deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-18 00:07:23 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge pull request #4412 from MicrosoftDocs/lsaldanha-4620497-batch13

Browse Source 
updated-24620497 M3D-converged
This commit is contained in:
Tina Burden 2021-02-16 11:01:41 -08:00 committed by GitHub
commit cf274a90af
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
25 changed files with 210 additions and 145 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
windows/security/threat-protection/microsoft-defender-atp/Onboard-Windows-10-multi-session-device.md
View File

@ -23,6 +23,16 @@ ms.technology: mde
Applies to: Applies to:
- Windows 10 multi-session running on Windows Virtual Desktop (WVD) - Windows 10 multi-session running on Windows Virtual Desktop (WVD)
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
> [!IMPORTANT]
> Welcome to Microsoft Defender for Endpoint, the new name for Microsoft Defender for Endpoint. Read more about this and other updates here. We'll be updating names in products and in the docs in the near future.
> [!WARNING]
> Microsoft Defender for Endpoint support for Windows Virtual Desktop multi-session scenarios is currently in Preview and limited up to 25 concurrent sessions per host/VM. However, single session scenarios on Windows Virtual Desktop are fully supported.
Microsoft Defender for Endpoint supports monitoring both VDI as well as Windows Virtual Desktop sessions. Depending on your organization's needs, you might need to implement VDI or Windows Virtual Desktop sessions to help your employees access corporate data and apps from an unmanaged device, remote location, or similar scenario. With Microsoft Defender for Endpoint, you can monitor these virtual machines for anomalous activity. Microsoft Defender for Endpoint supports monitoring both VDI as well as Windows Virtual Desktop sessions. Depending on your organization's needs, you might need to implement VDI or Windows Virtual Desktop sessions to help your employees access corporate data and apps from an unmanaged device, remote location, or similar scenario. With Microsoft Defender for Endpoint, you can monitor these virtual machines for anomalous activity.

7
windows/security/threat-protection/microsoft-defender-atp/offboard-machine-api.md
View File

@ -21,10 +21,13 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]

4
windows/security/threat-protection/microsoft-defender-atp/offboard-machines.md
View File

@ -28,7 +28,9 @@ ms.technology: mde
- Linux - Linux
- Windows Server 2012 R2 - Windows Server 2012 R2
- Windows Server 2016 - Windows Server 2016
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-offboarddevices-abovefoldlink) >Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-offboarddevices-abovefoldlink)

4
windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md
View File

@ -22,9 +22,9 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
[!include[Prerelease information](../../includes/prerelease.md)] [!include[Prerelease information](../../includes/prerelease.md)]

3
windows/security/threat-protection/microsoft-defender-atp/onboard-downlevel.md
View File

@ -29,7 +29,8 @@ ms.technology: mde
- Windows 7 SP1 Pro - Windows 7 SP1 Pro
- Windows 8.1 Pro - Windows 8.1 Pro
- Windows 8.1 Enterprise - Windows 8.1 Enterprise
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
>Want to experience Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-downlevel-abovefoldlink). >Want to experience Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-downlevel-abovefoldlink).

6
windows/security/threat-protection/microsoft-defender-atp/onboard-offline-machines.md
View File

@ -25,7 +25,11 @@ ms.technology: mde
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
To onboard devices without Internet access, you'll need to take the following general steps: To onboard devices without Internet access, you'll need to take the following general steps:

5
windows/security/threat-protection/microsoft-defender-atp/onboard.md
View File

@ -24,8 +24,11 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
Configure and manage all the Defender for Endpoint capabilities to get the best security protection for your organization. Configure and manage all the Defender for Endpoint capabilities to get the best security protection for your organization.

110
windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-configuration-manager.md
View File

@ -25,8 +25,10 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
This article is part of the Deployment guide and acts as an example onboarding method. This article is part of the Deployment guide and acts as an example onboarding method.
@ -76,39 +78,40 @@ Follow the steps below to onboard endpoints using Microsoft Endpoint Configurati
1. In Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Device Collections**. 1. In Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Device Collections**.
![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-device-collections.png) ![Image of Microsoft Endpoint Configuration Manager wizard1](images/configmgr-device-collections.png)
2. Right Click **Device Collection** and select **Create Device Collection**. 2. Right Click **Device Collection** and select **Create Device Collection**.
![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-create-device-collection.png) ![Image of Microsoft Endpoint Configuration Manager wizard2](images/configmgr-create-device-collection.png)
3. Provide a **Name** and **Limiting Collection**, then select **Next**. 3. Provide a **Name** and **Limiting Collection**, then select **Next**.
![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-limiting-collection.png) ![Image of Microsoft Endpoint Configuration Manager wizard3](images/configmgr-limiting-collection.png)
4. Select **Add Rule** and choose **Query Rule**. 4. Select **Add Rule** and choose **Query Rule**.
![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-query-rule.png) ![Image of Microsoft Endpoint Configuration Manager wizard4](images/configmgr-query-rule.png)
5. Click **Next** on the **Direct Membership Wizard** and click on **Edit Query Statement**. 5. Click **Next** on the **Direct Membership Wizard** and click on **Edit Query Statement**.
![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-direct-membership.png) ![Image of Microsoft Endpoint Configuration Manager wizard5](images/configmgr-direct-membership.png)
6. Select **Criteria** and then choose the star icon. 6. Select **Criteria** and then choose the star icon.
![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-criteria.png) ![Image of Microsoft Endpoint Configuration Manager wizard6](images/configmgr-criteria.png)
7. Keep criterion type as **simple value**, choose where as **Operating System - build number**, operator as **is greater than or equal to** and value **14393** and click on **OK**. 7. Keep criterion type as **simple value**, choose where as **Operating System - build number**, operator as **is greater than or equal to** and value **14393** and click on **OK**.
![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-simple-value.png) ![Image of Microsoft Endpoint Configuration Manager wizard7](images/configmgr-simple-value.png)
8. Select **Next** and **Close**. 8. Select **Next** and **Close**.
![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-membership-rules.png) ![Image of Microsoft Endpoint Configuration Manager wizard8](images/configmgr-membership-rules.png)
9. Select **Next**. 9. Select **Next**.
![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-confirm.png) ![Image of Microsoft Endpoint Configuration Manager wizard9](images/configmgr-confirm.png)
After completing this task, you now have a device collection with all the Windows 10 endpoints in the environment. After completing this task, you now have a device collection with all the Windows 10 endpoints in the environment.
@ -133,22 +136,23 @@ Manager and deploy that policy to Windows 10 devices.
2. Under Deployment method select the supported version of **Microsoft Endpoint Configuration Manager**. 2. Under Deployment method select the supported version of **Microsoft Endpoint Configuration Manager**.
![Image of Microsoft Defender for Endpoint onboarding wizard](images/mdatp-onboarding-wizard.png) ![Image of Microsoft Defender for Endpoint onboarding wizard10](images/mdatp-onboarding-wizard.png)
3. Select **Download package**. 3. Select **Download package**.
![Image of Microsoft Defender for Endpoint onboarding wizard](images/mdatp-download-package.png) ![Image of Microsoft Defender for Endpoint onboarding wizard11](images/mdatp-download-package.png)
4. Save the package to an accessible location. 4. Save the package to an accessible location.
5. In Microsoft Endpoint Configuration Manager, navigate to: **Assets and Compliance > Overview > Endpoint Protection > Microsoft Defender ATP Policies**. 5. In Microsoft Endpoint Configuration Manager, navigate to: **Assets and Compliance > Overview > Endpoint Protection > Microsoft Defender ATP Policies**.
6. Right-click **Microsoft Defender ATP Policies** and select **Create Microsoft Defender ATP Policy**. 6. Right-click **Microsoft Defender ATP Policies** and select **Create Microsoft Defender ATP Policy**.
![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-create-policy.png) ![Image of Microsoft Endpoint Configuration Manager wizard12](images/configmgr-create-policy.png)
7. Enter the name and description, verify **Onboarding** is selected, then select **Next**. 7. Enter the name and description, verify **Onboarding** is selected, then select **Next**.
![Image of Microsoft Endpoint Configuration Manager wizard](images/configmgr-policy-name.png) ![Image of Microsoft Endpoint Configuration Manager wizard13](images/configmgr-policy-name.png)
8. Click **Browse**. 8. Click **Browse**.
@ -157,25 +161,25 @@ Manager and deploy that policy to Windows 10 devices.
10. Click **Next**. 10. Click **Next**.
11. Configure the Agent with the appropriate samples (**None** or **All file types**). 11. Configure the Agent with the appropriate samples (**None** or **All file types**).
![Image of configuration settings](images/configmgr-config-settings.png) ![Image of configuration settings1](images/configmgr-config-settings.png)
12. Select the appropriate telemetry (**Normal** or **Expedited**) then click **Next**. 12. Select the appropriate telemetry (**Normal** or **Expedited**) then click **Next**.
![Image of configuration settings](images/configmgr-telemetry.png) ![Image of configuration settings2](images/configmgr-telemetry.png)
14. Verify the configuration, then click **Next**. 14. Verify the configuration, then click **Next**.
![Image of configuration settings](images/configmgr-verify-configuration.png) ![Image of configuration settings3](images/configmgr-verify-configuration.png)
15. Click **Close** when the Wizard completes. 15. Click **Close** when the Wizard completes.
16. In the Microsoft Endpoint Configuration Manager console, right-click the Defender for Endpoint policy you just created and select **Deploy**. 16. In the Microsoft Endpoint Configuration Manager console, right-click the Defender for Endpoint policy you just created and select **Deploy**.
![Image of configuration settings](images/configmgr-deploy.png) ![Image of configuration settings4](images/configmgr-deploy.png)
17. On the right panel, select the previously created collection and click **OK**. 17. On the right panel, select the previously created collection and click **OK**.
![Image of configuration settings](images/configmgr-select-collection.png) ![Image of configuration settings5](images/configmgr-select-collection.png)
#### Previous versions of Windows Client (Windows 7 and Windows 8.1) #### Previous versions of Windows Client (Windows 7 and Windows 8.1)
@ -238,7 +242,7 @@ Microsoft Defender Antivirus is a built-in antimalware solution that provides ne
2. Select **Scheduled scans**, **Scan settings**, **Default actions**, **Real-time protection**, **Exclusion settings**, **Advanced**, **Threat overrides**, **Cloud Protection Service** and **Security intelligence updates** and choose **OK**. 2. Select **Scheduled scans**, **Scan settings**, **Default actions**, **Real-time protection**, **Exclusion settings**, **Advanced**, **Threat overrides**, **Cloud Protection Service** and **Security intelligence updates** and choose **OK**.
![Image of next generation protection pane](images/1566ad81bae3d714cc9e0d47575a8cbd.png) ![Image of next generation protection pane1](images/1566ad81bae3d714cc9e0d47575a8cbd.png)
In certain industries or some select enterprise customers might have specific In certain industries or some select enterprise customers might have specific
needs on how Antivirus is configured. needs on how Antivirus is configured.
@ -248,30 +252,29 @@ needs on how Antivirus is configured.
For more details, see [Windows Security configuration framework](https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework) For more details, see [Windows Security configuration framework](https://docs.microsoft.com/windows/security/threat-protection/windows-security-configuration-framework/windows-security-configuration-framework)
![Image of next generation protection pane2](images/cd7daeb392ad5a36f2d3a15d650f1e96.png)
![Image of next generation protection pane](images/cd7daeb392ad5a36f2d3a15d650f1e96.png) ![Image of next generation protection pane3](images/36c7c2ed737f2f4b54918a4f20791d4b.png)
![Image of next generation protection pane](images/36c7c2ed737f2f4b54918a4f20791d4b.png) ![Image of next generation protection pane4](images/a28afc02c1940d5220b233640364970c.png)
![Image of next generation protection pane](images/a28afc02c1940d5220b233640364970c.png) ![Image of next generation protection pane5](images/5420a8790c550f39f189830775a6d4c9.png)
![Image of next generation protection pane](images/5420a8790c550f39f189830775a6d4c9.png) ![Image of next generation protection pane6](images/33f08a38f2f4dd12a364f8eac95e8c6b.png)
![Image of next generation protection pane](images/33f08a38f2f4dd12a364f8eac95e8c6b.png) ![Image of next generation protection pane7](images/41b9a023bc96364062c2041a8f5c344e.png)
![Image of next generation protection pane](images/41b9a023bc96364062c2041a8f5c344e.png) ![Image of next generation protection pane8](images/945c9c5d66797037c3caeaa5c19f135c.png)
![Image of next generation protection pane](images/945c9c5d66797037c3caeaa5c19f135c.png) ![Image of next generation protection pane9](images/3876ca687391bfc0ce215d221c683970.png)
![Image of next generation protection pane](images/3876ca687391bfc0ce215d221c683970.png)
3. Right-click on the newly created antimalware policy and select **Deploy**. 3. Right-click on the newly created antimalware policy and select **Deploy**.
![Image of next generation protection pane](images/f5508317cd8c7870627cb4726acd5f3d.png) ![Image of next generation protection pane10](images/f5508317cd8c7870627cb4726acd5f3d.png)
4. Target the new antimalware policy to your Windows 10 collection and click **OK**. 4. Target the new antimalware policy to your Windows 10 collection and click **OK**.
![Image of next generation protection pane](images/configmgr-select-collection.png) ![Image of next generation protection pane11](images/configmgr-select-collection.png)
After completing this task, you now have successfully configured Windows After completing this task, you now have successfully configured Windows
Defender Antivirus. Defender Antivirus.
@ -286,34 +289,35 @@ To set ASR rules in Audit mode:
1. In the Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**. 1. In the Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**.
![Image of Microsoft Endpoint Configuration Manager console](images/728c10ef26042bbdbcd270b6343f1a8a.png) ![Image of Microsoft Endpoint Configuration Manager console0](images/728c10ef26042bbdbcd270b6343f1a8a.png)
2. Select **Attack Surface Reduction**. 2. Select **Attack Surface Reduction**.
3. Set rules to **Audit** and click **Next**. 3. Set rules to **Audit** and click **Next**.
![Image of Microsoft Endpoint Configuration Manager console](images/d18e40c9e60aecf1f9a93065cb7567bd.png)
![Image of Microsoft Endpoint Configuration Manager console1](images/d18e40c9e60aecf1f9a93065cb7567bd.png)
4. Confirm the new Exploit Guard policy by clicking on **Next**. 4. Confirm the new Exploit Guard policy by clicking on **Next**.
![Image of Microsoft Endpoint Configuration Manager console](images/0a6536f2c4024c08709cac8fcf800060.png) ![Image of Microsoft Endpoint Configuration Manager console2](images/0a6536f2c4024c08709cac8fcf800060.png)
5. Once the policy is created click **Close**. 5. Once the policy is created click **Close**.
![Image of Microsoft Endpoint Configuration Manager console](images/95d23a07c2c8bc79176788f28cef7557.png) ![Image of Microsoft Endpoint Configuration Manager console3](images/95d23a07c2c8bc79176788f28cef7557.png)
![Image of Microsoft Endpoint Manager console1](images/95d23a07c2c8bc79176788f28cef7557.png)
6. Right-click on the newly created policy and choose **Deploy**. 6. Right-click on the newly created policy and choose **Deploy**.
![Image of Microsoft Endpoint Configuration Manager console](images/8999dd697e3b495c04eb911f8b68a1ef.png) ![Image of Microsoft Endpoint Configuration Manager console4](images/8999dd697e3b495c04eb911f8b68a1ef.png)
7. Target the policy to the newly created Windows 10 collection and click **OK**. 7. Target the policy to the newly created Windows 10 collection and click **OK**.
![Image of Microsoft Endpoint Configuration Manager console](images/0ccfe3e803be4b56c668b220b51da7f7.png) ![Image of Microsoft Endpoint Configuration Manager console5](images/0ccfe3e803be4b56c668b220b51da7f7.png)
After completing this task, you now have successfully configured ASR rules in audit mode. After completing this task, you now have successfully configured ASR rules in audit mode.
@ -331,11 +335,11 @@ endpoints. (This may take few minutes)
4. Click **Configuration** tab in Attack surface reduction rules reports. It shows ASR rules configuration overview and ASR rules status on each devices. 4. Click **Configuration** tab in Attack surface reduction rules reports. It shows ASR rules configuration overview and ASR rules status on each devices.
![A screenshot of attack surface reduction rules reports](images/f91f406e6e0aae197a947d3b0e8b2d0d.png) ![A screenshot of attack surface reduction rules reports1](images/f91f406e6e0aae197a947d3b0e8b2d0d.png)
5. Click each device shows configuration details of ASR rules. 5. Click each device shows configuration details of ASR rules.
![A screenshot of attack surface reduction rules reports](images/24bfb16ed561cbb468bd8ce51130ca9d.png) ![A screenshot of attack surface reduction rules reports2](images/24bfb16ed561cbb468bd8ce51130ca9d.png)
See [Optimize ASR rule deployment and See [Optimize ASR rule deployment and
detections](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr) for more details. detections](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-asr) for more details.
@ -344,29 +348,31 @@ detections](https://docs.microsoft.com/windows/security/threat-protection/micros
#### Set Network Protection rules in Audit mode: #### Set Network Protection rules in Audit mode:
1. In the Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**. 1. In the Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**.
![A screenshot System Center Configuration Manager](images/728c10ef26042bbdbcd270b6343f1a8a.png) ![A screenshot System Center Configuration Manager1](images/728c10ef26042bbdbcd270b6343f1a8a.png)
2. Select **Network protection**. 2. Select **Network protection**.
3. Set the setting to **Audit** and click **Next**. 3. Set the setting to **Audit** and click **Next**.
![A screenshot System Center Confirugatiom Manager](images/c039b2e05dba1ade6fb4512456380c9f.png) ![A screenshot System Center Confirugatiom Manager2](images/c039b2e05dba1ade6fb4512456380c9f.png)
4. Confirm the new Exploit Guard Policy by clicking **Next**. 4. Confirm the new Exploit Guard Policy by clicking **Next**.
![A screenshot Exploit GUard policy](images/0a6536f2c4024c08709cac8fcf800060.png) ![A screenshot Exploit GUard policy1](images/0a6536f2c4024c08709cac8fcf800060.png)
5. Once the policy is created click on **Close**. 5. Once the policy is created click on **Close**.
![A screenshot Exploit GUard policy](images/95d23a07c2c8bc79176788f28cef7557.png) ![A screenshot Exploit GUard policy2](images/95d23a07c2c8bc79176788f28cef7557.png)
6. Right-click on the newly created policy and choose **Deploy**. 6. Right-click on the newly created policy and choose **Deploy**.
![A screenshot Microsoft Endpoint Configuration Manager ](images/8999dd697e3b495c04eb911f8b68a1ef.png) ![A screenshot Microsoft Endpoint Configuration Manager1](images/8999dd697e3b495c04eb911f8b68a1ef.png)
7. Select the policy to the newly created Windows 10 collection and choose **OK**. 7. Select the policy to the newly created Windows 10 collection and choose **OK**.
![A screenshot Microsoft Endpoint Configuration Manager ](images/0ccfe3e803be4b56c668b220b51da7f7.png) ![A screenshot Microsoft Endpoint Configuration Manager2](images/0ccfe3e803be4b56c668b220b51da7f7.png)
After completing this task, you now have successfully configured Network After completing this task, you now have successfully configured Network
Protection in audit mode. Protection in audit mode.
@ -375,29 +381,29 @@ Protection in audit mode.
1. In the Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**. 1. In the Microsoft Endpoint Configuration Manager console, navigate to **Assets and Compliance \> Overview \> Endpoint Protection \> Windows Defender Exploit Guard** and choose **Create Exploit Guard Policy**.
![A screenshot of Microsoft Endpoint Configuration Manager ](images/728c10ef26042bbdbcd270b6343f1a8a.png) ![A screenshot of Microsoft Endpoint Configuration Manager3](images/728c10ef26042bbdbcd270b6343f1a8a.png)
2. Select **Controlled folder access**. 2. Select **Controlled folder access**.
3. Set the configuration to **Audit** and click **Next**. 3. Set the configuration to **Audit** and click **Next**.
![A screenshot of Microsoft Endpoint Configuration Manager ](images/a8b934dab2dbba289cf64fe30e0e8aa4.png) ![A screenshot of Microsoft Endpoint Configuration Manager4](images/a8b934dab2dbba289cf64fe30e0e8aa4.png)
4. Confirm the new Exploit Guard Policy by clicking on **Next**. 4. Confirm the new Exploit Guard Policy by clicking on **Next**.
![A screenshot of Microsoft Endpoint Configuration Manager ](images/0a6536f2c4024c08709cac8fcf800060.png) ![A screenshot of Microsoft Endpoint Configuration Manager5](images/0a6536f2c4024c08709cac8fcf800060.png)
5. Once the policy is created click on **Close**. 5. Once the policy is created click on **Close**.
![A screenshot of Microsoft Endpoint Configuration Manager ](images/95d23a07c2c8bc79176788f28cef7557.png) ![A screenshot of Microsoft Endpoint Configuration Manager6](images/95d23a07c2c8bc79176788f28cef7557.png)
6. Right-click on the newly created policy and choose **Deploy**. 6. Right-click on the newly created policy and choose **Deploy**.
![A screenshot of Microsoft Endpoint Configuration Manager ](images/8999dd697e3b495c04eb911f8b68a1ef.png) ![A screenshot of Microsoft Endpoint Configuration Manager7](images/8999dd697e3b495c04eb911f8b68a1ef.png)
7. Target the policy to the newly created Windows 10 collection and click **OK**. 7. Target the policy to the newly created Windows 10 collection and click **OK**.
![A screenshot of Microsoft Endpoint Configuration Manager ](images/0ccfe3e803be4b56c668b220b51da7f7.png) ![A screenshot of Microsoft Endpoint Configuration Manager8](images/0ccfe3e803be4b56c668b220b51da7f7.png)
You have now successfully configured Controlled folder access in audit mode. You have now successfully configured Controlled folder access in audit mode.

95
windows/security/threat-protection/microsoft-defender-atp/onboarding-endpoint-manager.md
View File

@ -25,10 +25,11 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
This article is part of the Deployment guide and acts as an example onboarding method. This article is part of the Deployment guide and acts as an example onboarding method.
@ -94,12 +95,12 @@ needs.<br>
2. Open **Groups > New Group**. 2. Open **Groups > New Group**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/66f724598d9c3319cba27f79dd4617a4.png) > ![Image of Microsoft Endpoint Manager portal1](images/66f724598d9c3319cba27f79dd4617a4.png)
3. Enter details and create a new group. 3. Enter details and create a new group.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/b1e0206d675ad07db218b63cd9b9abc3.png) > ![Image of Microsoft Endpoint Manager portal2](images/b1e0206d675ad07db218b63cd9b9abc3.png)
4. Add your test user or device. 4. Add your test user or device.
@ -110,7 +111,7 @@ needs.<br>
7. Find your test user or device and select it. 7. Find your test user or device and select it.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/149cbfdf221cdbde8159d0ab72644cd0.png) > ![Image of Microsoft Endpoint Manager portal3](images/149cbfdf221cdbde8159d0ab72644cd0.png)
8. Your testing group now has a member to test. 8. Your testing group now has a member to test.
@ -136,7 +137,7 @@ different types of endpoint security policies:
on **Create Profile**. on **Create Profile**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/58dcd48811147feb4ddc17212b7fe840.png) > ![Image of Microsoft Endpoint Manager portal4](images/58dcd48811147feb4ddc17212b7fe840.png)
3. Under **Platform, select Windows 10 and Later, Profile - Endpoint detection 3. Under **Platform, select Windows 10 and Later, Profile - Endpoint detection
and response > Create**. and response > Create**.
@ -144,39 +145,39 @@ different types of endpoint security policies:
4. Enter a name and description, then select **Next**. 4. Enter a name and description, then select **Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/a5b2d23bdd50b160fef4afd25dda28d4.png) > ![Image of Microsoft Endpoint Manager portal5](images/a5b2d23bdd50b160fef4afd25dda28d4.png)
5. Select settings as required, then select **Next**. 5. Select settings as required, then select **Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/cea7e288b5d42a9baf1aef0754ade910.png) > ![Image of Microsoft Endpoint Manager portal6](images/cea7e288b5d42a9baf1aef0754ade910.png)
> [!NOTE] > [!NOTE]
> In this instance, this has been auto populated as Defender for Endpoint has already been integrated with Intune. For more information on the integration, see [Enable Microsoft Defender for Endpoint in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection-configure#to-enable-microsoft-defender-atp). > In this instance, this has been auto populated as Defender for Endpoint has already been integrated with Intune. For more information on the integration, see [Enable Microsoft Defender for Endpoint in Intune](https://docs.microsoft.com/mem/intune/protect/advanced-threat-protection-configure#to-enable-microsoft-defender-atp).
> >
> The following image is an example of what you'll see when Microsoft Defender for Endpoint is NOT integrated with Intune: > The following image is an example of what you'll see when Microsoft Defender for Endpoint is NOT integrated with Intune:
> >
> ![Image of Microsoft Endpoint Manager portal](images/2466460812371ffae2d19a10c347d6f4.png) > ![Image of Microsoft Endpoint Manager portal7](images/2466460812371ffae2d19a10c347d6f4.png)
6. Add scope tags if necessary, then select **Next**. 6. Add scope tags if necessary, then select **Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/ef844f52ec2c0d737ce793f68b5e8408.png) > ![Image of Microsoft Endpoint Manager portal8](images/ef844f52ec2c0d737ce793f68b5e8408.png)
7. Add test group by clicking on **Select groups to include** and choose your group, then select **Next**. 7. Add test group by clicking on **Select groups to include** and choose your group, then select **Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/fc3525e20752da026ec9f46ab4fec64f.png) > ![Image of Microsoft Endpoint Manager portal9](images/fc3525e20752da026ec9f46ab4fec64f.png)
8. Review and accept, then select **Create**. 8. Review and accept, then select **Create**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/289172dbd7bd34d55d24810d9d4d8158.png) > ![Image of Microsoft Endpoint Manager portal10](images/289172dbd7bd34d55d24810d9d4d8158.png)
9. You can view your completed policy. 9. You can view your completed policy.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/5a568b6878be8243ea2b9d82d41ed297.png) > ![Image of Microsoft Endpoint Manager portal11](images/5a568b6878be8243ea2b9d82d41ed297.png)
### Next-generation protection ### Next-generation protection
@ -185,7 +186,7 @@ different types of endpoint security policies:
2. Navigate to **Endpoint security > Antivirus > Create Policy**. 2. Navigate to **Endpoint security > Antivirus > Create Policy**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/6b728d6e0d71108d768e368b416ff8ba.png) > ![Image of Microsoft Endpoint Manager portal12](images/6b728d6e0d71108d768e368b416ff8ba.png)
3. Select **Platform - Windows 10 and Later - Windows and Profile – Microsoft 3. Select **Platform - Windows 10 and Later - Windows and Profile – Microsoft
Defender Antivirus > Create**. Defender Antivirus > Create**.
@ -193,34 +194,34 @@ different types of endpoint security policies:
4. Enter name and description, then select **Next**. 4. Enter name and description, then select **Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/a7d738dd4509d65407b7d12beaa3e917.png) > ![Image of Microsoft Endpoint Manager portal13](images/a7d738dd4509d65407b7d12beaa3e917.png)
5. In the **Configuration settings page**: Set the configurations you require for 5. In the **Configuration settings page**: Set the configurations you require for
Microsoft Defender Antivirus (Cloud Protection, Exclusions, Real-Time Microsoft Defender Antivirus (Cloud Protection, Exclusions, Real-Time
Protection, and Remediation). Protection, and Remediation).
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/3840b1576d6f79a1d72eb14760ef5e8c.png) > ![Image of Microsoft Endpoint Manager portal14](images/3840b1576d6f79a1d72eb14760ef5e8c.png)
6. Add scope tags if necessary, then select **Next**. 6. Add scope tags if necessary, then select **Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/2055e4f9b9141525c0eb681e7ba19381.png) > ![Image of Microsoft Endpoint Manager portal15](images/2055e4f9b9141525c0eb681e7ba19381.png)
7. Select groups to include, assign to your test group, then select **Next**. 7. Select groups to include, assign to your test group, then select **Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/48318a51adee06bff3908e8ad4944dc9.png) > ![Image of Microsoft Endpoint Manager portal16](images/48318a51adee06bff3908e8ad4944dc9.png)
8. Review and create, then select **Create**. 8. Review and create, then select **Create**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/dfdadab79112d61bd3693d957084b0ec.png) > ![Image of Microsoft Endpoint Manager portal17](images/dfdadab79112d61bd3693d957084b0ec.png)
9. You'll see the configuration policy you created. 9. You'll see the configuration policy you created.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/38180219e632d6e4ec7bd25a46398da8.png) > ![Image of Microsoft Endpoint Manager portal18](images/38180219e632d6e4ec7bd25a46398da8.png)
### Attack Surface Reduction – Attack surface reduction rules ### Attack Surface Reduction – Attack surface reduction rules
@ -234,12 +235,12 @@ different types of endpoint security policies:
rules > Create**. rules > Create**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/522d9bb4288dc9c1a957392b51384fdd.png) > ![Image of Microsoft Endpoint Manager portal19](images/522d9bb4288dc9c1a957392b51384fdd.png)
5. Enter a name and description, then select **Next**. 5. Enter a name and description, then select **Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/a5a71fd73ec389f3cdce6d1a6bd1ff31.png) > ![Image of Microsoft Endpoint Manager portal20](images/a5a71fd73ec389f3cdce6d1a6bd1ff31.png)
6. In the **Configuration settings page**: Set the configurations you require for 6. In the **Configuration settings page**: Set the configurations you require for
Attack surface reduction rules, then select **Next**. Attack surface reduction rules, then select **Next**.
@ -250,27 +251,27 @@ different types of endpoint security policies:
> For more information, see [Attack surface reduction rules](attack-surface-reduction.md). > For more information, see [Attack surface reduction rules](attack-surface-reduction.md).
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/dd0c00efe615a64a4a368f54257777d0.png) > ![Image of Microsoft Endpoint Manager portal21](images/dd0c00efe615a64a4a368f54257777d0.png)
7. Add Scope Tags as required, then select **Next**. 7. Add Scope Tags as required, then select **Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/6daa8d347c98fe94a0d9c22797ff6f28.png) > ![Image of Microsoft Endpoint Manager portal22](images/6daa8d347c98fe94a0d9c22797ff6f28.png)
8. Select groups to include and assign to test group, then select **Next**. 8. Select groups to include and assign to test group, then select **Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/45cefc8e4e474321b4d47b4626346597.png) > ![Image of Microsoft Endpoint Manager portal23](images/45cefc8e4e474321b4d47b4626346597.png)
9. Review the details, then select **Create**. 9. Review the details, then select **Create**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/2c2e87c5fedc87eba17be0cdeffdb17f.png) > ![Image of Microsoft Endpoint Manager portal24](images/2c2e87c5fedc87eba17be0cdeffdb17f.png)
10. View the policy. 10. View the policy.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/7a631d17cc42500dacad4e995823ffef.png) > ![Image of Microsoft Endpoint Manager portal25](images/7a631d17cc42500dacad4e995823ffef.png)
### Attack Surface Reduction – Web Protection ### Attack Surface Reduction – Web Protection
@ -283,12 +284,12 @@ different types of endpoint security policies:
4. Select **Windows 10 and Later – Web protection > Create**. 4. Select **Windows 10 and Later – Web protection > Create**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/cd7b5a1cbc16cc05f878cdc99ba4c27f.png) > ![Image of Microsoft Endpoint Manager portal26](images/cd7b5a1cbc16cc05f878cdc99ba4c27f.png)
5. Enter a name and description, then select **Next**. 5. Enter a name and description, then select **Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/5be573a60cd4fa56a86a6668b62dd808.png) > ![Image of Microsoft Endpoint Manager portal27](images/5be573a60cd4fa56a86a6668b62dd808.png)
6. In the **Configuration settings page**: Set the configurations you require for 6. In the **Configuration settings page**: Set the configurations you require for
Web Protection, then select **Next**. Web Protection, then select **Next**.
@ -299,27 +300,27 @@ different types of endpoint security policies:
> For more information, see [Web Protection](web-protection-overview.md). > For more information, see [Web Protection](web-protection-overview.md).
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/6104aa33a56fab750cf30ecabef9f5b6.png) > ![Image of Microsoft Endpoint Manager portal28](images/6104aa33a56fab750cf30ecabef9f5b6.png)
7. Add **Scope Tags as required > Next**. 7. Add **Scope Tags as required > Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/6daa8d347c98fe94a0d9c22797ff6f28.png) > ![Image of Microsoft Endpoint Manager portal29](images/6daa8d347c98fe94a0d9c22797ff6f28.png)
8. Select **Assign to test group > Next**. 8. Select **Assign to test group > Next**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/45cefc8e4e474321b4d47b4626346597.png) > ![Image of Microsoft Endpoint Manager portal30](images/45cefc8e4e474321b4d47b4626346597.png)
9. Select **Review and Create > Create**. 9. Select **Review and Create > Create**.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/8ee0405f1a96c23d2eb6f737f11c1ae5.png) > ![Image of Microsoft Endpoint Manager portal31](images/8ee0405f1a96c23d2eb6f737f11c1ae5.png)
10. View the policy. 10. View the policy.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of Microsoft Endpoint Manager portal](images/e74f6f6c150d017a286e6ed3dffb7757.png) > ![Image of Microsoft Endpoint Manager portal32](images/e74f6f6c150d017a286e6ed3dffb7757.png)
## Validate configuration settings ## Validate configuration settings
@ -337,22 +338,22 @@ To confirm that the configuration policy has been applied to your test device, f
steps above. The following example shows the next generation protection settings. steps above. The following example shows the next generation protection settings.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> [ ![Image of Microsoft Endpoint Manager portal](images/43ab6aa74471ee2977e154a4a5ef2d39.png) ](images/43ab6aa74471ee2977e154a4a5ef2d39.png#lightbox) > [ ![Image of Microsoft Endpoint Manager portal33](images/43ab6aa74471ee2977e154a4a5ef2d39.png) ](images/43ab6aa74471ee2977e154a4a5ef2d39.png#lightbox)
2. Select the **Configuration Policy** to view the policy status. 2. Select the **Configuration Policy** to view the policy status.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> [ ![Image of Microsoft Endpoint Manager portal](images/55ecaca0e4a022f0e29d45aeed724e6c.png) ](images/55ecaca0e4a022f0e29d45aeed724e6c.png#lightbox) > [ ![Image of Microsoft Endpoint Manager portal34](images/55ecaca0e4a022f0e29d45aeed724e6c.png) ](images/55ecaca0e4a022f0e29d45aeed724e6c.png#lightbox)
3. Select **Device Status** to see the status. 3. Select **Device Status** to see the status.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> [ ![Image of Microsoft Endpoint Manager portal](images/18a50df62cc38749000dbfb48e9a4c9b.png) ](images/18a50df62cc38749000dbfb48e9a4c9b.png#lightbox) > [ ![Image of Microsoft Endpoint Manager portal35](images/18a50df62cc38749000dbfb48e9a4c9b.png) ](images/18a50df62cc38749000dbfb48e9a4c9b.png#lightbox)
4. Select **User Status** to see the status. 4. Select **User Status** to see the status.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> [ ![Image of Microsoft Endpoint Manager portal](images/4e965749ff71178af8873bc91f9fe525.png) ](images/4e965749ff71178af8873bc91f9fe525.png#lightbox) > [ ![Image of Microsoft Endpoint Manager portal36](images/4e965749ff71178af8873bc91f9fe525.png) ](images/4e965749ff71178af8873bc91f9fe525.png#lightbox)
5. Select **Per-setting status** to see the status. 5. Select **Per-setting status** to see the status.
@ -360,7 +361,7 @@ To confirm that the configuration policy has been applied to your test device, f
>This view is very useful to identify any settings that conflict with another policy. >This view is very useful to identify any settings that conflict with another policy.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> [ ![Image of Microsoft Endpoint Manager portal](images/42acc69d0128ed09804010bdbdf0a43c.png) ](images/42acc69d0128ed09804010bdbdf0a43c.png#lightbox) > [ ![Image of Microsoft Endpoint Manager portal37](images/42acc69d0128ed09804010bdbdf0a43c.png) ](images/42acc69d0128ed09804010bdbdf0a43c.png#lightbox)
### Endpoint detection and response ### Endpoint detection and response
@ -369,13 +370,13 @@ To confirm that the configuration policy has been applied to your test device, f
Protection service should not be started. Protection service should not be started.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> [ ![Image of Services panel](images/b418a232a12b3d0a65fc98248dbb0e31.png) ](images/b418a232a12b3d0a65fc98248dbb0e31.png#lightbox) > [ ![Image of Services panel1](images/b418a232a12b3d0a65fc98248dbb0e31.png) ](images/b418a232a12b3d0a65fc98248dbb0e31.png#lightbox)
2. After the configuration has been applied, the Defender for Endpoint 2. After the configuration has been applied, the Defender for Endpoint
Protection Service should be started. Protection Service should be started.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> [ ![Image of Services panel](images/a621b699899f1b41db211170074ea59e.png) ](images/a621b699899f1b41db211170074ea59e.png#lightbox) > [ ![Image of Services panel2](images/a621b699899f1b41db211170074ea59e.png) ](images/a621b699899f1b41db211170074ea59e.png#lightbox)
3. After the services are running on the device, the device appears in Microsoft 3. After the services are running on the device, the device appears in Microsoft
Defender Security Center. Defender Security Center.
@ -389,7 +390,7 @@ To confirm that the configuration policy has been applied to your test device, f
manage the settings as shown below. manage the settings as shown below.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of setting page](images/88efb4c3710493a53f2840c3eac3e3d3.png) > ![Image of setting page1](images/88efb4c3710493a53f2840c3eac3e3d3.png)
2. After the policy has been applied, you should not be able to manually manage 2. After the policy has been applied, you should not be able to manually manage
the settings. the settings.
@ -399,7 +400,7 @@ To confirm that the configuration policy has been applied to your test device, f
> **Turn on real-time protection** are being shown as managed. > **Turn on real-time protection** are being shown as managed.
> [!div class="mx-imgBorder"] > [!div class="mx-imgBorder"]
> ![Image of setting page](images/9341428b2d3164ca63d7d4eaa5cff642.png) > ![Image of setting page2](images/9341428b2d3164ca63d7d4eaa5cff642.png)
### Attack Surface Reduction – Attack surface reduction rules ### Attack Surface Reduction – Attack surface reduction rules
@ -414,13 +415,13 @@ To confirm that the configuration policy has been applied to your test device, f
> >
> AttackSurfaceReductionRules_Ids: > AttackSurfaceReductionRules_Ids:
![Image of command line](images/cb0260d4b2636814e37eee427211fe71.png) ![Image of command line1](images/cb0260d4b2636814e37eee427211fe71.png)
3. After applying the policy on a test device, open a PowerShell Windows and type `Get-MpPreference`. 3. After applying the policy on a test device, open a PowerShell Windows and type `Get-MpPreference`.
4. This should respond with the following lines with content as shown below: 4. This should respond with the following lines with content as shown below:
![Image of command line](images/619fb877791b1fc8bc7dfae1a579043d.png) ![Image of command line2](images/619fb877791b1fc8bc7dfae1a579043d.png)
### Attack Surface Reduction – Web Protection ### Attack Surface Reduction – Web Protection
@ -429,11 +430,11 @@ To confirm that the configuration policy has been applied to your test device, f
2. This should respond with a 0 as shown below. 2. This should respond with a 0 as shown below.
![Image of command line](images/196a8e194ac99d84221f405d0f684f8c.png) ![Image of command line3](images/196a8e194ac99d84221f405d0f684f8c.png)
3. After applying the policy, open a PowerShell Windows and type 3. After applying the policy, open a PowerShell Windows and type
`(Get-MpPreference).EnableNetworkProtection`. `(Get-MpPreference).EnableNetworkProtection`.
4. This should respond with a 1 as shown below. 4. This should respond with a 1 as shown below.
![Image of command line](images/c06fa3bbc2f70d59dfe1e106cd9a4683.png) ![Image of command line4](images/c06fa3bbc2f70d59dfe1e106cd9a4683.png)

11
windows/security/threat-protection/microsoft-defender-atp/onboarding-notification.md
View File

@ -23,9 +23,12 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
@ -180,8 +183,8 @@ You'll need to have access to:
11. Under **Condition**, add the following expression: "length(body('Get_items')?['value'])" and set the condition to equal to 0. 11. Under **Condition**, add the following expression: "length(body('Get_items')?['value'])" and set the condition to equal to 0.
![Image of apply to each condition](images/apply-to-each-value.png) ![Image of apply to each condition](images/apply-to-each-value.png)
![Image of condition](images/conditions-2.png) ![Image of condition1](images/conditions-2.png)
![Image of condition](images/condition3.png) ![Image of condition2](images/condition3.png)
![Image of send email](images/send-email.png) ![Image of send email](images/send-email.png)
## Alert notification ## Alert notification

5
windows/security/threat-protection/microsoft-defender-atp/onboarding.md
View File

@ -25,9 +25,12 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
Learn about the various phases of deploying Microsoft Defender for Endpoint and how to configure the capabilities within the solution. Learn about the various phases of deploying Microsoft Defender for Endpoint and how to configure the capabilities within the solution.
Deploying Defender for Endpoint is a three-phase process: Deploying Defender for Endpoint is a three-phase process:

6
windows/security/threat-protection/microsoft-defender-atp/overview-attack-surface-reduction.md
View File

@ -24,10 +24,12 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
Help reduce your attack surfaces, by minimizing the places where your organization is vulnerable to cyberthreats and attacks. Use the following resources to configure protection for the devices and applications in your organization. Help reduce your attack surfaces, by minimizing the places where your organization is vulnerable to cyberthreats and attacks. Use the following resources to configure protection for the devices and applications in your organization.

6
windows/security/threat-protection/microsoft-defender-atp/overview-custom-detections.md
View File

@ -24,7 +24,11 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
With custom detections, you can proactively monitor for and respond to various events and system states, including suspected breach activity and misconfigured devices. You can do this with customizable detection rules that automatically trigger alerts and response actions. With custom detections, you can proactively monitor for and respond to various events and system states, including suspected breach activity and misconfigured devices. You can do this with customizable detection rules that automatically trigger alerts and response actions.

4
windows/security/threat-protection/microsoft-defender-atp/overview-endpoint-detection-response.md
View File

@ -25,8 +25,10 @@ ms.technology: mde
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
Defender for Endpoint endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. Defender for Endpoint endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats.

6
windows/security/threat-protection/microsoft-defender-atp/overview-hardware-based-isolation.md
View File

@ -22,8 +22,12 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
Hardware-based isolation helps protect system integrity in Windows 10 and is integrated with Microsoft Defender for Endpoint. Hardware-based isolation helps protect system integrity in Windows 10 and is integrated with Microsoft Defender for Endpoint.

20
windows/security/threat-protection/microsoft-defender-atp/partner-applications.md
View File

@ -24,9 +24,11 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
Defender for Endpoint supports third-party applications to help enhance the detection, investigation, and threat intelligence capabilities of the platform. Defender for Endpoint supports third-party applications to help enhance the detection, investigation, and threat intelligence capabilities of the platform.
@ -55,7 +57,7 @@ Logo |Partner name | Description
![Image of Elastic security logo](images/elastic-security-logo.png) | [Elastic Security](https://go.microsoft.com/fwlink/?linkid=2139303) | Elastic Security is a free and open solution for preventing, detecting, and responding to threats ![Image of Elastic security logo](images/elastic-security-logo.png) | [Elastic Security](https://go.microsoft.com/fwlink/?linkid=2139303) | Elastic Security is a free and open solution for preventing, detecting, and responding to threats
![Image of IBM QRadar logo](images/ibm-qradar-logo.png) | [IBM QRadar](https://go.microsoft.com/fwlink/?linkid=2113903) | Configure IBM QRadar to collect detections from Defender for Endpoint ![Image of IBM QRadar logo](images/ibm-qradar-logo.png) | [IBM QRadar](https://go.microsoft.com/fwlink/?linkid=2113903) | Configure IBM QRadar to collect detections from Defender for Endpoint
![Image of Micro Focus ArcSight logo](images/arcsight-logo.png) | [Micro Focus ArcSight](https://go.microsoft.com/fwlink/?linkid=2113548) | Use Micro Focus ArcSight to pull Defender for Endpoint detections ![Image of Micro Focus ArcSight logo](images/arcsight-logo.png) | [Micro Focus ArcSight](https://go.microsoft.com/fwlink/?linkid=2113548) | Use Micro Focus ArcSight to pull Defender for Endpoint detections
![Image of RSA NetWitness logo](images/rsa-netwitness-logo.png) | [RSA NetWitness](https://go.microsoft.com/fwlink/?linkid=2118566) | Stream Defender for Endpoint Alerts to RSA NetWitness leveraging Microsoft Graph Security API ![Image of RSA NetWitness logo](images/rsa-netwitness-logo.png) | [RSA NetWitness](https://go.microsoft.com/fwlink/?linkid=2118566) | Stream Defender for Endpoint Alerts to RSA NetWitness using Microsoft Graph Security API
![Image of SafeBreach logo](images/safebreach-logo.png) | [SafeBreach](https://go.microsoft.com/fwlink/?linkid=2114114)| Gain visibility into Defender for Endpoint security events that are automatically correlated with SafeBreach simulations ![Image of SafeBreach logo](images/safebreach-logo.png) | [SafeBreach](https://go.microsoft.com/fwlink/?linkid=2114114)| Gain visibility into Defender for Endpoint security events that are automatically correlated with SafeBreach simulations
![Image of Skybox Vulnerability Control logo](images/skybox-logo.png) | [Skybox Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2127467) | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network, and threat context to uncover your riskiest vulnerabilities ![Image of Skybox Vulnerability Control logo](images/skybox-logo.png) | [Skybox Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2127467) | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network, and threat context to uncover your riskiest vulnerabilities
![Image of Splunk logo](images/splunk-logo.png) | [Splunk](https://go.microsoft.com/fwlink/?linkid=2129805) | The Defender for Endpoint Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk ![Image of Splunk logo](images/splunk-logo.png) | [Splunk](https://go.microsoft.com/fwlink/?linkid=2129805) | The Defender for Endpoint Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk
@ -98,25 +100,25 @@ Logo |Partner name | Description
Logo |Partner name | Description Logo |Partner name | Description
:---|:---|:--- :---|:---|:---
![Image of Bitdefender logo](images/bitdefender-logo.png)| [Bitdefender](https://go.microsoft.com/fwlink/?linkid=860032)| Bitdefender GravityZone is a layered next generation endpoint protection platform offering comprehensive protection against the full spectrum of sophisticated cyber threats ![Image of Bitdefender logo](images/bitdefender-logo.png)| [Bitdefender](https://go.microsoft.com/fwlink/?linkid=860032)| Bitdefender GravityZone is a layered next generation endpoint protection platform offering comprehensive protection against the full spectrum of sophisticated cyber threats
![Image of Better Mobile logo](images/bettermobile-logo.png) | [Better Mobile](https://go.microsoft.com/fwlink/?linkid=2086214)| AI based MTD solution to stop mobile threats & phishing. Private internet browsing to protect user privacy ![Image of Better Mobile logo](images/bettermobile-logo.png) | [Better Mobile](https://go.microsoft.com/fwlink/?linkid=2086214)| AI-based MTD solution to stop mobile threats & phishing. Private internet browsing to protect user privacy
![Image of Corrata logo](images/corrata-logo.png)| [Corrata](https://go.microsoft.com/fwlink/?linkid=2081148) | Mobile solution — Protect your mobile devices with granular visibility and control from Corrata ![Image of Corrata logo](images/corrata-logo.png)| [Corrata](https://go.microsoft.com/fwlink/?linkid=2081148) | Mobile solution that protects your mobile devices with granular visibility and control from Corrata
![Image of Lookout logo](images/lookout-logo.png)| [Lookout](https://go.microsoft.com/fwlink/?linkid=866935)| Get Lookout Mobile Threat Protection telemetry for Android and iOS mobile devices ![Image of Lookout logo](images/lookout-logo.png)| [Lookout](https://go.microsoft.com/fwlink/?linkid=866935)| Get Lookout Mobile Threat Protection telemetry for Android and iOS mobile devices
![Image of Symantec Endpoint Protection Mobile logo](images/symantec-logo.png) | [Symantec Endpoint Protection Mobile](https://go.microsoft.com/fwlink/?linkid=2090992)| SEP Mobile helps businesses predict, detect, and prevent security threats and vulnerabilities on mobile devices ![Image of Symantec Endpoint Protection Mobile logo](images/symantec-logo.png) | [Symantec Endpoint Protection Mobile](https://go.microsoft.com/fwlink/?linkid=2090992)| SEP Mobile helps businesses predict, detect, and prevent security threats and vulnerabilities on mobile devices
![Image of Zimperium logo](images/zimperium-logo.png)| [Zimperium](https://go.microsoft.com/fwlink/?linkid=2118044)|Extend your Defender for Endpoint to iOS and Android with Machine Learning-based Mobile Threat Defense ![Image of Zimperium logo](images/zimperium-logo.png)| [Zimperium](https://go.microsoft.com/fwlink/?linkid=2118044)|Extend your Defender for Endpoint to iOS and Android with Machine Learning-based Mobile Threat Defense
## Additional integrations ## More integrations
Logo |Partner name | Description Logo |Partner name | Description
:---|:---|:--- :---|:---|:---
![Image of Cyren Web Filter logo](images/cyren-logo.png)| [Cyren Web Filter](https://go.microsoft.com/fwlink/?linkid=2108221)| Enhance your Defender for Endpoint with advanced Web Filtering ![Image of Cyren Web Filter logo](images/cyren-logo.png)| [Cyren Web Filter](https://go.microsoft.com/fwlink/?linkid=2108221)| Enhance your Defender for Endpoint with advanced Web Filtering
![Image of Morphisec logo](images/morphisec-logo.png)| [Morphisec](https://go.microsoft.com/fwlink/?linkid=2086215)| Provides Moving Target Defense-powered advanced threat prevention and integrates forensics data directly into WD Security Center dashboards to help prioritize alerts, determine device at-risk score and visualize full attack timeline including internal memory information ![Image of Morphisec logo](images/morphisec-logo.png)| [Morphisec](https://go.microsoft.com/fwlink/?linkid=2086215)| Provides Moving Target Defense-powered advanced threat prevention. Integrates forensics data directly into WD Security Center dashboards to help prioritize alerts, determine device at-risk score and visualize full attack timeline including internal memory information
![Image of THOR Cloud logo](images/nextron-thor-logo.png)| [THOR Cloud](https://go.microsoft.com/fwlink/?linkid=862988)| Provides on-demand live forensics scans using a signature base with focus on persistent threats ![Image of THOR Cloud logo](images/nextron-thor-logo.png)| [THOR Cloud](https://go.microsoft.com/fwlink/?linkid=862988)| Provides on-demand live forensics scans using a signature base with focus on persistent threats
## SIEM integration ## SIEM integration
Defender for Endpoint supports SIEM integration through a variety of methods — specialized SIEM system interface with out of the box connectors, a generic alert API enabling custom implementations, and an action API enabling alert status management. For more information, see [Enable SIEM integration](enable-siem-integration.md). Defender for Endpoint supports SIEM integration through various of methods. This can include specialized SIEM system interface with out of the box connectors, a generic alert API enabling custom implementations, and an action API enabling alert status management. For more information, see [Enable SIEM integration](enable-siem-integration.md).
## Ticketing and IT service management ## Ticketing and IT service management
Ticketing solution integration helps to implement manual and automatic response processes. Defender for Endpoint can help to create tickets automatically when an alert is generated and resolve the alerts when tickets are closed using the alerts API. Ticketing solution integration helps to implement manual and automatic response processes. Defender for Endpoint can help to create tickets automatically when an alert is generated and resolve the alerts when tickets are closed using the alerts API.
@ -129,12 +131,12 @@ Defender for Endpoint offers unique automated investigation and remediation capa
Integrating the automated investigation and response capability with other solutions such as IDS and firewalls help to address alerts and minimize the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices. Integrating the automated investigation and response capability with other solutions such as IDS and firewalls help to address alerts and minimize the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices.
External alerts can be pushed into Defender for Endpoint and is presented side by side with additional device-based alerts from Defender for Endpoint. This view provides a full context of the alert — with the real process and the full story of attack. External alerts can be pushed to Defender for Endpoint. These alerts are shown side by side with additional device-based alerts from Defender for Endpoint. This view provides a full context of the alert and can reveal the full story of an attack.
## Indicators matching ## Indicators matching
You can use threat-intelligence from providers and aggregators to maintain and use indicators of compromise (IOCs). You can use threat-intelligence from providers and aggregators to maintain and use indicators of compromise (IOCs).
Defender for Endpoint allows you to integrate with such solutions and act on IoCs by correlating its rich telemetry and creating alerts when there's a match; leveraging prevention and automated response capabilities to block execution and take remediation actions when there's a match. Defender for Endpoint allows you to integrate with these solutions and act on IoCs by correlating rich telemetry to create alerts. You can also useg prevention and automated response capabilities to block execution and take remediation actions when there's a match.
Defender for Endpoint currently supports IOC matching and remediation for file and network indicators. Blocking is supported for file indicators. Defender for Endpoint currently supports IOC matching and remediation for file and network indicators. Blocking is supported for file indicators.

5
windows/security/threat-protection/microsoft-defender-atp/partner-integration.md
View File

@ -23,9 +23,10 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)

8
windows/security/threat-protection/microsoft-defender-atp/portal-overview.md
View File

@ -24,7 +24,9 @@ ms.technology: mde
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) >Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-portaloverview-abovefoldlink)
@ -81,7 +83,7 @@ Icon | Description
![Alert icon](images/alert-icon.png)| Alert – Indication of an activity correlated with advanced attacks. ![Alert icon](images/alert-icon.png)| Alert – Indication of an activity correlated with advanced attacks.
![Detection icon](images/detection-icon.png)| Detection – Indication of a malware threat detection. ![Detection icon](images/detection-icon.png)| Detection – Indication of a malware threat detection.
![Active threat icon](images/active-threat-icon.png)| Active threat – Threats actively executing at the time of detection. ![Active threat icon](images/active-threat-icon.png)| Active threat – Threats actively executing at the time of detection.
![Remediated icon](images/remediated-icon.png)| Remediated – Threat removed from the device. ![Remediated icon1](images/remediated-icon.png)| Remediated – Threat removed from the device.
![Not remediated icon](images/not-remediated-icon.png)| Not remediated – Threat not removed from the device. ![Not remediated icon](images/not-remediated-icon.png)| Not remediated – Threat not removed from the device.
![Thunderbolt icon](images/atp-thunderbolt-icon.png)| Indicates events that triggered an alert in the **Alert process tree**. ![Thunderbolt icon](images/atp-thunderbolt-icon.png)| Indicates events that triggered an alert in the **Alert process tree**.
![Device icon](images/atp-machine-icon.png)| Device icon ![Device icon](images/atp-machine-icon.png)| Device icon
@ -116,7 +118,7 @@ Icon | Description
![Terminated by system](images/terminated-by-system.png) | Automated investigation - terminated by system ![Terminated by system](images/terminated-by-system.png) | Automated investigation - terminated by system
![Pending icon](images/pending.png) | Automated investigation - pending ![Pending icon](images/pending.png) | Automated investigation - pending
![Running icon](images/running.png) | Automated investigation - running ![Running icon](images/running.png) | Automated investigation - running
![Remediated icon](images/remediated.png) | Automated investigation - remediated ![Remediated icon2](images/remediated.png) | Automated investigation - remediated
![Partially investigated icon](images/partially_remediated.png) | Automated investigation - partially remediated ![Partially investigated icon](images/partially_remediated.png) | Automated investigation - partially remediated
![Threat insights icon](images/tvm_bug_icon.png) | Threat & Vulnerability Management - threat insights ![Threat insights icon](images/tvm_bug_icon.png) | Threat & Vulnerability Management - threat insights
![Possible active alert icon](images/tvm_alert_icon.png) | Threat & Vulnerability Management - possible active alert ![Possible active alert icon](images/tvm_alert_icon.png) | Threat & Vulnerability Management - possible active alert

7
windows/security/threat-protection/microsoft-defender-atp/post-ti-indicator.md
View File

@ -21,16 +21,17 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) > Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
[!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)] [!include[Microsoft Defender for Endpoint API URIs for US Government](../../includes/microsoft-defender-api-usgov.md)]
[!include[Improve request performance](../../includes/improve-request-performance.md)] [!include[Improve request performance](../../includes/improve-request-performance.md)]
## API description ## API description
Submits or Updates new [Indicator](ti-indicator.md) entity. Submits or Updates new [Indicator](ti-indicator.md) entity.
<br>CIDR notation for IPs is not supported. <br>CIDR notation for IPs is not supported.

4
windows/security/threat-protection/microsoft-defender-atp/preferences-setup.md
View File

@ -24,7 +24,9 @@ ms.technology: mde
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-prefsettings-abovefoldlink) >Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-prefsettings-abovefoldlink)

7
windows/security/threat-protection/microsoft-defender-atp/prepare-deployment.md
View File

@ -25,12 +25,11 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
Deploying Defender for Endpoint is a three-phase process: Deploying Defender for Endpoint is a three-phase process:

5
windows/security/threat-protection/microsoft-defender-atp/preview-settings.md
View File

@ -21,9 +21,10 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-previewsettings-abovefoldlink) >Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-previewsettings-abovefoldlink)

6
windows/security/threat-protection/microsoft-defender-atp/preview.md
View File

@ -28,7 +28,11 @@ ms.technology: mde
>The preview versions are provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities. >The preview versions are provided without a service level agreement, and it's not recommended for production workloads. Certain features might not be supported or might have constrained capabilities.
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
The Defender for Endpoint service is constantly being updated to include new feature enhancements and capabilities. The Defender for Endpoint service is constantly being updated to include new feature enhancements and capabilities.

4
windows/security/threat-protection/microsoft-defender-atp/production-deployment.md
View File

@ -27,7 +27,9 @@ ms.technology: mde
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
Deploying Defender for Endpoint is a three-phase process: Deploying Defender for Endpoint is a three-phase process:

5
windows/security/threat-protection/microsoft-defender-atp/pull-alerts-using-rest-api.md
View File

@ -23,7 +23,10 @@ ms.technology: mde
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037) **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink) - Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)