mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-14 06:17:22 +00:00
Merge remote-tracking branch 'refs/remotes/origin/blurb' into rs2
This commit is contained in:
Joey Caparas
commit
ebaa19a05a
@ -21,7 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
The sensor health tile provides information on the individual endpoint’s ability to provide sensor data and communicate with the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues.
|
The sensor health tile provides information on the individual endpoint’s ability to provide sensor data and communicate with the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues.
|
||||||
|
|
||||||
|
|||||||
@ -21,8 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
## Pull alerts using supported security information and events management (SIEM) tools
|
## Pull alerts using supported security information and events management (SIEM) tools
|
||||||
Windows Defender ATP supports (SIEM) tools to pull alerts. Windows Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
|
Windows Defender ATP supports (SIEM) tools to pull alerts. Windows Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
|
||||||
|
|
||||||
|
|||||||
@ -21,8 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
You can define custom alert definitions and indicators of compromise (IOC) using the threat intelligence API. Creating custom threat intelligence alerts allows you to generate specific alerts that are applicable to your organization.
|
You can define custom alert definitions and indicators of compromise (IOC) using the threat intelligence API. Creating custom threat intelligence alerts allows you to generate specific alerts that are applicable to your organization.
|
||||||
|
|
||||||
## Before you begin
|
## Before you begin
|
||||||
|
|||||||
@ -21,8 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
The **Dashboard** displays a snapshot of:
|
The **Dashboard** displays a snapshot of:
|
||||||
|
|
||||||
- The latest active alerts on your network
|
- The latest active alerts on your network
|
||||||
|
|||||||
@ -21,8 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
Before you can create custom threat intelligence (TI) using REST API, you'll need to set up the custom threat intelligence application through the Windows Defender ATP portal.
|
Before you can create custom threat intelligence (TI) using REST API, you'll need to set up the custom threat intelligence application through the Windows Defender ATP portal.
|
||||||
|
|
||||||
1. In the navigation pane, select **Preference Setup** > **Threat intel API**.
|
1. In the navigation pane, select **Preference Setup** > **Threat intel API**.
|
||||||
|
|||||||
@ -21,7 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
With the Windows Defender ATP threat intelligence API, you can create custom threat intelligence alerts that can help you keep track of possible attack activities in your organization.
|
With the Windows Defender ATP threat intelligence API, you can create custom threat intelligence alerts that can help you keep track of possible attack activities in your organization.
|
||||||
|
|
||||||
|
|||||||
@ -21,8 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
Machines that are categorized as misconfigured or inactive can be flagged due to varying causes. This section provides some explanations as to what might have caused a machine to be categorized as inactive or misconfigured.
|
Machines that are categorized as misconfigured or inactive can be flagged due to varying causes. This section provides some explanations as to what might have caused a machine to be categorized as inactive or misconfigured.
|
||||||
|
|
||||||
## Inactive machines
|
## Inactive machines
|
||||||
|
|||||||
@ -21,8 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
This article provides PowerShell code examples for using the custom threat intelligence API.
|
This article provides PowerShell code examples for using the custom threat intelligence API.
|
||||||
|
|
||||||
These code examples demonstrate the following tasks:
|
These code examples demonstrate the following tasks:
|
||||||
|
|||||||
@ -21,7 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
The Windows Defender ATP service is constantly being updated to include new feature enhancements and capabilities.
|
The Windows Defender ATP service is constantly being updated to include new feature enhancements and capabilities.
|
||||||
|
|
||||||
|
|||||||
@ -21,7 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
## Before you begin
|
## Before you begin
|
||||||
You must [install](http://docs.python-requests.org/en/master/user/install/#install) the "[requests](http://docs.python-requests.org/en/master/)" python library.
|
You must [install](http://docs.python-requests.org/en/master/user/install/#install) the "[requests](http://docs.python-requests.org/en/master/)" python library.
|
||||||
|
|||||||
@ -21,7 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
Quickly respond to detected attacks by isolating machines or collecting an investigation package. After taking action on machines, you can check activity details on the Action center.
|
Quickly respond to detected attacks by isolating machines or collecting an investigation package. After taking action on machines, you can check activity details on the Action center.
|
||||||
|
|
||||||
|
|||||||
@ -21,7 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
You can take response actions on machines and files to quickly respond to detected attacks so that you can contain or reduce and prevent further damage caused by malicious attackers in your organization.
|
You can take response actions on machines and files to quickly respond to detected attacks so that you can contain or reduce and prevent further damage caused by malicious attackers in your organization.
|
||||||
|
|
||||||
|
|||||||
@ -21,8 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
Advanced cybersecurity attacks comprise of multiple complex malicious events, attributes, and contextual information. Identifying and deciding which of these activities qualify as suspicious can be a challenging task. Your knowledge of known attributes and abnormal activities specific to your industry is fundamental in knowing when to call an observed behavior as suspicious.
|
Advanced cybersecurity attacks comprise of multiple complex malicious events, attributes, and contextual information. Identifying and deciding which of these activities qualify as suspicious can be a challenging task. Your knowledge of known attributes and abnormal activities specific to your industry is fundamental in knowing when to call an observed behavior as suspicious.
|
||||||
|
|
||||||
With Windows Defender ATP, you can create custom threat alerts that can help you keep track of possible attack activities in your organization. You can flag suspicious events to piece together clues and possibly stop an attack chain. These custom threat alerts will only appear in your organization and will flag events that you set it to track.
|
With Windows Defender ATP, you can create custom threat alerts that can help you keep track of possible attack activities in your organization. You can flag suspicious events to piece together clues and possibly stop an attack chain. These custom threat alerts will only appear in your organization and will flag events that you set it to track.
|
||||||
|
|||||||
@ -21,7 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
You might need to troubleshoot issues while using the custom threat intelligence feature.
|
You might need to troubleshoot issues while using the custom threat intelligence feature.
|
||||||
|
|
||||||
|
|||||||
@ -21,8 +21,6 @@ localizationpriority: high
|
|||||||
- Windows 10 Pro Education
|
- Windows 10 Pro Education
|
||||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||||
|
|
||||||
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
|
||||||
|
|
||||||
Understand threat intelligence concepts, then enable the custom threat intelligence application so that you can proceed to create custom threat intelligence alerts that are specific to your organization.
|
Understand threat intelligence concepts, then enable the custom threat intelligence application so that you can proceed to create custom threat intelligence alerts that are specific to your organization.
|
||||||
|
|
||||||
You can use the code examples to guide you in creating calls to the custom threat intelligence API.
|
You can use the code examples to guide you in creating calls to the custom threat intelligence API.
|
||||||
|
|||||||
Loading…
x
Reference in New Issue
Block a user