From 08ac68cecac9780d19b7268366b720b65ef6b859 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 27 Aug 2020 11:27:27 -0700 Subject: [PATCH] Update indicator-ip-domain.md adding note about CIDR --- .../microsoft-defender-atp/indicator-ip-domain.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md b/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md index 90e188b28e..3b0bfb0cab 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md +++ b/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md @@ -33,6 +33,9 @@ The threat intelligence data set for this has been managed by Microsoft. By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs, or domains based on your own threat intelligence. You can do this through the settings page or by machine groups if you deem certain groups to be more or less at risk than others. +> [!NOTE] +> Classless Inter-Domain Routing (CIDR) notation for IP addresses is not supported. + ### Before you begin It's important to understand the following prerequisites prior to creating indicators for IPS, URLs, or domains: - URL/IP allow and block relies on the Microsoft Defender ATP component Network Protection to be enabled in block mode. For more information on Network Protection and configuration instructions, see [Enable network protection](enable-network-protection.md). @@ -72,4 +75,4 @@ It's important to understand the following prerequisites prior to creating indic - [Create indicators](manage-indicators.md) - [Create indicators for files](indicator-file.md) - [Create indicators based on certificates](indicator-certificates.md) -- [Manage indicators](indicator-manage.md) \ No newline at end of file +- [Manage indicators](indicator-manage.md)