mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-15 06:47:21 +00:00
Update configure-microsoft-threat-experts.md
This commit is contained in:
parent
67a7201b65
commit
d97a008117
@ -37,14 +37,12 @@ ms.technology: mde
|
||||
|
||||
Ensure that you have Defender for Endpoint deployed in your environment with devices enrolled, and not just on a laboratory set-up.
|
||||
|
||||
Defender for Endpoint customers need to apply for the Microsoft Threat Experts managed threat hunting service to get proactive Targeted Attack Notifications and to collaborate with experts on demand. Experts on Demand is an add-on service. Targeted Attack Notifications are always included after you have been accepted into Microsoft Threat Experts managed threat hunting service.
|
||||
If you're a Defender for Endpoint customer, you need to apply for Microsoft Threat Experts - Targeted Attack Notifications to get special insights and analysis that help identify the most critical threats so you can respond to them quickly. Apply for Microsoft Threat Experts - Experts on Demand if you want to consult with our threat experts on relevant detections and adversaries.
|
||||
|
||||
If you are not enrolled yet and would like to experience its benefits, go to **Settings** > **General** > **Advanced features** > **Microsoft Threat Experts** to apply. Once accepted, you will get the benefits of Targeted Attack Notifications, and start a 90-day trial of Experts on Demand. Contact your Microsoft representative to get a full Experts on-Demand subscription.
|
||||
## Apply for Microsoft Threat Experts - Targeted Attack Notifications service
|
||||
If you're already a Defender for Endpoint customer, you can apply through the Microsoft Defender Security Center.
|
||||
|
||||
## Register to Microsoft Threat Experts managed threat hunting service
|
||||
If you're already a Defender for Endpoint customer, you can apply through the Microsoft Defender for Endpoint portal.
|
||||
|
||||
1. From the navigation pane, go to **Settings > General > Advanced features > Microsoft Threat Experts**.
|
||||
1. From the navigation pane, go to **Settings > General > Advanced features > Microsoft Threat Experts - Targeted Attack Notifications**.
|
||||
|
||||
2. Click **Apply**.
|
||||
|
||||
@ -58,7 +56,7 @@ If you're already a Defender for Endpoint customer, you can apply through the Mi
|
||||
|
||||

|
||||
|
||||
6. From the navigation pane, go to **Settings** > **General** > **Advanced features** to turn the **Threat Experts** toggle on. Click **Save preferences**.
|
||||
6. From the navigation pane, go to **Settings** > **General** > **Advanced features** to turn the **Microsoft Threat Experts - Targeted Attack Notification** toggle on. Click **Save preferences**.
|
||||
|
||||
## Receive targeted attack notification from Microsoft Threat Experts
|
||||
You can receive targeted attack notification from Microsoft Threat Experts through the following medium:
|
||||
@ -77,13 +75,15 @@ You'll start receiving targeted attack notification from Microsoft Threat Expert
|
||||
|
||||
2. From the dashboard, select the same alert topic that you got from the email, to view the details.
|
||||
|
||||
## Apply for Microsoft Threat Experts - Experts on Demand
|
||||
If you're already a Defender for Endpoint customer, you can contact your Microsoft representative to subscribe to Microsoft Threat Experts - Experts on Demand.
|
||||
|
||||
## Consult a Microsoft threat expert about suspicious cybersecurity activities in your organization
|
||||
You can partner with Microsoft Threat Experts who can be engaged directly from within the Microsoft Defender Security Center for timely and accurate response. Experts provide insights to better understand complex threats, targeted attack notifications that you get, or if you need more information about the alerts, a potentially compromised device, or a threat intelligence context that you see on your portal dashboard.
|
||||
|
||||
> [!NOTE]
|
||||
> - Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details.
|
||||
> - You will need to have the "Manage security settings" permission in the Security Center portal to be able to submit a "Consult a threat expert" inquiry.
|
||||
> - You need to have the **Manage security settings** permission in the Security Center portal to be able to submit a "Consult a threat expert" inquiry.
|
||||
|
||||
1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or device is in view before you send an investigation request.
|
||||
|
||||
@ -106,7 +106,7 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w
|
||||
4. Enter the email address that you'd like to use to correspond with Microsoft Threat Experts.
|
||||
|
||||
> [!NOTE]
|
||||
> Customers with Premier Support subscription mapped to their Office 365 license can track the status of their Experts on Demand cases through Microsoft Services Hub.
|
||||
> If your Premier Support subscription is mapped to your Microsoft Defender for Office 365 license, you can track the status of your Experts on Demand cases through Microsoft Services Hub.
|
||||
|
||||
Watch this video for a quick overview of the Microsoft Services Hub.
|
||||
|
||||
@ -114,7 +114,7 @@ Watch this video for a quick overview of the Microsoft Services Hub.
|
||||
|
||||
|
||||
|
||||
## Sample investigation topics that you can consult with Microsoft Threat Experts
|
||||
## Sample investigation topics that you can consult with Microsoft Threat Experts - Experts on Demand
|
||||
|
||||
**Alert information**
|
||||
- We see a new type of alert for a living-off-the-land binary: [AlertID]. Can you tell us something more about this alert and how we can investigate further?
|
||||
|
Loading…
x
Reference in New Issue
Block a user