mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-16 15:27:22 +00:00
update all notes to reflect new guideline
This commit is contained in:
Joey Caparas
parent
5b00452b50
commit
ef7e0a63ad
@ -21,7 +21,8 @@ As a security operations team member, you can manage Windows Defender ATP alerts
|
||||
|
||||
To see a list of alerts, click any of the queues under the **Alerts queue** option in the navigation pane.
|
||||
|
||||
> **Note** By default, the queues are sorted from newest to oldest.
|
||||
> [!NOTE]
|
||||
> By default, the queues are sorted from newest to oldest.
|
||||
|
||||
The following table and screenshot demonstrate the main areas of the **Alerts queue**.
|
||||
|
||||
@ -57,7 +58,8 @@ There are three mechanisms to pivot the queue against:
|
||||
- **30 days**
|
||||
- **6 months**
|
||||
|
||||
> **Note** You can change the sort order (for example, from most recent to least recent) by clicking the sort order icon 
|
||||
> [!NOTE]
|
||||
> You can change the sort order (for example, from most recent to least recent) by clicking the sort order icon 
|
||||
|
||||
### Related topics
|
||||
- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -47,9 +47,9 @@ You need to add an application in your Azure Active Directory (AAD) tenant then
|
||||
|
||||
14. Open a web browser and connect to the following URL: `https://DataAccess-PRD.trafficmanager.net:444/api/FetchToken?clientId=f7c1acd8-0458-48a0-a662-dba6de049d1c&tenantId=<tenant ID>&clientSecret=1234`. An Azure login page appears.
|
||||
|
||||
> **Notes:**
|
||||
- Replace *tenant ID* with your actual tenant ID.
|
||||
- Keep the client secret as is. This is a dummy value, but the parameter must appear.
|
||||
> [!NOTE]
|
||||
> - Replace *tenant ID* with your actual tenant ID.
|
||||
> - Keep the client secret as is. This is a dummy value, but the parameter must appear.
|
||||
|
||||
15. Sign in with the credentials of a user from your tenant.
|
||||
|
||||
|
||||
@ -19,7 +19,8 @@ author: mjcaparas
|
||||
|
||||
<span style="color:#ED1C24;">[Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
|
||||
|
||||
> **Note** To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later.
|
||||
> [!NOTE]
|
||||
> To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later.
|
||||
|
||||
### Onboard endpoints
|
||||
1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
@ -69,7 +70,8 @@ You can use Group Policy (GP) to configure settings, such as settings for the sa
|
||||
### Offboard endpoints
|
||||
For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
|
||||
> **Note** Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
|
||||
1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
@ -101,7 +103,8 @@ With Group Policy there isn’t an option to monitor deployment of policies on t
|
||||
2. Click **Machines view**.
|
||||
3. Verify that endpoints are appearing.
|
||||
|
||||
> **Note** It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting.
|
||||
> [!NOTE]
|
||||
> It can take several days for endpoints to start showing on the **Machines view**. This includes the time it takes for the policies to be distributed to the endpoint, the time it takes before the user logs on, and the time it takes for the endpoint to start reporting.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -53,13 +53,15 @@ Health Status for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThrea
|
||||
Configuration for onboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Configuration/SampleSharing | Integer | 0 or 1 <br> Default value: 1 | Windows Defender ATP Sample sharing is enabled
|
||||
|
||||
|
||||
> **Note** The **Health Status for onboarded machines** policy uses read-only properties and can't be remediated.
|
||||
> [!NOTE]
|
||||
> The **Health Status for onboarded machines** policy uses read-only properties and can't be remediated.
|
||||
|
||||
### Offboard and monitor endpoints
|
||||
|
||||
For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
|
||||
> **Note** Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
|
||||
1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
@ -82,7 +84,8 @@ Offboarding | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/Offboarding |
|
||||
Health Status for offboarded machines | ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/SenseIsRunning | Boolean | FALSE |Windows Defender ATP service is not running
|
||||
| ./Device/Vendor/MSFT/WindowsAdvancedThreatProtection/HealthState/OnBoardingState | Integer | 0 | Offboarded from Windows Defender ATP
|
||||
|
||||
> **Note** The **Health Status for offboarded machines** policy uses read-only properties and can't be remediated.
|
||||
> [!NOTE]
|
||||
> The **Health Status for offboarded machines** policy uses read-only properties and can't be remediated.
|
||||
|
||||
|
||||
## Related topics
|
||||
|
||||
@ -24,7 +24,8 @@ author: mjcaparas
|
||||
## Configure endpoints using System Center Configuration Manager (current branch) version 1606
|
||||
System Center Configuration Manager (current branch) version 1606, currently in technical preview, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see [Support for Windows Defender Advanced Threat Protection service](https://technet.microsoft.com/en-us/library/mt706220.aspx#BKMK_ATP).
|
||||
|
||||
> **Note** If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later.
|
||||
> [!NOTE]
|
||||
> If you intend to use this deployment tool, ensure that you are on Windows 10 Insider Preview Build 14379 or later. This deployment method is only available from that build or later.
|
||||
|
||||
<span id="sccm1602"/>
|
||||
## Configure endpoints using System Center Configuration Manager (current branch) version 1602 or earlier versions
|
||||
@ -50,11 +51,12 @@ You can use System Center Configuration Manager’s existing functionality to cr
|
||||
|
||||
For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
|
||||
> **Note** Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
|
||||
1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
a. Click **Endpoint Management** on the **Navigation pane**.
|
||||
a. Click **Endpoint Management** on the **Navigation pane**.
|
||||
|
||||
b. Under **Endpoint offboarding** section, select **System Center Configuration Manager (current branch) version 1602 or earlier**, click **Download package**, and save the .zip file.
|
||||
|
||||
|
||||
@ -40,7 +40,8 @@ For for information on how you can manually validate that the endpoint is compli
|
||||
## Offboard endpoints using a local script
|
||||
For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
|
||||
> **Note** Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
|
||||
1. Get the offboarding package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
|
||||
@ -183,7 +183,8 @@ Verify the proxy configuration completed successfully, that WinHTTP can discover
|
||||
|
||||
If the any of the verification steps indicate a fail, then verify that you have performed the proxy configuration steps to enable server discovery and access to the service URLs.
|
||||
|
||||
> **Note** SenseSnapshot verifies connectivity for all URLs (including EU and U.S.), so you can ignore results of connectivity verification for irrelevant geo-locations.
|
||||
> [!NOTE]
|
||||
> SenseSnapshot verifies connectivity for all URLs (including EU and U.S.), so you can ignore results of connectivity verification for irrelevant geo-locations.
|
||||
|
||||
## Related topics
|
||||
- [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -35,7 +35,8 @@ You'll need to configure Splunk so that it can consume Windows Defender ATP aler
|
||||
2. Select **Search & Reporting**, then **Settings** > **Data inputs**.
|
||||
|
||||
3. Select **REST** under **Local inputs**.
|
||||
> **Note** This input will only appear after you install the [REST API Modular Input app](https://splunkbase.splunk.com/app/1546/).
|
||||
> [!NOTE]
|
||||
> This input will only appear after you install the [REST API Modular Input app](https://splunkbase.splunk.com/app/1546/).
|
||||
|
||||
4. Select **New**.
|
||||
|
||||
|
||||
@ -82,7 +82,8 @@ Threats are considered "active" if there is a very high probability that the mal
|
||||
|
||||
Clicking on any of these categories will navigate to the [Machines view](investigate-machines-windows-defender-advanced-threat-protection.md), filtered by the appropriate category. This lets you see a detailed breakdown of which machines have active malware detections, and how many threats were detected per machine.
|
||||
|
||||
> **Note** The **Machines with active malware detections** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
|
||||
> [!NOTE]
|
||||
> The **Machines with active malware detections** tile will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
|
||||
|
||||
### Related topics
|
||||
- [View and organize the Windows Defender Advanced Threat Protection Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -18,7 +18,8 @@ author: mjcaparas
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
This section covers some of the most frequently asked questions regarding privacy and data handling for Windows Defender ATP.
|
||||
> **Note** This document explains the data storage and privacy details related to Windows Defender ATP. For more information related to Windows Defender ATP and other products and services like Windows Defender and Windows 10, see [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement). See also [Windows 10 privacy FAQ](http://windows.microsoft.com/en-au/windows-10/windows-privacy-faq) for more information.
|
||||
> [!NOTE]
|
||||
> This document explains the data storage and privacy details related to Windows Defender ATP. For more information related to Windows Defender ATP and other products and services like Windows Defender and Windows 10, see [Microsoft Privacy Statement](https://privacy.microsoft.com/en-us/privacystatement). See also [Windows 10 privacy FAQ](http://windows.microsoft.com/en-au/windows-10/windows-privacy-faq) for more information.
|
||||
|
||||
## What data does Windows Defender ATP collect?
|
||||
|
||||
|
||||
@ -22,7 +22,8 @@ You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/en-US/
|
||||
|
||||
For example, if endpoints are not appearing in the **Machines view** list, you might need to look for event IDs on the endpoints. You can then use this table to determine further troubleshooting steps.
|
||||
|
||||
> **Note** It can take several days for endpoints to begin reporting to the Windows Defender ATP service.
|
||||
> [!NOTE]
|
||||
> It can take several days for endpoints to begin reporting to the Windows Defender ATP service.
|
||||
|
||||
**Open Event Viewer and find the Windows Defender ATP service event log:**
|
||||
|
||||
@ -33,7 +34,8 @@ For example, if endpoints are not appearing in the **Machines view** list, you m
|
||||
|
||||
a. You can also access the log by expanding **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE** and click on **Operational**.
|
||||
|
||||
> **Note** SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP.
|
||||
> [!NOTE]
|
||||
> SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP.
|
||||
|
||||
3. Events recorded by the service will appear in the log. See the following table for a list of events recorded by the service.
|
||||
|
||||
|
||||
@ -63,7 +63,8 @@ The alert spotlight feature helps ease investigations by highlighting alerts rel
|
||||
You can click on the machine link from the alert view to see the alerts related to the machine.
|
||||
|
||||
|
||||
> **Note** This shortcut is not available from the Incident graph machine links.
|
||||
> [!NOTE]
|
||||
> This shortcut is not available from the Incident graph machine links.
|
||||
|
||||
Alerts related to the machine are displayed under the **Alerts related to this machine** section.
|
||||
Clicking on an alert row takes you the to the date in which the alert was flagged on **Machine timeline**. This eliminates the need to manually filter and drag the machine timeline marker to when the alert was seen on that machine.
|
||||
|
||||
@ -60,11 +60,13 @@ Use the deep analysis feature to investigate the details of any file, usually du
|
||||
|
||||
In the file's page, **Submit for deep analysis** is enabled when the file is available in the Windows Defender ATP backend sample collection or if it was observed on a Windows 10 machine that supports submitting to deep analysis.
|
||||
|
||||
> **Note** Only files from Windows 10 can be automatically collected.
|
||||
> [!NOTE]
|
||||
> Only files from Windows 10 can be automatically collected.
|
||||
|
||||
You can also manually submit a sample through the [Malware Protection Center Portal](https://www.microsoft.com/en-us/security/portal/submission/submit.aspx) if the file was not observed on a Windows 10 machine, and wait for **Submit for deep analysis** button to become available.
|
||||
|
||||
> **Note** Due to backend processing flows in the Malware Protection Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Windows Defender ATP.
|
||||
> [!NOTE]
|
||||
> Due to backend processing flows in the Malware Protection Center Portal, there could be up to 10 minutes of latency between file submission and availability of the deep analysis feature in Windows Defender ATP.
|
||||
|
||||
When the sample is collected, Windows Defender ATP runs the file in is a secure environment and creates a detailed report of observed behaviors and associated artifacts, such as files dropped on machines, communication to IPs, and registry modifications.
|
||||
|
||||
@ -82,7 +84,8 @@ When the sample is collected, Windows Defender ATP runs the file in is a secure
|
||||
|
||||
A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done.
|
||||
|
||||
> **Note** Depending on machine availability, sample collection time can vary. There is a 1-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file.
|
||||
> [!NOTE]
|
||||
> Depending on machine availability, sample collection time can vary. There is a 1-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file.
|
||||
|
||||
## View deep analysis report
|
||||
|
||||
@ -122,7 +125,8 @@ HKLM\SOFTWARE\Policies\Microsoft\Sense\AllowSampleCollection
|
||||
5. Change the organizational unit through the Group Policy. For more information, see [Configure with Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md).
|
||||
6. If these steps do not resolve the issue, contact [winatp@microsoft.com](mailto:winatp@microsoft.com).
|
||||
|
||||
> **Note** If the value *AllowSampleCollection* is not available, the client will allow sample collection by default.
|
||||
> [!NOTE]
|
||||
> If the value *AllowSampleCollection* is not available, the client will allow sample collection by default.
|
||||
|
||||
### Related topics
|
||||
- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -40,7 +40,8 @@ The **Communication with IP in organization** section provides a chronological v
|
||||
|
||||
Details about the IP address are displayed, including: registration details (if available), reverse IPs (for example, domains), prevalence of machines in the organization that communicated with this IP Address (during selectable time period), and the machines in the organization that were observed communicating with this IP address.
|
||||
|
||||
> **Note** Search results will only be returned for IP addresses observed in communication with machines in the organization.
|
||||
> [!NOTE]
|
||||
> Search results will only be returned for IP addresses observed in communication with machines in the organization.
|
||||
|
||||
Use the search filters to define the search criteria. You can also use the timeline search box to filter the displayed results of all machines in the organization observed communicating with the IP address, the file associated with the communication and the last date observed.
|
||||
|
||||
|
||||
@ -35,7 +35,8 @@ The Machines view contains the following columns:
|
||||
- **Active Alerts** - the number of alerts reported by the machine by severity
|
||||
- **Active malware detections** - the number of active malware detections reported by the machine
|
||||
|
||||
> **Note** The **Active alerts** and **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
|
||||
> [!NOTE]
|
||||
> The **Active alerts** and **Active malware detections** filter column will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
|
||||
|
||||
Click any column header to sort the view in ascending or descending order.
|
||||
|
||||
@ -53,7 +54,8 @@ You can filter the view by the following time periods:
|
||||
- 30 days
|
||||
- 6 months
|
||||
|
||||
> **Note** When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period.
|
||||
> [!NOTE]
|
||||
> When you select a time period, the list will only display machines that reported within the selected time period. For example, selecting 1 day will only display a list of machines that reported telemetry within the last 24-hour period.
|
||||
|
||||
The threat category filter lets you filter the view by the following categories:
|
||||
|
||||
|
||||
@ -84,7 +84,8 @@ The context of the rule lets you tailor the queue to ensure that only alerts you
|
||||
1. Click the **Manage Alert** menu icon  on the heading of an existing alert.
|
||||
2. Choose the context for suppressing the alert.
|
||||
|
||||
> **Note** You cannot create a custom or blank suppression rule. You must start from an existing alert.
|
||||
> [!NOTE]
|
||||
> You cannot create a custom or blank suppression rule. You must start from an existing alert.
|
||||
|
||||
**See the list of suppression rules:**
|
||||
|
||||
@ -93,7 +94,8 @@ The context of the rule lets you tailor the queue to ensure that only alerts you
|
||||
|
||||
|
||||
|
||||
> **Note** You can also click **See rules** in the confirmation window that appears when you suppress an alert.
|
||||
> [!NOTE]
|
||||
> You can also click **See rules** in the confirmation window that appears when you suppress an alert.
|
||||
|
||||
The list of suppression rules shows all the rules that users in your organization have created.
|
||||
Each rule shows:
|
||||
|
||||
@ -40,7 +40,8 @@ Endpoints on your network must be running Windows 10, version 1607.
|
||||
The hardware requirements for Windows Defender ATP on endpoints is the same as those for Windows 10, version 1607.
|
||||
|
||||
|
||||
> **Note** Endpoints that are running Windows Server and mobile versions of Windows are not supported.
|
||||
> [!NOTE]
|
||||
> Endpoints that are running Windows Server and mobile versions of Windows are not supported.
|
||||
|
||||
Internet connectivity on endpoints is also required. For more information on additional proxy configuration settings see, [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) .
|
||||
|
||||
|
||||
@ -34,7 +34,8 @@ When you open the portal, you’ll see the main areas of the application:
|
||||
|
||||
|
||||
|
||||
> **Note** Malware related detections will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
|
||||
> [!NOTE]
|
||||
> Malware related detections will only appear if your endpoints are using [Windows Defender](https://technet.microsoft.com/en-us/library/mt622091(v=vs.85).aspx) as the default real-time protection antimalware product.
|
||||
|
||||
You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section.
|
||||
|
||||
|
||||
@ -63,7 +63,8 @@ You can check the event viewer for the onboarding script results.
|
||||
3. Look for an event from **WDATPOnboarding** event source.
|
||||
|
||||
If the script fails and the event is an error, you can check the event ID in the following table to help you troubleshoot the issue.
|
||||
> **Note** The following event IDs are specific to the onboarding script only.
|
||||
> [!NOTE]
|
||||
> The following event IDs are specific to the onboarding script only.
|
||||
|
||||
Event ID | Error Type | Resolution steps
|
||||
:---|:---|:---
|
||||
@ -82,7 +83,8 @@ Event ID | Error Type | Resolution steps
|
||||
|
||||
2. In the **Event Viewer (Local)** pane, expand **Applications and Services Logs** > **Microsoft** > **Windows** > **SENSE**.
|
||||
|
||||
> **Note** SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP.
|
||||
> [!NOTE]
|
||||
> SENSE is the internal name used to refer to the behavioral sensor that powers Windows Defender ATP.
|
||||
|
||||
3. Select **Operational** to load the log.
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user