@ A progress bar is displayed and provides information on the different stages of
|
|||||||
|
|
||||||
**View deep analysis reports**
|
**View deep analysis reports**
|
||||||
|
|
||||||
View the deep analysis report that Microsoft Defender ATP provides to see the details of the deep analysis that was conducted on the file you submitted. This feature is available in the file view context.
|
View the deep analysis report that Defender for Endpoint provides to see the details of the deep analysis that was conducted on the file you submitted. This feature is available in the file view context.
|
||||||
|
|
||||||
You can view the comprehensive report that provides details on the following sections:
|
You can view the comprehensive report that provides details on the following sections:
|
||||||
|
|
||||||
|
|||||||
@ -23,9 +23,9 @@ ms.topic: article
|
|||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-respondmachine-abovefoldlink)
|
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-respondmachine-abovefoldlink)
|
||||||
|
|
||||||
Quickly respond to detected attacks by isolating devices or collecting an investigation package. After taking action on devices, you can check activity details on the Action center.
|
Quickly respond to detected attacks by isolating devices or collecting an investigation package. After taking action on devices, you can check activity details on the Action center.
|
||||||
|
|
||||||
@ -128,7 +128,7 @@ One you have selected **Run antivirus scan**, select the scan type that you'd li
|
|||||||
The Action center will show the scan information and the device timeline will include a new event, reflecting that a scan action was submitted on the device. Microsoft Defender AV alerts will reflect any detections that surfaced during the scan.
|
The Action center will show the scan information and the device timeline will include a new event, reflecting that a scan action was submitted on the device. Microsoft Defender AV alerts will reflect any detections that surfaced during the scan.
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>When triggering a scan using Microsoft Defender ATP response action, Microsoft Defender antivirus 'ScanAvgCPULoadFactor' value still applies and limits the CPU impact of the scan.<br>
|
>When triggering a scan using Defender for Endpoint response action, Microsoft Defender antivirus 'ScanAvgCPULoadFactor' value still applies and limits the CPU impact of the scan.<br>
|
||||||
>If ScanAvgCPULoadFactor is not configured, the default value is a limit of 50% maximum CPU load during a scan.<br>
|
>If ScanAvgCPULoadFactor is not configured, the default value is a limit of 50% maximum CPU load during a scan.<br>
|
||||||
>For more information, see [configure-advanced-scan-types-microsoft-defender-antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus).
|
>For more information, see [configure-advanced-scan-types-microsoft-defender-antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-advanced-scan-types-microsoft-defender-antivirus).
|
||||||
|
|
||||||
@ -163,7 +163,7 @@ Depending on the severity of the attack and the sensitivity of the device, you m
|
|||||||
>- Full isolation is available for devices on Windows 10, version 1703.
|
>- Full isolation is available for devices on Windows 10, version 1703.
|
||||||
>- Selective isolation is available for devices on Windows 10, version 1709 or later.
|
>- Selective isolation is available for devices on Windows 10, version 1709 or later.
|
||||||
|
|
||||||
This device isolation feature disconnects the compromised device from the network while retaining connectivity to the Microsoft Defender ATP service, which continues to monitor the device.
|
This device isolation feature disconnects the compromised device from the network while retaining connectivity to the Defender for Endpoint service, which continues to monitor the device.
|
||||||
|
|
||||||
On Windows 10, version 1709 or later, you'll have additional control over the network isolation level. You can also choose to enable Outlook, Microsoft Teams, and Skype for Business connectivity (a.k.a 'Selective Isolation').
|
On Windows 10, version 1709 or later, you'll have additional control over the network isolation level. You can also choose to enable Outlook, Microsoft Teams, and Skype for Business connectivity (a.k.a 'Selective Isolation').
|
||||||
|
|
||||||
@ -175,7 +175,7 @@ Once you have selected **Isolate device** on the device page, type a comment and
|
|||||||
|
|
||||||
|
|
||||||
>[!NOTE]
|
>[!NOTE]
|
||||||
>The device will remain connected to the Microsoft Defender ATP service even if it is isolated from the network. If you've chosen to enable Outlook and Skype for Business communication, then you'll be able to communicate to the user while the device is isolated.
|
>The device will remain connected to the Defender for Endpoint service even if it is isolated from the network. If you've chosen to enable Outlook and Skype for Business communication, then you'll be able to communicate to the user while the device is isolated.
|
||||||
|
|
||||||
**Notification on device user**:</br>
|
**Notification on device user**:</br>
|
||||||
When a device is being isolated, the following notification is displayed to inform the user that the device is being isolated from the network:
|
When a device is being isolated, the following notification is displayed to inform the user that the device is being isolated from the network:
|
||||||
|
|||||||
@ -21,9 +21,9 @@ ms.topic: article
|
|||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||||
|
|
||||||
|
|
||||||
## API description
|
## API description
|
||||||
@ -37,7 +37,7 @@ Restrict execution of all applications on the device except a predefined set.
|
|||||||
[!include[Device actions note](../../includes/machineactionsnote.md)]
|
[!include[Device actions note](../../includes/machineactionsnote.md)]
|
||||||
|
|
||||||
## Permissions
|
## Permissions
|
||||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||||
|
|
||||||
Permission type | Permission | Permission display name
|
Permission type | Permission | Permission display name
|
||||||
:---|:---|:---
|
:---|:---|:---
|
||||||
|
|||||||
@ -18,18 +18,18 @@ ms.topic: conceptual
|
|||||||
ms.date: 5/1/2020
|
ms.date: 5/1/2020
|
||||||
---
|
---
|
||||||
|
|
||||||
# Review alerts in Microsoft Defender Advanced Threat Protection
|
# Review alerts in Microsoft Defender for Endpoint
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-managealerts-abovefoldlink)
|
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-managealerts-abovefoldlink)
|
||||||
|
|
||||||
The alert page in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) provides full context to the alert, by combining attack signals and alerts related to the selected alert, to construct a detailed alert story.
|
The alert page in Microsoft Defender for Endpoint provides full context to the alert, by combining attack signals and alerts related to the selected alert, to construct a detailed alert story.
|
||||||
|
|
||||||
Quickly triage, investigate, and take effective action on alerts that affect your organization. Understand why they were triggered, and their impact from one location. Learn more in this overview.
|
Quickly triage, investigate, and take effective action on alerts that affect your organization. Understand why they were triggered, and their impact from one location. Learn more in this overview.
|
||||||
|
|
||||||
@ -37,7 +37,7 @@ Quickly triage, investigate, and take effective action on alerts that affect you
|
|||||||
|
|
||||||
## Getting started with an alert
|
## Getting started with an alert
|
||||||
|
|
||||||
Clicking on an alert's name in Microsoft Defender ATP will land you on its alert page. On the alert page, all the information will be shown in context of the selected alert. Each alert page consists of 4 sections:
|
Clicking on an alert's name in Defender for Endpoint will land you on its alert page. On the alert page, all the information will be shown in context of the selected alert. Each alert page consists of 4 sections:
|
||||||
|
|
||||||
1. **The alert title** shows the alert's name and is there to remind you which alert started your current investigation regardless of what you have selected on the page.
|
1. **The alert title** shows the alert's name and is there to remind you which alert started your current investigation regardless of what you have selected on the page.
|
||||||
2. [**Affected assets**](#review-affected-assets) lists cards of devices and users affected by this alert that are clickable for further information and actions.
|
2. [**Affected assets**](#review-affected-assets) lists cards of devices and users affected by this alert that are clickable for further information and actions.
|
||||||
@ -46,7 +46,7 @@ Clicking on an alert's name in Microsoft Defender ATP will land you on its alert
|
|||||||
|
|
||||||
|
|
||||||
|
|
||||||
Note the detection status for your alert. Blocked, prevented, or remediated means actions were already taken by Microsoft Defender ATP.
|
Note the detection status for your alert. Blocked, prevented, or remediated means actions were already taken by Defender for Endpoint.
|
||||||
Start by reviewing the *automated investigation details* in your alert's [details pane](#take-action-from-the-details-pane), to see which actions were already taken, as well as reading the alert's description for recommended actions.
|
Start by reviewing the *automated investigation details* in your alert's [details pane](#take-action-from-the-details-pane), to see which actions were already taken, as well as reading the alert's description for recommended actions.
|
||||||
|
|
||||||
|
|
||||||
|
|||||||
@ -22,9 +22,9 @@ ms.topic: article
|
|||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||||
|
|
||||||
## Limitations
|
## Limitations
|
||||||
1. You can only run a query on data from the last 30 days.
|
1. You can only run a query on data from the last 30 days.
|
||||||
@ -36,7 +36,7 @@ ms.topic: article
|
|||||||
5. 429 response will represent reaching quota limit either by number of requests or by CPU. The 429 response body will also indicate the time until the quota is renewed.
|
5. 429 response will represent reaching quota limit either by number of requests or by CPU. The 429 response body will also indicate the time until the quota is renewed.
|
||||||
|
|
||||||
## Permissions
|
## Permissions
|
||||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||||
|
|
||||||
Permission type | Permission | Permission display name
|
Permission type | Permission | Permission display name
|
||||||
:---|:---|:---
|
:---|:---|:---
|
||||||
@ -137,6 +137,6 @@ Here is an example of the response.
|
|||||||
```
|
```
|
||||||
|
|
||||||
## Related topic
|
## Related topic
|
||||||
- [Microsoft Defender ATP APIs introduction](apis-intro.md)
|
- [Microsoft Defender for Endpoint APIs introduction](apis-intro.md)
|
||||||
- [Advanced Hunting from Portal](advanced-hunting-query-language.md)
|
- [Advanced Hunting from Portal](advanced-hunting-query-language.md)
|
||||||
- [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md)
|
- [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md)
|
||||||
|
|||||||
@ -22,7 +22,7 @@ ms.topic: article
|
|||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
|
|
||||||
Run advanced queries using PowerShell, see [Advanced Hunting API](run-advanced-query-api.md).
|
Run advanced queries using PowerShell, see [Advanced Hunting API](run-advanced-query-api.md).
|
||||||
@ -65,7 +65,7 @@ $aadToken = $response.access_token
|
|||||||
|
|
||||||
where
|
where
|
||||||
- $tenantId: ID of the tenant on behalf of which you want to run the query (that is, the query will be run on the data of this tenant)
|
- $tenantId: ID of the tenant on behalf of which you want to run the query (that is, the query will be run on the data of this tenant)
|
||||||
- $appId: ID of your Azure AD app (the app must have 'Run advanced queries' permission to Microsoft Defender ATP)
|
- $appId: ID of your Azure AD app (the app must have 'Run advanced queries' permission to Defender for Endpoint)
|
||||||
- $appSecret: Secret of your Azure AD app
|
- $appSecret: Secret of your Azure AD app
|
||||||
|
|
||||||
## Run query
|
## Run query
|
||||||
@ -117,6 +117,6 @@ $results | ConvertTo-Json | Set-Content file1.json
|
|||||||
|
|
||||||
|
|
||||||
## Related topic
|
## Related topic
|
||||||
- [Microsoft Defender ATP APIs](apis-intro.md)
|
- [Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||||
- [Advanced Hunting API](run-advanced-query-api.md)
|
- [Advanced Hunting API](run-advanced-query-api.md)
|
||||||
- [Advanced Hunting using Python](run-advanced-query-sample-python.md)
|
- [Advanced Hunting using Python](run-advanced-query-sample-python.md)
|
||||||
|
|||||||
@ -24,7 +24,7 @@ ms.topic: article
|
|||||||
|
|
||||||
**Applies to:**
|
**Applies to:**
|
||||||
|
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
Run advanced queries using Python, see [Advanced Hunting API](run-advanced-query-api.md).
|
Run advanced queries using Python, see [Advanced Hunting API](run-advanced-query-api.md).
|
||||||
|
|
||||||
@ -68,7 +68,7 @@ aadToken = jsonResponse["access_token"]
|
|||||||
|
|
||||||
where
|
where
|
||||||
- tenantId: ID of the tenant on behalf of which you want to run the query (that is, the query will be run on the data of this tenant)
|
- tenantId: ID of the tenant on behalf of which you want to run the query (that is, the query will be run on the data of this tenant)
|
||||||
- appId: ID of your Azure AD app (the app must have 'Run advanced queries' permission to Microsoft Defender ATP)
|
- appId: ID of your Azure AD app (the app must have 'Run advanced queries' permission to Microsoft Defender for Endpoint)
|
||||||
- appSecret: Secret of your Azure AD app
|
- appSecret: Secret of your Azure AD app
|
||||||
|
|
||||||
## Run query
|
## Run query
|
||||||
@ -147,6 +147,6 @@ outputFile.close()
|
|||||||
|
|
||||||
|
|
||||||
## Related topic
|
## Related topic
|
||||||
- [Microsoft Defender ATP APIs](apis-intro.md)
|
- [Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||||
- [Advanced Hunting API](run-advanced-query-api.md)
|
- [Advanced Hunting API](run-advanced-query-api.md)
|
||||||
- [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md)
|
- [Advanced Hunting using PowerShell](run-advanced-query-sample-powershell.md)
|
||||||
|
|||||||
@ -21,9 +21,9 @@ ms.topic: article
|
|||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
|
|
||||||
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
- Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||||
|
|
||||||
|
|
||||||
## API description
|
## API description
|
||||||
@ -37,7 +37,7 @@ Initiate Microsoft Defender Antivirus scan on a device.
|
|||||||
[!include[Device actions note](../../includes/machineactionsnote.md)]
|
[!include[Device actions note](../../includes/machineactionsnote.md)]
|
||||||
|
|
||||||
## Permissions
|
## Permissions
|
||||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender for Endpoint APIs](apis-intro.md)
|
||||||
|
|
||||||
Permission type | Permission | Permission display name
|
Permission type | Permission | Permission display name
|
||||||
:---|:---|:---
|
:---|:---|:---
|
||||||
|
|||||||
@ -19,7 +19,7 @@ ms.collection:
|
|||||||
ms.topic: article
|
ms.topic: article
|
||||||
---
|
---
|
||||||
|
|
||||||
# Run a detection test on a newly onboarded Microsoft Defender ATP device
|
# Run a detection test on a newly onboarded Microsoft Defender for Endpoint device
|
||||||
|
|
||||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||||
|
|
||||||
@ -30,10 +30,10 @@ ms.topic: article
|
|||||||
- Windows Server 2016
|
- Windows Server 2016
|
||||||
- Windows Server, version 1803
|
- Windows Server, version 1803
|
||||||
- Windows Server, 2019
|
- Windows Server, 2019
|
||||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||||
|
|
||||||
|
|
||||||
Run the following PowerShell script on a newly onboarded device to verify that it is properly reporting to the Microsoft Defender ATP service.
|
Run the following PowerShell script on a newly onboarded device to verify that it is properly reporting to the Defender for Endpoint service.
|
||||||
|
|
||||||
1. Create a folder: 'C:\test-MDATP-test'.
|
1. Create a folder: 'C:\test-MDATP-test'.
|
||||||
2. Open an elevated command-line prompt on the device and run the script:
|
2. Open an elevated command-line prompt on the device and run the script:
|
||||||
@ -55,4 +55,4 @@ The Command Prompt window will close automatically. If successful, the detection
|
|||||||
## Related topics
|
## Related topics
|
||||||
- [Onboard Windows 10 devices](configure-endpoints.md)
|
- [Onboard Windows 10 devices](configure-endpoints.md)
|
||||||
- [Onboard servers](configure-server-endpoints.md)
|
- [Onboard servers](configure-server-endpoints.md)
|
||||||
- [Troubleshoot Microsoft Defender Advanced Threat Protection onboarding issues](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding)
|
- [Troubleshoot Microsoft Defender for Endpoint onboarding issues](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/troubleshoot-onboarding)
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user