From 67bb581bc655d31f37723a93542482667bc79f0e Mon Sep 17 00:00:00 2001 From: jirenugo <57419984+jirenugo@users.noreply.github.com> Date: Tue, 14 Jul 2020 01:23:19 -0700 Subject: [PATCH 01/57] Update credential-guard-manage.md --- .../credential-guard/credential-guard-manage.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 7e98cba59b..a046602eea 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -155,7 +155,7 @@ DG_Readiness_Tool_v3.6.ps1 -Ready - You should perform regular reviews of the PCs that have Windows Defender Credential Guard enabled. This can be done with security audit policies or WMI queries. Here's a list of WinInit event IDs to look for: - **Event ID 13** Windows Defender Credential Guard (LsaIso.exe) was started and will protect LSA credentials. - **Event ID 14** Windows Defender Credential Guard (LsaIso.exe) configuration: 0x1, 0 - - The first variable: 0x1 means Windows Defender Credential Guard is configured to run. 0x0 means it's not configured to run. + - The first variable: 0x1 means Windows Defender Credential Guard is configured to run. 0x0 means it's not configured to run. 0x2 means Windows Defender Credential Guard is configured to run with UEFI lock - The second variable: 0 means it's configured to run in protect mode. 1 means it's configured to run in test mode. This variable should always be 0. - **Event ID 15** Windows Defender Credential Guard (LsaIso.exe) is configured but the secure kernel is not running; continuing without Windows Defender Credential Guard. - **Event ID 16** Windows Defender Credential Guard (LsaIso.exe) failed to launch: \[error code\] From 8d5aefa6bf00959945fe756b7498b6d5250ece13 Mon Sep 17 00:00:00 2001 From: Ben McGarry <9434920+BenMcGarry@users.noreply.github.com> Date: Mon, 24 Aug 2020 15:06:41 +0100 Subject: [PATCH 02/57] Update WDAC hunting query Existing query does not appear to work within WDATP Advanced hunting, this updates the query to return the expected result. --- ...ation-control-events-centrally-using-advanced-hunting.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md index 3b0e313266..19bcd021e5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md +++ b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md @@ -30,10 +30,10 @@ This capability is supported beginning with Windows version 1607. Here is a simple example query that shows all the WDAC events generated in the last seven days from machines being monitored by Microsoft Defender ATP: ``` -MiscEvents -| where EventTime > ago(7d) and +DeviceEvents +| where Timestamp > ago(7d) and ActionType startswith "AppControl" -| summarize Machines=dcount(ComputerName) by ActionType +| summarize Machines=dcount(DeviceName) by ActionType | order by Machines desc ``` From 2b6ec3393ea3b7f2f3d0b7634a91cf02fcffb7cc Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Tue, 25 Aug 2020 21:02:02 +0500 Subject: [PATCH 03/57] Update advanced-security-audit-policy-settings.md --- .../auditing/advanced-security-audit-policy-settings.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md index e36022563e..1ce7884399 100644 --- a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md @@ -64,7 +64,6 @@ Detailed Tracking security policy settings and audit events can be used to monit - [Audit Process Creation](audit-process-creation.md) - [Audit Process Termination](audit-process-termination.md) - [Audit RPC Events](audit-rpc-events.md) -- [Audit Credential Validation](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-credential-validation) - [Audit Token Right Adjusted](https://docs.microsoft.com/windows/security/threat-protection/auditing/audit-token-right-adjusted) ## DS Access From e546ca6030efa9b71ecec7af3ac70c3c1c379927 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Sun, 30 Aug 2020 11:33:19 +0500 Subject: [PATCH 04/57] Update credential-guard-requirements.md --- .../credential-guard/credential-guard-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 25d125585e..8e3b5ae6a1 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -98,7 +98,7 @@ The following tables describe baseline protections, plus protections for improve | Hardware: **Trusted Platform Module (TPM)** |  **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.
[TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations) | A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. | | Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)| UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. | | Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).| UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. | -| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 Enterprise, Windows 10 Education, Windows Server 2016, or Windows 10 IoT Enterprise

Important:
Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard.

|Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. | +| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 or Windows Server 2016

Important:
Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard.

|Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. | > [!IMPORTANT] > The following tables list additional qualifications for improved security. We strongly recommend meeting the additional qualifications to significantly strengthen the level of security that Windows Defender Credential Guard can provide. From 1f41afd14c95b11e9bb5bad0959d07ad544088c5 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Mon, 31 Aug 2020 14:32:30 +0500 Subject: [PATCH 05/57] Update windows/security/identity-protection/credential-guard/credential-guard-requirements.md Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com> --- .../credential-guard/credential-guard-requirements.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md index 8e3b5ae6a1..cdf9c3ec9a 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-requirements.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-requirements.md @@ -98,7 +98,7 @@ The following tables describe baseline protections, plus protections for improve | Hardware: **Trusted Platform Module (TPM)** |  **Requirement**: TPM 1.2 or TPM 2.0, either discrete or firmware.
[TPM recommendations](https://technet.microsoft.com/itpro/windows/keep-secure/tpm-recommendations) | A TPM provides protection for VBS encryption keys that are stored in the firmware. This helps protect against attacks involving a physically present user with BIOS access. | | Firmware: **UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot** | **Requirements**: See the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot)| UEFI Secure Boot helps ensure that the device boots only authorized code. This can prevent boot kits and root kits from installing and persisting across reboots. | | Firmware: **Secure firmware update process** | **Requirements**: UEFI firmware must support secure firmware update found under the following Windows Hardware Compatibility Program requirement: [System.Fundamentals.Firmware.UEFISecureBoot](https://msdn.microsoft.com/library/windows/hardware/dn932805.aspx#system-fundamentals-firmware-uefisecureboot).| UEFI firmware just like software can have security vulnerabilities that, when found, need to be patched through firmware updates. Patching helps prevent root kits from getting installed. | -| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 or Windows Server 2016

Important:
Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard.

|Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. | +| Software: Qualified **Windows operating system** | **Requirement**: Windows 10 or Windows Server 2016.

Important:
Windows Server 2016 running as a domain controller does not support Windows Defender Credential Guard.

|Support for VBS and for management features that simplify configuration of Windows Defender Credential Guard. | > [!IMPORTANT] > The following tables list additional qualifications for improved security. We strongly recommend meeting the additional qualifications to significantly strengthen the level of security that Windows Defender Credential Guard can provide. From 032a7518c5047cdcacbab7c2202ae93ee1101351 Mon Sep 17 00:00:00 2001 From: Mark Wodrich Date: Thu, 3 Sep 2020 16:54:44 -0700 Subject: [PATCH 06/57] Update StackPivot compatibility considerations --- .../microsoft-defender-atp/exploit-protection-reference.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md index d8f35500f4..388335525b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md +++ b/windows/security/threat-protection/microsoft-defender-atp/exploit-protection-reference.md @@ -667,7 +667,7 @@ Compatibility issues are uncommon. Applications which depend on replacing Window ### Description -The *validate stack integrity (StackPivot) mitigation helps protect against the Stack Pivot attack, a ROP attack where an attacker creates a fake stack in heap memory, and then tricks the application into returning into the fake stack which controls the flow of execution. +The *validate stack integrity (StackPivot)* mitigation helps protect against the Stack Pivot attack, a ROP attack where an attacker creates a fake stack in heap memory, and then tricks the application into returning into the fake stack which controls the flow of execution. This mitigation intercepts a number of Windows APIs, and inspects the value of the stack pointer. If the address of the stack pointer does not fall between the bottom and the top of the stack, then an event is recorded and, if not in audit mode, the process will be terminated. @@ -710,7 +710,10 @@ The APIs intercepted by this mitigation are: ### Compatibility considerations -Compatibility issues are uncommon. Applications which are leveraging fake stacks will be impacted, and there is also a small risk of revealing subtle timing bugs in multi-threaded applications. +Applications which are leveraging fake stacks will be impacted, and there is also a small risk of revealing subtle timing bugs in multi-threaded applications. +Applications which perform API interception, particularly security software, can cause compatibility problems with this mitigation. + +This mitigation is incompatible with the Arbitrary Code Guard mitigation. ### Configuration options From ae76541e4ff5c03ea8f69a10255ca577cc96713b Mon Sep 17 00:00:00 2001 From: Ben Watt <13239035+wattbt@users.noreply.github.com> Date: Fri, 4 Sep 2020 14:09:05 +0100 Subject: [PATCH 07/57] Added missing final steps The steps for deploying the custom configuration profile did not finish as the previous section did, by explaining how the configuration profile should be assigned. I have added identical steps to the Systems Extension Policy before it. --- .../microsoft-defender-atp/mac-sysext-policies.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies.md b/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies.md index 3cd6ef23e7..a146b082c5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mac-sysext-policies.md @@ -279,3 +279,5 @@ To deploy this custom configuration profile: ![System extension in Intune screenshot](images/mac-system-extension-intune.png) +5. In the `Assignments` tab, assign this profile to **All Users & All devices**. +6. Review and create this configuration profile. From 5dc06cf3a417550fbb1029c45b1af4a9b9dbd2cc Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 4 Sep 2020 15:15:22 -0700 Subject: [PATCH 08/57] add partner table --- .../partner-applications.md | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index ee58dab8f6..3827f0fead 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -31,6 +31,36 @@ The support for third-party solutions help to further streamline, integrate, and Microsoft Defender ATP seamlessly integrates with existing security solutions - providing out of the box integration with SIEM, ticketing and IT service management solutions, managed security service providers (MSSP), IoC indicators ingestions and matching, automated device investigation and remediation based on external alerts, and integration with Security orchestration and automation response (SOAR) systems. +## Supported partner applications + +Partner name | Description |Category +:---|:---|:--- +|AzureSentinel | Stream alerts from Microsoft Defender Advanced Threat Protection into Azure Sentinel |Security information and analytics +|Elastic Security | Elastic Security is a free and open solution for preventing, detecting, and responding to threats.|Security information and analytics +|AttackIQ Platform | AttackIQ Platform validates MDATP is configured properly by launching continuous attacks safely on production assets|Security information and analytics +|Skybox® Vulnerability Control | Skybox® Vulnerability Control cuts through the noise of vulnerability management, correlating business, network threat context to uncover your riskiest vulnerabilities.|Security information and analytics +| Splunk | The Microsoft Defender ATP Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk |Security information and analytics +|IBM QRadar | Configure IBM QRadar to collect detections from Microsoft Defender ATP |Security information and analytics +|Cymulate | Correlate Defender ATP findings with simulated attacks to validate accurate detection and effective response actions |Security information and analytics +| HP ArcSight |Use HP ArcSight to pull Microsoft Defender ATP detections |Security information and analytics +|SafeBreach | Gain visibility into Microsoft Defender ATP security events that are automatically correlated with SafeBreach simulations|Security information and analytics +| RSA NetWitness| Steam Microsoft Defender ATP Alerts to RSA NetWitness leveraging Microsoft Graph Security API|Security information and analytics +| XM Cyber| Prioritize your response to an alert based on risk factors and high value assets.|Security information and analytics + Demisto, a Palo Alto Networks Company|Demisto integrates with Microsoft Defender ATP to enable security teams to orchestrate and automate endpoint security monitoring, enrichment and response|Orchestration and automation + |||Orchestration and automation + |||Orchestration and automation + |||Orchestration and automation + |||Orchestration and automation + |||Orchestration and automation + |||Orchestration and automation +Palo Alto Networks |Enrich your endpoint protection by extending Autofocus and other threat feeds to Microsoft Defender ATP using MineMeld|Threat intelligence +ThreatConnect | Alert and/or block on custom threat intelligence from ThreatConnect Playbooks using Microsoft Defender ATP connectors |Threat intelligence +MISP (Malware Information Sharing Platform) | Integrate threat indicators from the Open Source Threat Intelligence Sharing Platform into your Microsoft Defender ATP environment| Threat intelligence + |||Network security + ||| Cross platform +||| Additional integrations + ||| Manages security service providers + ## SIEM integration Microsoft Defender ATP supports SIEM integration through a variety of methods - specialized SIEM system interface with out of the box connectors, a generic alert API enabling custom implementations, and an action API enabling alert status management. For more information, see [Enable SIEM integration](enable-siem-integration.md). From 62c377cc7be3a952fae462aab379d368b83278b6 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 10 Sep 2020 15:59:38 -0700 Subject: [PATCH 09/57] char --- .../microsoft-defender-atp/partner-applications.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index 3827f0fead..8d7ecfb297 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -38,7 +38,7 @@ Partner name | Description |Category |AzureSentinel | Stream alerts from Microsoft Defender Advanced Threat Protection into Azure Sentinel |Security information and analytics |Elastic Security | Elastic Security is a free and open solution for preventing, detecting, and responding to threats.|Security information and analytics |AttackIQ Platform | AttackIQ Platform validates MDATP is configured properly by launching continuous attacks safely on production assets|Security information and analytics -|Skybox® Vulnerability Control | Skybox® Vulnerability Control cuts through the noise of vulnerability management, correlating business, network threat context to uncover your riskiest vulnerabilities.|Security information and analytics +|Skybox Vulnerability Control | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network threat context to uncover your riskiest vulnerabilities.|Security information and analytics | Splunk | The Microsoft Defender ATP Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk |Security information and analytics |IBM QRadar | Configure IBM QRadar to collect detections from Microsoft Defender ATP |Security information and analytics |Cymulate | Correlate Defender ATP findings with simulated attacks to validate accurate detection and effective response actions |Security information and analytics From aaa5974d73545b5e369bee8dc0221448f65e4cd3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Fri, 11 Sep 2020 15:37:46 -0700 Subject: [PATCH 10/57] update based on feeback --- .../microsoft-defender-atp/partner-applications.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index 8d7ecfb297..16bd018aee 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -31,7 +31,7 @@ The support for third-party solutions help to further streamline, integrate, and Microsoft Defender ATP seamlessly integrates with existing security solutions - providing out of the box integration with SIEM, ticketing and IT service management solutions, managed security service providers (MSSP), IoC indicators ingestions and matching, automated device investigation and remediation based on external alerts, and integration with Security orchestration and automation response (SOAR) systems. -## Supported partner applications +## Supported applications Partner name | Description |Category :---|:---|:--- @@ -85,4 +85,4 @@ Microsoft Defender ATP allows you to integrate with such solutions and act on Io Microsoft Defender ATP currently supports IOC matching and remediation for file and network indicators. Blocking is supported for file indicators. ## Support for non-Windows platforms -Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the portal and better protect your organization's network. This experience leverages on a third-party security products' sensor data giving you a unified experience. +Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the portal and better protect your organization's network. From b0e6671ccc3b523ce436b631830e781f70645ec5 Mon Sep 17 00:00:00 2001 From: Eddy Ng <57738387+WplusAzureAuto@users.noreply.github.com> Date: Mon, 14 Sep 2020 11:00:14 +0800 Subject: [PATCH 11/57] Update waas-delivery-optimization-setup.md Amended line 149 from Get-DeliveryOptimizationPerfSnap to Get-DeliveryOptimizationStatus, this command is validated from windows powershell to be the valid command that has -peerinfo switch --- windows/deployment/update/waas-delivery-optimization-setup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/waas-delivery-optimization-setup.md b/windows/deployment/update/waas-delivery-optimization-setup.md index a93a577f74..9cc82a5183 100644 --- a/windows/deployment/update/waas-delivery-optimization-setup.md +++ b/windows/deployment/update/waas-delivery-optimization-setup.md @@ -146,7 +146,7 @@ Using the `-Verbose` option returns additional information: - Bytes from CDN (the number of bytes received over HTTP) - Average number of peer connections per download  -**Starting in Windows 10, version 2004**, `Get-DeliveryOptimizationPerfSnap` has a new option `-PeerInfo` which returns a real-time list of the connected peers. +**Starting in Windows 10, version 2004**, `Get-DeliveryOptimizationStatus` has a new option `-PeerInfo` which returns a real-time list of the connected peers. Starting in Windows 10, version 1803, `Get-DeliveryOptimizationPerfSnapThisMonth` returns data similar to that from `Get-DeliveryOptimizationPerfSnap` but limited to the current calendar month. From b5ed97ba1d15db48f6943b000866ab7ecfd1b706 Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Mon, 14 Sep 2020 17:24:16 +0500 Subject: [PATCH 12/57] Update indicator-ip-domain.md --- .../microsoft-defender-atp/indicator-ip-domain.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md b/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md index 90e188b28e..5f42abda95 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md +++ b/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md @@ -46,6 +46,7 @@ It's important to understand the following prerequisites prior to creating indic > For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge leverages [Network Protection](network-protection.md) to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS). For all other processes, web protection scenarios leverage Network Protection for inspection and enforcement:
> NOTE: >- IP is supported for all three protocols +>- Only single IP addresses are supported (no CIDR blocks or IP ranges) >- Encrypted URLs (full path) can only be blocked on first party browsers >- Encrypted URLS (FQDN only) can be blocked outside of first party browsers >- Full URL path blocks can be applied on the domain level and all unencrypted URLs @@ -59,7 +60,7 @@ It's important to understand the following prerequisites prior to creating indic 2. Select the **IP addresses or URLs/Domains** tab. -3. Select **Add indicator**. +3. Select **Add item**. 4. Specify the following details: - Indicator - Specify the entity details and define the expiration of the indicator. @@ -72,4 +73,4 @@ It's important to understand the following prerequisites prior to creating indic - [Create indicators](manage-indicators.md) - [Create indicators for files](indicator-file.md) - [Create indicators based on certificates](indicator-certificates.md) -- [Manage indicators](indicator-manage.md) \ No newline at end of file +- [Manage indicators](indicator-manage.md) From 5323230175e3727a46039391198639abbcdd2a68 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 14 Sep 2020 10:30:51 -0700 Subject: [PATCH 13/57] Update indicator-ip-domain.md --- .../microsoft-defender-atp/indicator-ip-domain.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md b/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md index 5f42abda95..50c42b1fe9 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md +++ b/windows/security/threat-protection/microsoft-defender-atp/indicator-ip-domain.md @@ -1,4 +1,4 @@ ---- +--- title: Create indicators for IPs and URLs/domains ms.reviewer: description: Create indicators for IPs and URLs/domains that define the detection, prevention, and exclusion of entities. From beb0000a9072aa270e0b36af50c0e41754bbe62d Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 14 Sep 2020 16:50:55 -0700 Subject: [PATCH 14/57] logos and partner descriptions --- .../images/arcsight-logo.png | Bin 0 -> 2800 bytes .../images/attackiq-logo.png | Bin 0 -> 1445 bytes .../images/cymulate-logo.png | Bin 0 -> 3519 bytes .../images/elastic-security-logo.png | Bin 0 -> 3567 bytes .../images/ibm-qradar-logo.png | Bin 0 -> 7354 bytes .../images/sentinel-logo.png | Bin 0 -> 4439 bytes .../partner-applications.md | 42 ++++++++++++++++++ 7 files changed, 42 insertions(+) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/arcsight-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/attackiq-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/cymulate-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/elastic-security-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/ibm-qradar-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/sentinel-logo.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/arcsight-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/arcsight-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..5ec3542ebea6b2581b468a90d8f60b339cb9e72d GIT binary patch literal 2800 zcmc&$XIB%55)Cbc5K3rClqMYorMPsZB?MNCgd$B86{HD*bm;-5H$^}M1W`&9K|);! z1cHHGx*$bDZ!QuNfozcG%bxcm_QTAanKLtA?%X*y)dqtW0G|Q_0003iOQbD32D0q| z2*~yq-H|-(z!zxg91H+RDE@04R<;TZc9A#4>MDwNl}`|+DV@snVGn|{t&pbn5yiBU zs6hKKQhi-s^nk&De6?~MpD<*}(=Ii2or6!ul=FIpy+FzY@0p6;Gn4tr@+mogO_zf| zgA2hfh%2s8kQ`h=4ky@Op`?}LJ)ep+pPv~@-`XZ_Oc`4?D>$2&OXv;%9NZe5CvF@K zw`~N+u}XuLgUKl=vQUY+rtSFEzj8Qv&|opim=T#QnM)7V56=ALLte`WjiD>ndvW~9 zM2&DiE3oO#{ePFLP2d}o{~{rsOS&lV#%Jn%j4I=IS+k)^T`Y5|X|(8NofYgunu)DL z^^i^uIcV);%IMfw0)=AXRIB41V|17bqS0veGxryZS+&|3-Sl#V_n$+iK|7Lq_;(j( zN|jsBa{4C=o{8J^m>?eO1oH6q=%d%OtdZzzq}HGoSp@~|wY9aFtQNUTQcFuq^)9tA zb#r9@zyR9Er^b~}7lOcj{B;Ba_EHuP#RrzE>%zZ`Uld?6nf?9!q|M*_jO504IrY(g z+m1Gd#ol_yzcn^DUrzSD?@ba7E+xIO`lxdLycrgI#v)5{rpgJ)ow+-3PX>B>sfTB} z{&wOaXNGCjl>FigukK8X=z>m3{CMggUtI=^m>`R6MBuiJzsISytz4Sz;^jmvCe6LJH77^KoN$)c+)>|5@sMM?D^SbJi%-1 z^XKKS*BzRo+L7LVe&(K@Z)amLRp2T+Vh9icsV)*ujEmmkyR)4_a3d}Jc0r931`I`_3*$Q2=FdE0ksT5HcS65Ty955+3tG5?9Sg6URs;UYA zy!?_@X!Xq9-xv2#fDyegptb`sC0?$ zkr5$-l41GfKN$CcB1>EO;kO|IkB9qs^QR5R>O=inwA;v&+^#3O)e9fR*IT*w=YnMl zG2KGnr^hwdGz#_;(1`jX(}%NoPgSH09m*O_Hhbc-1QsSnezkcdMH#`n^KqVdLN{1b;mtG+0J9Ok>^r1@= zt#QWC4P>!hRFLMHg@w(^$#Jj47xC<1jH2ROF;P+TlM{}{*yBgb#iGz$JU--*)-wLJ z$uBh+Gh*D8q?VuH(d6P5N+1w?CaTBm?d_38m18on^KZ({lWij-+umjFG-zr4+#g*c zC$nepc-!b`qqlG0=2rUHJ2_dFmzQ6RU(?2aAs2dqc(rEtP4<7uAn+0+K zA@Ieo(mK(4duh^P?Q^u-2ndk6N*8)ip_?&3UtL@KJ>N4!bMfqnJa0Cif&*%IOrC+z z2U18&vR4zASGa=rrM%S#6DMPbL(6(Y0tGmrjYYoHMY_=S}4> z`Ka-ty`v-RDO^+=8rCi~+d_}W;{y$f3k!r`dZES4n3b#Ak|Cevk3tg~RliYOtgN<$XKT1fs+iwsa zlJ}f^;>OcISA!q#j+*e+i`C<&;a=RmCWbQg@DK|zkjj!Wob>zk-kBf_WBCofGL~U4 zZPix+{fvxsYK(wJ$HW{)-^kD`v{ph|Sls#ZsiKOSipj%=T3N635>iqu2TNXZqUy@< zcyLi=#k_Senc)lj~5b>QOnLLjauBAmBwKJFG8il6VpWi@EEFyVI@ahq0+ zYp*QkhOOgww+Fy-Q&lxJP&{5vP3^s-Bnn#}#R}*+Iasi02scr0X0&3t?1mWh*-9u9}2{yz4dnUa-7F-hlna6f{}%F0TmuA0&BzUd%N?mXh` ziehjSpWT-*48PYi>G5f6CR_I6o=$Y^w;ZppG*$|rm7JQT?Zrr6xEvAd9tHWJc=nXk z&xLryEe&8cjzFx4LQpg!)~(@BgwVSiyx85ZE>2;+W>~Rey&tzac8Bk=K~TGOB4=xB zOM-LVg+QUXaLwg){vHj8ln#VWWJ#ZTS;YA2=a-w8mn0M(6Hg*R;f9YOO4fy-#G4DX zm>bbXM@L6Dg2+8&%^f*qz7&(<3g01L4I<1!%?(T}fZ-Aof1Dh;VjUfm6M2Q?Hon(E zVKNH~=CpE88~dV20}5k}kzGxb5^O1%`youmC9$5W*2eidT(XdI21LHpQ0#eqzE`cy>C zsUEndaI z?zT_PG2lDdMcn_2t^Z6$nREvozJ9fW&b~p5wLAdH?=Y^EC`zMln(=JJK^t{*`s`*y)HD~7-$+>*V zm#HbOHHDL;HQJQMXtHFRFGFUsX_KUKyXXFgp6C5~zh2Mlm-qX5UeEK&3&La9o7kEF z0I(kCj|tZEIX%e6M*8h63G~;~TC#tb-n82F9}IB8J2iR}Lcs<2LMGRmSz7~*J0%+d zzz~DOpbw{9eJc(0uT1`~d!gt+1=4TRfYFoEMD&c%m|}b^w{>jGhs>Q62kh4MJ z2~F+fb`O3be1a1GCm%&CBeZyx*0F^@gR5D!IMZGG4mD*Zj=iFo~#}>vz)))XjXmr;6>B8{j)e7$#^Q87IN$oQ7mH;sTh}`!!jhEJ-!?%tKRX4qQ3 z8~c!+A+7ds{RhE}ntzii4?334jSLM9ZGf0>h10qiLlQ~in+LLZHxN8OS>fpD*fUPH z>1#__sGC)(LS!=8EjHV^LD4Zu_89ExIY?Piif`OvFwkwX_^weEv+YOH%g83}neH7j z)GgQ*&dj6t&!!x66$4RElqHu(=3cz8@WW!q7g7jK!%#EYfLvZEm&*@3aab)a8^glF z;4UuRa`{$iyt_ak2s(1)Z{2Gi0jeK>td@HnyH7T7b92LSE?m9*s5d?#Au1)shR^3W z4#xtS4<3NmZ`@GK%i3`@wblA?oDhh*d-p7eO`ELp4J+z-s>PG3sh-Nk1B@UYDLL6X zIy&0HL!~Iym3q3mt|@tzGdmk|2#>Gha#5g_8LhaoGG8i{o-((LB9S1+Io3=j^QlOL z&B(|QuDt8-hk_tTa4om+_DfAo)fvET)}15}fZpETn;Z_7NF=`CcBN~#Wvn@k-G?td zelVu$`blr<2WUu0$c$2Hpqa>Pym=E2dLxlpJRX{olvJ;CSrO1TKNSiwzP^UQZ2IKp|p&`E|X9Pl!1{wlQ!v%A5u`ylGaXtob7Ol#=#gZU51U9DerPN7gGdZ-JIh z&l&Pp!hHU^ia{->=KWf~y}-dZ%A~U_`-iVBb4O!5Q7bcvRS>36MexB6Wl8PeSlp5S bJ89YcS{2*Vx5$pAuUG)*i^tsgiIDv- += literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/cymulate-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/cymulate-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..daa2aef8f818f1bb19535a1e2ca4a0c54f9c324f GIT binary patch literal 3519 zcmchac|4Te-^UfVEjvY$rNr2`NyA{Q*|)KW?EB78!b~G;wuG^Ci(*L2knC%bgcuBl z24mlEVnnv_T=(<*`TYI+{c*1IdR^yy&-J~|`F!5z^-Z-f(`RMoXQrW{VKp?+g#&%) zzm1U|cz&DPHwHSUPy>eu8k#G&{%scw;iA8QmkbC)Q$26s&VF-_hHAqidD~fen2Eogz-?JAP_fhg* zV(l`{rXNO>?6J#}veT{Gzvz!v(?-8;a^lgIy>a7VhMG2}k0z&A?NPT5fI@ z%)u1)K*t8% zJ!LKJ%8#I0yPF~|3|1mziy*Y1{{Kz1yr`bZwHB7EnN>#jNZ{7+e|Tt!$-L@Ml>t+x z)W_?*q6JAwIHm-M%`MPgm=T>SZpq?CcV#OZW&Yp^BdaVF`a`c%;uXZTG@yS0-y^{} zIq`A@Han#^Fpmf(+sQafPmlGZsMI@uTdu$^_ki|>cNFA{Bctb^sBdLennNZg+$hK5 zCk8&#)GK9cXym0pbI+p=8N-fbTO%ga4CxECyXt>OsE40Tu0T(2W(nkRn0uc%roU!5 zmXY^80@dulH0Ov%>v^NnEcZ1##TE1}6n`?8D*ezcwi&gPnk3eA`Zv5Qjst`(fA=oU zS~797<QY2= z364oxr>x=iV{(>2g5SPV`XU5@K-2`!sBX6(-uL(SfAjXO`)IkLv_oxzFSx&YzG@h5 z)ImKC@cvQog%r|hs!Td`6UjDsW*};|p)PLqQ2=#R5?QP7WY^+ctk~M<(Bga@u4>lU z?a-S?*5}^K8tBMF#h!I&rHG@WBX;uu z`JsfnH_X$@Du;#s$sRkZ$x$q)Poo{*5TxSyokQi}FW2VanXI}Hq3^4e=DU3vXL9R$ zsIH)y9Fq9crwY9;X<-GW#57Q@rXCE%IZftDG zo93*ncwdpW|I8p1t7&N1SAE0j%$h5e&e_=+k{QuoJ@Za;3Ry6As`9-%XpX90l9T+i zCcgu%Tzc_CEC(Z6Op|ajJ8YaU>oryDm5agDdJppZ2Lz1#zRCUi?OREHetzG8fSddo ziYRKVk&#h>q8D>dPY=ykcZK^8=l{BhrpY!)&`Z0LZ6f9u80guZ#2Pr$a#@5fBO}8J zF{1b0xfNsc&NjQxlTXo;5tteufAL_4jGu0fkdTsE9D?rXGNN;zXThiiSsKSF$H$Lw zZF~J~hpr@LDckq1l$AkIE+#+|W%^m(TazC}a|~ZbuU!2}A{kZ^+75mO1Wwf^N?28J zuq7Lc<@_jAO7;a8wXRlKRl@Jx`?;#TbvwcP!KqCYm8f1DF%cBqxI{Xa!3LEeAT>db zRLZ!WF#)_>=SL`ya5B(H+H6tGGwR#e@OQAc2X&tA4NP~aM64K?5|(}wUF6sWAi@Fu z{+{xDxp!s|IV^M+n`_h%YZlF+^V(P0k|R!}2cA<_@%dAMw%d~*b?BdHMQ=B+u4vaU zLc$NWrbbsOefomYq9Kff-k(;PhJywFy*uNYrea-t<8y9 zL{vDDqqd^ruJWBb0}TzzD#+7^enl1U-@nhTERHIY27#X4)X&Tv@dbxCE>Q@ZqIXqg zhbf}k4cm8B3p-Hmna|BCQ-w6r-T2b^Z!?Fw64%p}c*Bf)Y4b z_`xYa7MZ(?y-FV6SfmHs$sKVp$(lO|=gNi#j891%roZ24VHZNnz@|%#d_4l13dAUQ ze4C>j0d}GcL9<56^gSG|ytAvOcU}0J8oS%W3&=W;^XA<-2wO?)=wUMcP?eq;^-R#` zW>J#m1EvM>CI1RPINZrZ`NeWKJ8bFOwU8gAOUsshyc5KTp38PM;mbx7)h_t$nbr$U zi>NjuJ$~RUaY{0&6&aY)Zx?5(6YhK}J6IAmlMQP3`*mEgX-=jofz!mc|>pgfn%~)SwA4?g$(}WwCl)}yJ6U=><`||>)o3i)z!s%J~hIe?n!KNkz&z;$J;6eac zQr$^aHO5GoIpJ801SXH+g9Hn1jqvdfi#Jc zs!%AvuiU)6uwQdp2^_gRyh?G$i0#gEWUPh|yT%{a#@RzF2^kqIpk8y>S*}}m5+`$_ zZ%`1nrKRXPG)lmaR^&}p)t6dn+Yk5jM7idBcwNfhzI~c;?M^r;s4;A9Sfn9vYBb1% z7+IVwge(9YzIRH&e?qLoF|yA6?;So(wnZxi5OLU7uh2h#-fIXUo2dzk7n&%>9q((5 zJEKl_dxc;J?&Mi@>z9^!=O(5)e_|O2vgA!6{EfGsvjYEnl0PsxGIclEgHTvMRh&)< z+loOtsueudWRx+N8v$p8LQFh7ZeqOLNXi-|S(?I{Ha3?Rzhx}u+1+>hn!?E_!l4aN zJbLp(BP0EjHUPf%n7;&=8aF3Cc>J3C;uJYy|2Ve8m@#qcEqK+(P-A-!P& zLuwQg{%hB&-n=QrViN%YvpEx^*Ip&3^e$T4+A2oxd7dI+-O230MXOlIg2iG@iomHN zI!W?TTlP`g)4*woTuHOEwfzR{^pBYb5wxqYrZC5M)?Wb5u%3hpQiW<7gdsX@QDv3ZdF+`_lEsCIcq-lQoIV_FLRNDkq#s+y`_Nd zU#%n?pY57FKdZ_V>}{ou;)Oy&3)C0Y(gAnPF`s9!Cqi zOC<4x@5>pz5alBk6ei|SZq-!a+Tu?_?%0};9_XN29u-sikEmA zd8e|xoUW5h-s~TQah+|WTZU7tOR~hk_s@{r{|sf@B*44zxk^ZVj~@B-lA19LyBrF; z9}#ARtmYUq4SuUp@{XaTo8035xKzx(UlS$b&8||qFc#X640ZRTzl`R%jJDVjmomHR zFE;mID+B&t$+4PHX&q=!KI}b{L`Ju$f3TQWw`TnPZzXdCTQoWOy`;5V1QcI1hI(eY JIBnPX{{b&4%ZdO1 literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/elastic-security-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/elastic-security-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..30352fe3b7be6d63b6f261aa7c94ab88cbfc46f6 GIT binary patch literal 3567 zcmb_fc_0)1`=2Ok=3Fdyt_YhPCB~$QX=~;Pm3t$(b40G3g`BzODn|?w?;p?mdEU?SzW#VUujlZG5k9os3Q@L%CTS;%j&o!o&aj4}7(Nj}kYIwnqbA?*FBDC8BZkizw% zP(O)@qDOD3vjLvv8Q03rpmOl2N$2bR+!_}RTzF{`OMGkhy=nM*t9zDJ_^a#CDNYzm zes17b#Un2@XOzWR)nKQ@wzC&$5Z*o-tv~l2WV-R!nc3o|v_sc5j;Rx|HWw$$-bPtb zW+}g!``ckAf40LuG^zp%P-y~2N{+#bUW$C{&!kl;AOGQGcADV0DwBE&(G;zz4tLQN zD>35+&YkdHEzBLLXo_b3jjgO_9z?|ztIUBa?KiW<0mZ0-Q4`sW7xXcc!s;5$x_oPJ zb|)MG&0Q@dj4UOWRR64;EIj9}jbXfU?_V0)Q$+;Rl>}SRiLVJ}acY*bUPK}1!7QHJ z6-b(f!iOB?|3#>z=qMc(=V9csmK-(uon!dI=H6wpsRBhTsTARNshsj6GSzIE2CVrB zii+0=yMW$OmMYIo^mx}VQ*Qa9x)L#`!I7cwaBMMCnTsSw>Z>B0x^TqsCuRcYkmuVPz9=F8?yHF)g`h^ zmmi*2Y#tKS?^)%<#R=q{DLT3;`II-sEv(AODPJ+aVq7;uH(*d!DgQjP-1^xqH`Str zdHyxI98?)Zv6Gs*8lU0>d7%VpkEZ@ETPW@*DHph`LQNxn(FhtWJx6?@QiRleUtlKi zBl$c2XM1XdRBZQMP(7w!VgCP4*D z!q=OCK$WQ-%a{(cEE?Gt1+ncK`9H(<35ZrkB4233RG z?ZkMWwV+igNS-V06`A9!P=(8tC*usuKjU2?rsvLHNKk?rx9!{}U5XUP*&%-UjN{!b z{E)Nr6LLGB@yt`&m1ZM zBBJpdo?`rMaQOW6CtS}v5D(?!`603+*pPG{oD)7ZrC)=7NF)=p9s3d5S`;xQd=S-n zPV6axj=iJ~q7RPDUA`hl1PJC9_*zeXUW7S$W6#wi!&cCWsm;VKx$GhOkcw)Bw!mWM zU6?Q5HGh?Cq)LqeYsGkb_i?nBc0*Ao!GBE_BYA( z|1!kINYAjyepX`ThkS;qOP*qav$?%J%HRJ2H@{S=4y3%a^x)};x19)kDk~yh-W;^E z{C8w7;x}b>HnzGNT~k}p*}3-gvw`FaI-#XSpX=D(mr1MV*;)qt!si)n%MJ_QOd?}P zmtVeCfA`}DRm+4m;g{KC+ag1jP|J9^Von?BPX z1hIto9eQ8iu%cPA7u8K=i(hni=X9`^I;?E4#^{X@&1auBzI=7}@X5d7jnNLyyH60VRlZm3dR2C_6H$O+IYtEA$& zNL5PtKUy(^-|_fBFlJ)op}xEj>hlUXv>TpT1z$4c+6;pgI${htq}N#K{QMI5zNaUS_M}-kPOqN? z>JBHv>fNVXBxSe)+*)6+HC_jVEKP|{H3sReSS4K!aJ$dIP#N2rFaf^Dw!wQAbD{2f zdegxSrg%Mp9M(bW@`NSgGn1DbOyN@GWo9Yql>TfN-a^?SijMiaUq-6#8@}X-Rjg&~ zS3Z9!4_^4{Sy$L!%B}c@vs~$vtE=lP2L>2n$JCT^Je2Q|lWSvzTU#fR=@Rgeyy}5d z>;m&P?7o`byr(POv!3xdNSstvB~L_asOunKlXzMO*)UHp{U95>K1UWWXjRwI`54RE zQN@usQvKGZ)3lCv>|9Um@hmq z9aAs|_q=}V#$Eg^kvD}VK zCYU?0d=6{s$?f~NAFG}UhsN%%cHLSuQ=;$Tdzkwk|w)L_N@W4%{Km& z6zT;Hc%dgyZLrj30DSXs*D<8tTXc2Ocd>2Rv4TWOud9>V0&Z>YbuR8RNJ_9}Q=3cs zJ6%{;SN*7+VLcwMW82%?LWyyoemwN~hQmb_{0~-(buX?YslPi24Nz85AyCA9 zFX#q?)5s~ZVA%{IGc%)uakWchW40!~Sm|*Z;P4Pkh|o`1VqX8&o8dN=tXSRD>Wch8Sz_5#hdf*nktLJj*hrh z?c4JnM{cS_?yZs`QfFS)G$mUj+S301y){`s-w!+5r>@OM0dfbUdrH0qcZ>%e<{^Rg z)MuVI&R1qN`BU5+9){{u?ZZyj);1}_RC?*m*CFG*!gh;v^WR;6=EBZ)ECo6`!rm{K zLoFS5@zpYSER2i^morTBOm&bE5o!d2;3-ZHF|nU-{63^de)2>zso>^Sc*e)oAPU@7wlqbcTb?;g_Hy1gUpzlR(x zrXu=QhwHM}19kHrjNh4oiXM(DvG4KeV6F}oPZ-GyRdmiRT16p0kaOlnX6@;~j?QLCA^+Du zpJy~YXS9K5KXUP7xT+uiyj?4F3UK5Hr zM<(BFA=fGu|My?||F1{*h|<7@bJCU$7Mc#8hD}XsVT3k!-zb}VjlhI9kv?11!k<2Y zlVWt2=IS5za1Dr*i_@uUKW+4c#d)pb6NIzl3Xa{Z O0Z_&_kab2*G5-OX|IkGM literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/ibm-qradar-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/ibm-qradar-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..47a6790a6fc8938c59d9faf565bf5b9a5d7431bf GIT binary patch literal 7354 zcma)BS2$c~{YxbTq_Oi>5aPv0*qXd~-uW zB4YS&y;A%_e~u`=aaUB8eY1msL(GBmjl`=M35nvHqKu@Lcjif!ue+g+-@b%z&b;5z zAEjjbp_(1*OulQ1IVXmiFn&Etw z%mh+W2?@mXG?CkaocJQuA6S#whra9Uw44nHS)bi+57!W``WCPXS;$-)DgzgV_mAgq zkJq1{{T~}+L+A8rqh8KTk&o9KZ()uDEJT4m4^%0}KG*t-G1@a-&wjq~P9Ah$s|CyP z>!qrcW-z;0G+0r~WMH`ezkT~-e zmnOEVRtz8F9B^H*kdOBqJ=fWT1lPqdv_x!MIKMt^G#cIQmvOcRkk7QmUax z13TKg4&lCv3iN*DL?zp?vL2yy={@`hfbP7-d`D^h+~e&@R%4Gyoc+^@FP#eD$7@y# zLc>0-wVvzsHUjKdGRSDEk|;hznwIL^hUY2vo;?kcq84m|`H(p%rg)m!Hse>MWEx%l zu=0P8H*?t<*9#7)Me9-nkn%{~CmtSK&}+Yly!>v zPdgfaWXo-V;$NPKSpj;dW!zlW%{Y$lqAq;0Ln2;gd6aC@&a-C;V$ak9qN=&aoXt2iEZdq_-`TlcYy^KpG2!7fuTQwa-hw5_W9>*SQ4C;lg(&s*vBhjFIA)@4 z9RLGz3`zxl`n+q2LT#ehQ2&OU<$ZBkT^-uk)>2(FOmCI%I9Ll9JvBjAZI|As=TIiV z3(RHIm_5JB2Nb#)X-Arp2eW=0u(ADBon7gZ_fdNq{1Ivb@52}+vnYt7RR5r=QNgY3 zpy|9@_{ZTgX>V~mn)6viSjyh^?YK`64)*@R2TnFUZA@xPf#&D7ySyWZAH|%j5}hL< z&82wYy|^JSiRyNmyvvF$&eOB~-7bUKBT0Q%_eV<^JHc3##DW&&0x>H$co9eOQei^T z{Zf99=(&>X`mrc*~;G|qu2%&LXKwu7Kx}H1f7j#e0uyxTqRNg)4a0VS& zYQJ>~Q&{n#1iFmjzS&&eY||QPBQc+Rbi>2BbM|4IgtAsZO>cZWNP73j!)ocX3Olz3 zHj^45@cV5zfxEzR=pW{kkKH=yT^1#ty`MT8ZcJ45job-ChVcCfJxYUq&>h-)mWo%_ zS$UVX(XW@b_R$DV!?n81*-iw?<4}^JMIIf_#o;YxdEZfvh*u7vJW$=QX)z3oUu5ao z_Iv=SS!3f;ss>e~x)bz7HZ~+Fq2YGkH!|T`9WANODnqharh2qs&Z%pD&Kv7Aj!b{NQ>BgDjUiCaB+)CrFcpq<62rf|*m&1{j}JbU%sTvL zc<<6dkK4;Ok!&582}O5LeoWq$HuvJoiwkkicXMa8HQv?z2Z^RrE7k z8`JY%xK;GVzV5}P0iJpUU&&bk8{Okv68HIUj~XuQ`DC;frwI(T>n{@u&dITaZTt#H z-NNd*!JKPzhOZpr0et(Gpp9sJ%?86FqH86KTWg}e3J2GKgwG9Luf%9;UI8No0I$*tV}-v4l*eN{zZ!=iC|jX~}k zbfT+n`@k5bVo?glz&ML{F3e8*X;ViQ*^ z@!}#;iL+m-cB|XDbLMYN-r7nB=BPXdJWq=az!j11`1ELrjGJH?8RN0@3?tY40sl6r zW81&#tE^lNeLx@%bop|VpaioiE=t6e)F@dF9T)q7fZ%TXAjB3bWNHy=l9lp8O@Lt{nK=+t^F{kfRtH&L14E zwa&6e##jDeL^>SLey`ng-vC&gB1*;n%7K<$Da4ar3HS^pKzP{9%ANwT-}eDb2++G= zj3#l+L6Xh<`Kn`zB7>PH4fY|eshC$q(1beh!aePI=!@zVQ(%l$M1|EG8W!%(`2n!@ zGNTLw#$NaMM@5yVeP0%{yd?p7&550WfO2kbjZ1=n@3$B@*gETb=(=d|e~TQWWI=23 zhdcq!`;+N!|HZ^`d4ZnVO05dp0#lKi9uq~Hoc%~>OlXfTBSm88u(r_HhKSdeRp(Fn zk=n$K$`=KM=on9ZYI{SESci?S2W1wgv90I6=Ao1phVny8TS<%R`ma64_SMyr6bRe? z90gU3mg>RnQWL{wXOB(D@@f>n?Z)p_byZaGM&>B#3|D;ZARue(;!=~A@q2h!GNU!Y z5TGXm%Pog*#5x|ArvXhA_6nGCqWST_@ZXKCRwT?eiou@O`>N9C7iIIV+xPW-GS;=c zN2&e6i~*1Fs#q#XWgVhN84hzfgwg8=dUrdJGq;qPZ5der)lcrqVo_*bHtV(sa+q4f8CrhpU9#`i~|k>^p#gm5Y^vbo`_*bs3l_#5VZN3 zV@YEoj*&(#e7A8r7e0KTBzQHbM_hY9{OD_iGGwY>(<&l-)^VDQWZcnSl-u6$9a0e$ zNf_8-)_s-Yo1BjrS*#S`ckE7u5Zpk>74K*MUl7N;i4XwL`uU+WAs0B)B!8%s6@AmF zNAUVjY6tN7fg$GSUW!K{vx(yKUorB#?F?Zd(R6G03nb&l;e#g;7QG)cK|pg_TW9?`lq4V9Xup#U;QvJ@$Du zKKy|-)a0Q|N4x!NA~OvtevncB66boHEi?IOqY+zr4fqWCk5) zC^h)|WEST~#O>LO7tW_6sk8O`)2vh2Wp)pWAobJfxiyLhz}55qLd(HYd3&{#Z=BnD zw$Vjo66{~t0Yw$5RngOlw=18b+>H0kXi!t7W>z@9*`-}mhyB9;EAi2z!oS%v%p|Fp zFxV|_wcWecW^g=I@uV7UKzl!dGdKXR(cKSrxMXXpvffD>G#d_bCqiZ3m! zD;JtPA+Xh@nkt80EgY2cGd$AuA4PuJei{o!&vh;H?$;N}u$0x5P1i6btEZ}M^7x|cU4C>OG7YxAXZ8~YadJUJXzW9aM@eAXeFUYheQc%l+eYas zE^*_9KpRZ^Pe0sVRH4R}Y*EZGKgO#F(oBDRI6Qw+!E`f~8$b6%=D2>r>irjzz)!%~ zgd9d4N^_O~NN|RXZ3@UIb9?B`!4Jc(^ua!bi#;l&NA0d)x`Ijit4eOJYr*VN(0#8! zUY$HA4W95j09Mo*Ux}IVZp)m4>6WgGp475p=s2DBfjQq5vL$Eq5iyC9STrsgu$y>n zyjy!_AXsKsi4IFeM*;uSpkqFh3vbM#OatGj_l+gyX~{R5SJruI$yihP9f2}7A4Tk%`mlcwFy$kqw=`%=_1WPGL4qBFTIf$~H#glk~;b*K_KL6L`OfqGIt5 zzbf4pd`xd&DLbqb_yw3_-~&07qC&JGPTQkKOt^Wr5sS+r&7!ptS53aN>xTVP4|k$c~|r23XsI+~b^L7eSN2#7IuRUb*88wuAe_CbdV6b2= z(YB(eV$>Aied*h_cU+X7IkaF|S6<)w@5Mj=Ed=Fxrd+~@X0)bdnrHVSKYv8JI)M!r#^_J z+!Q>4<)$|GJ_{B0H8jo!_Ib&&#W{0w^eR(9yt^>jt5%>T197)AOve||z?0yUoRHG3 zV_8#Ria_b_UdKw&nM{q6Ef+PXGlAFNMfEL4Ho9Kj8)D|&Da!WH zJdwW7e{81;UI{cFn>rkSk(-9+*D2FBMQh&oFdG)~*M!9X^{<p8C0nBDvrwk0k4a z85vZhL^9PSkmp?*2tc8y72yt5ojL5~>84N@AC$R48q0O~8A+^2_-KpiXh!RWt4>&L zK_ZQIuJvjjzR5}~y%cC=ae(UOfBlwOJHSgzNs*ptKcUQVYna@z4+nLfuO=IG;D{rB zOW$$k(zRT%(uoTBugvunY=6}; zie>E#MFjL}zFQC3=Q#1LV131JJ(KnccpZ(YsfA`3b?@^!iQP34SFR6a8~tfCS%`c; z!|$^ur;zyogU$pCv)=2FO58lh6{o8kaPvV8Fup&HUlJ&*>Bg%5ax5;|s6vynJ2N;WB$Gw-LFpc%EQ^c0 zjG<*j3y62^kklBK2ZWv7CqXQxb)DI#lyd8&?xS3rf6S3BLNOs^_ z1OXa~W-MK(V(*~|{Xe!Zx~V)rDh))niy=(*DvPP@#8R%$6(c^+LlGA%JWBUX)@dEC zC7nUmIXk=70poY))D`*|L21dVBk3LnPd7(Rf0r`2VZ11sEPFneT~sdTVeLD$04U$# z!P=-uz)26Y_CILueoNbBx8~DU+5ia^*)Ofqze9EQ_^=ZL_d|XI&(+rIETjUnpvT|0 zsyx$*DkFRS%i>Xx;GEURSge~5x%GZxId>~MrE{8z#Z~Pw20j!MDugk34f9h32Q-?( zikc>L4wG3s!}-0)tEjN#=8zxMCjCRn;X_ICHW&_Xun)J8Ov^q^PDo^m$@cI{+phdzVX;A?8p&@X*2o5Dzv_I~F{b=THE_GfsF(Z?IiE?Li<@U~ za06rQrCL1~6ubF6uc-FZY!OHLU%Tit{6&T%Q3_qdD;lP#rTHr(^7s{B`e8S>u$c~S z!!k)`q=2B6y{Fua)Pm7S13y*fMNT%diQkhQ#UG;K??)Eds z*QJS-ss5IVXe0{1T_2o(W>k8B?s$^<_WhpB-$y49uxz&fUvZafq zZ68d>gc1-Z`{qfV{JLC)sM5?Ky?vvmQ{z{3#R;W20Cpk(I{`gQzSE9IlPvFm(fX7- z673JXIO6R7jsNq;JL{t{1H!nJ1jT`U6%^9D$x25LX&xOGD<;zm#;&eMoU0c@vOQ z=$&^;dLX=?&$g7;N}?tfBF7E+p04YR(twwN_X<2VSvGhLgEb;#;zBEadnjU}I8ChN zZFTg+z@1wf-~I85v`x{Q*&6$`=KUUbr)Cq+$&RfDF$53Tll&D>diX93QdC%mHdAi5 zn@_*(GRvVo3|jLhz2auCX!3_=)|b^I?3^C0-yc-0~1=3qH>kP>=q4Y;?B$$G%hpI?#d zRN{je(uX0OqDNC!jh?FOx+ZDZGO&J9S@*|zGCvSQZrr{9)~}FhfO)6JJ9{KV;>j1v z*L*$&dJ1gVl5%$isw<2pa=)P(b0!Gh8?ere7U0lq0B6l@&#z4@H zJ~~=@SG^mj9p++>3KNxP`tEbG@%AUyO}wJ&*v$60e&d?%-s@HlCW1(gg#g_^W=*t1 z#Wt{c(P_^-$KoYdd(o+-@(7IAR{_kRy#3(wP~|{GJYCDigBRwjPc8P~Y^(Y_sz< zHn<(1k65E=xFzSk*Y&*q&1?DXDnLR=y!&0p^+$xiS{-4aO3P%VV+^E|kP3>!4YI@I z5|SHmh(yBQo}LT5ZaK7RiOQWZg4`fxJ0ZRsLxIK>r9sE6YnYv+trMfp7LAe-W`Q5H z$|m+W576YIfn9I^h6y)wTYgb35X{*cQ$*Q8KF^-0$dIO{W}-)=F8-G;;k|iaVS8=H zvj0`0Oa?wlxFSc!UWWY34wi=0XsPUkin`jbx^8dj2}U0~`>&?Rci98dUaMWbgVY^o zlWUV>*#XxW_`o?+612qk`JglM7Z{_)CvAy}z4o`O)S;64?o1!5N8-DsfH^fOdk4LS z6r{hw2&!62gj5dOoaEQXRt`hjv8KbszcZa~9`vpftO6i6EI{KOv$;MFe-(FR3n~E4~C7?Ym3tKL`=AtbkI(b5qd?y;ZhxTPkCKIDtzj3 z80Mj^TAV)~xW$Acp_FrR}8 zk*Z821jU?37${p`9tkcN(?2xSg3E7+F~@>|%r&O!KxZjVU@RAg3L}!^ z<>WFv=+Th{X?N>@Us_d^S}meN-29meWUY_w5P!Lp;ykV7?kW4ED4B5c5FFM_+(vL| zTB0>}Ti&?KC0K=tDV0PlGS1b?^I(zmVqA>M)MkUE50qRopo1Z6=Ixj^>W;tc z$vl26|4KJTT3P>1kzB;NU#ws3n)*8M4FaIhB1R#80WAzd4UOW8*0#mjxRdy9dW*)% zRS=3pJXn$VO)3Xv(Q$!BOI~5JtC9}-Hk*$g#=(-BvuAvz<%k2*C;BBB@eDciu9+Q@ za8u`5)iZND*Uai%|I219KY1LJRH9txQ02whgrW{psJ%KO~4h=)rs(#Z+{!4hy z>a8I{D26P*?9|xWFX#Fm;j{=iY%dN_bzZF~(XZDvZMOfG1=!wj)G$CQ^ zat;M^v?o8CM<_Bdaj7Kk^rDZk1G(7AmoZHAZp!&}XGqxhwc4gAJ6N_K7KgJFI5?x3 z=~aWW)BZ6dwDB*M2w!W@O0_9(_1>IMNBE^5+G9){TpRSuMl(1DJL8ptI@4jmKip>0 zmk|uqZ;c%hdvo?i_c6H1%6S<<({19MR@LrQ8xca6R zjgt#eFK<|o8zC#4g5roE$nYPiOQ{nPv+2a@loR~_GPVB`!*R8`)d#GvHP(D6(?xoD Zmsi{W&Z`cL2pN%(6lK+9Dx^$;{|9UBX0HGM literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/sentinel-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/sentinel-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..f48e0a6b9cff09dfab26d701404c345d0ce01a7e GIT binary patch literal 4439 zcmV-d5vcBoP)w4i^|S76?CY000p7NklRZEuI+L0Vvt}HnY+8S|-#Apj2KwBhEdL%%bI7Z>LNE{<5 zYS%!L#!8f=uq{`CFVQl6C{mhOibRPvb;UY)?ln8}`p4|-yqR5+d(7=Bhclj5$JN%2y{7W1iBmoD-0bNtdt%#@ z8!*YjTt84l^&r;(tC>)jqeh_1Q6tdhs1fLL)ChDrY6Q9*Sz&}*aVe(a@c9&uTvU)y zvKLq+o?yj%9;=&0)O$$Fph6*3SvX6Sg!7sgsLWR zTBi8&o74F3BXQHeiyY7r@`{3UQ^t#N zdQ!z_emaha`+WG~Edl#GWizUlzyoJwJhE>RXC{q@%X2_?gMhXW2SNZ!b+V9=3%S;b z1gn|_v_~k8UQ%$G8R6eP7{lOc8UOwVL9|Es3Os@QP<8Iti7N^o**A$DKN&ZX=NAcX zZV}NMdcipF?<&2Zuh9F_AFl$8WtK#kby%;;t?U_b!ug z`w~xCo=ZNc7=cGFrSRUl6ka`H5P}9#-yJ!#J30dTTbqhtDnN)Cc zOhuAO3jFMN0zW&RKu99kwAh2Kof3MR1hmvu&X74m;IvFJk)Rk)XkOpwgo=}63P#2h zoE%f|;l|%U)8fcF z55e{G1uTv5Xpivds^>A^&mrU?2ua$=b_%u<_;;^Q;gu7~qUH;Z0F8bQ3+p&Uyc_@u z3X=9BD|01;U~!m3Q-H(i2?d`_t4QVO+EkKa=&X#Pv)SffM@K!62YY?^vm3kxKbzTL z8-a(dK&np;h!g=aZ4%S^PsYTukA{X8R1EZ7o?B z0D7AQ1U+QNIfjBT-eCIbQrRZ}ev!-B&r5NNqs*M2Yo(+VIO4@DjA05HN|$?D zBy=|!q~!~p+}3&l10BeadF*@&zdn<2Okb8V_jsX9S}N_2l`Qux6tTY3i?B^aNRmL% z)g+>;NyPdN3HyiR_`kEVZTcFr0oRyNHRDRNX{qAm-bE5_?UZaIE*HW+4xhTgkM*4@ z-WpEeS7#Eo>2H26_Ui569GHFsN%7Z^mtaR<0L`KDt%!$x9Jb!z!@9*D{OI5`#^bc) zez0cK?qy-eUTKxmOeTgFA$K(icxWJ4R`OUhhj=_R5JY#AP?Y|x%);(D(6KlWAW$hX ze+rSeEcfBQz5u*A3YN+Vuc%poEz5lc>2H-?=fnV-7s|}%nGD5T@~3*c~;zbod=)p^&_ADu(HXCal;&_LuDrP+2q^0yja~@-Q?+5-Ri+@U0PX0zWrn2 z4krfeL{6cGf7;g z7`c?fk>AO<992L-a3!Xo-p7N2qQTE&#R3uS^8{PG+dF%F_}<%-bM{XQ>J8Y;pR<`5 zQ%y+@d7#6K_IahLFcwp>?`RAMPbFclu>n8`E>CNg+$zuC`W z<6;r37l>#JaR`V6QJLc72^9x_C*$>xWt@+yS^C6e;5+*#@rCt4EDRTxd-aI~Yuh|{ zZ!|e$f7z6bOPm;{6FH`YHEmK+t$zQ5X+&k3)t;9p_JiNxzs(@%;~`@z|zN!FsJ}lknbXa+WF3pv@H~)QE$Sb&dEqbQE!zz^g~& zI6JOnwYRK+$8+0)Gm>Y;&J_}#+ZM#K20lx_v*QY0JzCiI008KiFJwI0nfk56B?KCo z2rmLQf!^oMS=yZ1;8@jUlCuxJVM zIr|Hk&88~|q|nny`h-q0a!a`I(f97h$(-#yF%UplD$bJ)O9W301hVu~De%T{qTu#g z!hFvDS_!jyrKQ3)0)3X^BHjBkTxw13Xe^w-*N?}t+WTyeujF%GR?Zjj*&eS+KMG*z zqaw^`qnNY56y_1=;q6`Hw2ikHDP$W*BVnRVjh>UZbgOGh$o|4IhRtq_W!SYu0wp+JWW(hrVV$OV8m8 zv+p9d!YAhLuhopQ&&dwhNT8V*MP+h=Feda^feykuA0ix3zSFucj4b@6ulVu;cLXAaTwnk+4;b>kY#$<}uj>mEAf^7PIn&V#f=uS-f z9>0*nYscex>$>}JG-rRU+X3ye96D@!l^gvW8oV4X$F;dbRw#JE$jIn#=G!9)92ha) z?o38y4%v9Kwf*#Vf+Obk_4~beD2g8)isq%C4r_m9hQaHCoXJtAHN4=HNo z{frVjd*llRIv8`|LR7U?KUQWBMd({#|M_dS61av@Fr~7cGWH1AAs@X|T;h2q9KEF2 zsvj$-m^pCG0{b(Uwi39OQBYBl>3lCEEQa~cy#)e-#^)oea@t+Xd|WQFYnb~o@?#h8kOqOWNh`{nGC-xy8e z(S1_|XZTeLJi2cRZ;U2w)rXanjB!}AKqz>{BwskP8u8~h8pqe!SjzkD)* z?LQvF{!=rbQ^w-0Q!=*ycnq(c%+B!GC0otsUog+ZZaA_ce^-};r{0ZXWK79)#>1!g z3h4EcnT;T&%SSFMc^Tzb!#gKVp?Ux77$QVo?80+B)`~nb7nMVW6zvhTO zZ1Dc*I=>^%iw?)i3U{vX;<}*LJcTwVP)lc>l#>d@mAH0bYdP+x%Si>$xm*(Fv3;3y zqYrR+a|?UwyR1;C`qE0Kfcol^RS?LGNA;yLoOLDSj`-*sGBl#+;sKGtf}sA z5phR{^E<8_KkWHmHr8e40F~;wL1x7oxGH2>rI~Ps0Ql$I>g;}$IpH{g*UuO5K#vjJ z%PN~*)8`O(%c^R2T>kV1FS;Abb2vj;j$8lx^#LqlYGGst6W!&$s+2-z$XgQT@uh+C zeetC%1o{Mm|M*l0Qo16GQZ3C!DZrNExlvB3hSw?aT0gB7dQPHjA3W%8;PFozj5kxE z+J=AjjixS>^|BEiU;F()*-WR7vVO7Rf$P1vmx+tmw-*_Qz#TG$x!z^RatZgZEdN&V zvVU^q$xU_WX*4hVQfMwYd#p+|%M|8PiJnFQU*A|BuhWXM6X@Xyp5Ge6JfD%JQPK~C zQh=oA7E+}$KuqM#^Kp27YsmJB>wHm>kNz|TI6S}2*v6G1k)(rTJ=0NzGF#^<@dW?1 zErceUO9cx-#qPYSNx*+@4MBf#ts{{=<*!;~g_*N?0(|$5pd)1xg`lF}58S-OgQvFy zGqO%1(d#ss&61Ur^^wOqF;8y^VsjOIhOXitfV{g~!av?>gcqzi1%+{pafM_Mk~xK5 z#}{u2;O=f`R~hm}#R&v}&#m&|i2*Z-YQ~&W;~y&^tCo@X*iC*s+~?d1d!eWb0s-Lj zt9|(D2E!GnFoI<5V#HzPk+nFFCGUxW03N%kx;|506`x?$@nEkO2!HuaZ6%*Vdx)Iw z4Z<9kIVoEg@xQvEE~8&Hp=w5;jt6_a__r-Vuwj+C>df#CosrG=;|TE0P1Q*rP=y2n zz&*<(yl_|8loVDo=1eOfGM=%0GHbR0EzWyxYY4k4kRr<$RY@QK+}bMQC-;U;rTUZ_ ze+bNRTB$P9?dk|i1iQC~v2k(bLxtH;wFClMj`5|P5iFZ$Wcc-wVvW;Ek@YrpED7^? zWoN|JFKs%7swNNsTIx9b&yEN-Sw@0JB8-d)DNeRbf4F&(h?jRp&|0C-9TbYHClJsU zgrDCQ!r$DS?ZUIAeWXCyioaUx$BXxb5%g3hFu0xK1Bw7TJnFTI#`T57axd`LY~v z9f5#mQvY>x5KnHZgLjVl6GC$TzrbmQx8J)nyl2ck=GXD z@!~yUe4&bRn#ID^1Oi&I)Jyk8OlADD;o&|X-u@H!noKKPPoNH+nEsaB#B|m3*t;u# zqTPb4hCo0wjk~vp@y$(jrlY?;x5|hAy}usUmw38iHR9^)5rADQz1Z3*;pf8%^fim7 zOwQGYtCBzfsPmAD)M=I*SCt997EvS6<){(pa?}WPIcfyD99drI(1F29=utzFAatfQ deGRU_{{yAPG3*#neTM)5002ovPDHLkV1m|rkAVOH literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index 16bd018aee..64ef0b4db5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -33,6 +33,48 @@ Microsoft Defender ATP seamlessly integrates with existing security solutions - ## Supported applications + +### Security information and analytics + +Logo |Partner name | Description +:---|:---|:--- +![Image of AttackIQ logo](images/attackiq-logo.png)| AttackIQ Platform | AttackIQ Platform validates MDATP is configured properly by launching continuous attacks safely on production assets +![Image of Azure Sentinel logo](images/sentinel-logo.png)|AzureSentinel | Stream alerts from Microsoft Defender Advanced Threat Protection into Azure Sentinel +![Image of Cymulate logo](images/cymulate-logo.png) | Cymulate| Correlate Defender ATP findings with simulated attacks to validate accurate detection and effective response actions +![Image of Elastic security logo](images/elastic-security-logo.png) | Elastic Security | Elastic Security is a free and open solution for preventing, detecting, and responding to threats +![Image of IBM QRadar logo](images/ibm-qradar-logo.png) | IBM QRadar | Configure IBM QRadar to collect detections from Microsoft Defender ATP +![Image of Micro Focus ArcSight logo](images/arcsight-logo.png) | Micro Focus ArcSight | Use Micro Focus ArcSight to pull Microsoft Defender ATP detections +![Image of logo](images/-logo.png) | +![Image of logo](images/-logo.png) | +![Image of logo](images/-logo.png) | + + + + + + + + + +![Image of logo](images/-logo.png) | + +![Image of logo](images/-logo.png) | + +![Image of logo](images/-logo.png) | + + +![Image of logo](images/-logo.png) | + + +![Image of logo](images/-logo.png) | + + + + + + + + Partner name | Description |Category :---|:---|:--- |AzureSentinel | Stream alerts from Microsoft Defender Advanced Threat Protection into Azure Sentinel |Security information and analytics From 2d6054ff774e71afe6c7887359e21ffadd5a6d44 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 14 Sep 2020 17:10:20 -0700 Subject: [PATCH 15/57] orchestration and automation --- .../images/rsa-netwitness-logo.png | Bin 0 -> 4706 bytes .../images/safebreach-logo.png | Bin 0 -> 7898 bytes .../images/skybox-logo.png | Bin 0 -> 4121 bytes .../images/splunk-logo.png | Bin 0 -> 4576 bytes .../images/xmcyber-logo.png | Bin 0 -> 7188 bytes .../partner-applications.md | 24 +++++++++++++----- 6 files changed, 18 insertions(+), 6 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/rsa-netwitness-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/safebreach-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/skybox-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/splunk-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/xmcyber-logo.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/rsa-netwitness-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/rsa-netwitness-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..b590724e540c28996c1a3be7caf5b3efb60153ee GIT binary patch literal 4706 zcmai2Wl$Sjv&N-pf#OmeinWAN3bdiP7k4O7ifco#VlP^X7m5W4S}4IaK(RuQV8Mzz zBm{RU(#t#dyZ6_fxj**o%$_~Z?#!N@-Faekv{fh`Fh9V-!J$x7Rn)uJp8pC7(f!%G za;kB!NIg|eK{z<{y#ETWnjX*Ly^+{kO-qS*gOrj%;-THE&?p=n8eBESHwJ#$d)fY; zEYm@Kz{iwfII4I&o%k!bp+$-@Elj4#?+4=cOlrUNYQQ?R+T%YD$aqM?dfreI&jKHdzzI~3>Z>Pi zZz3yjKLTE_O0 zObNa@JH>3U|2OFW>HR+u?=MZ$#Jt;%Bwwr^aG2D_&E@eA>V+b$l#@{Pn=?@*<& zs0>IADE^YTXSycPRc!7i(A#L|%MM{iyy79)Cr^j(PC9&1w5)G>R?W!k;gg(TC2&;~ zgv zB;=&8Y{PAwb-_76Q4Qs*qt3$P4~qF}9Pt8Q19Wxq};SCT6XVk@kS78FoU;kSl>0uvU5u6)T+u?Ygtq_Q(h}i~7%TimZQ*m!CVv;#_it{n z_7P_|R(UAUp8KKARxAO2gmRyw|GsenuguTU-?szP#B zhI%bn={o2l_ShNf7xq;l z+Su+~2rNy$>7!1$+`V)V1Z{cus;{z-o%VJNz)n@d{>fFhn_EhvUni(7sZ!d9-0h8x z-ph*FA@q7*dW0$ehNPWIA5emJ7+lR--K@&I_ONx z@6qD!dMM6MOx_5-lKF3u+()nssS>+NH=V)p&d4EfB>r;FXc zb;%(xKz<}BM>@yAJ%4`4%$OgJ)XRUCDIk+dJrjiGy35UNcyUQoR2+(fAg27f=ShP7 zUJ}yce)6R;@9E}GDQKj7U1aRJf$(m=rI<&cn5H={1G9v_rDdFia2sKR#es&WwcKF^ z-c|*oV4ZByewLCr0J0Z#wq0&imcT|ku5fn7vP3pvB&RCrXa)@l)(u%V_$0&Mac&r3 z<)68NLKU<CL(ZSX5$S5x@Yz)Q|*Fz||e zC5uEi|J$d4XI*i93Kv3Rb(=!(9+?)6S%)?*-$XGbMxz~|#aFWq176b4Qoq^cHl0aK zE%FL)SFH!G;A%dfR|E%L4!$G7YNn8eFLr$#Gj+S~UxJ;6lj3xNHp~()X0##cH=g{j zyylxpeYpiCqkyeyN3ti|CxuAK&m)lSZQC-KMm@QS>U|4IamaqLwIWGxYBrs`mgE4o z7u>dyH!x%HslHUUCYx)$P?A$Hb+Wb6U4RE3{S&U)*Z=@v39SzoeNnUJzjE^$tCQH4 zgHw_3`#hn*#GPH!G1eDQ&6Jn|bKo27ssiI~LQ$^l*n;MmTN9~2+H!#Gf@KN1sC^%q zpwjKr6)_QM^CC;_7|i6dYZ_3pr159+w=#iWZ`d0;p@kH4wM9URRY7pb__KJy1MbCV z9ZR{JBl%>ej4RDLP>5ti<#|+^d6PT-&O1RC|0*Z9NaORHa-TKb z=$UE+lr8y~&$d0fUu>?QMh^DqRJVT5k_RnGH~Oq6r-t5PssA1-11N&5I1ggy$*z!n zLMWF8SQ%)D;V}*5gDjnW?;cSMslX4;Qv}&7t|OeglP|H;S@el@jAwpKXMRU-qxIOu z1fRZtj;x*>d z@B(qI_qbWTc=hpqmt8?WmXYUL(OYa##i}XWF$ddzv&HHgT`ob~zdq2Mju4@<-hCH0 zcPkfA>~VIlCZ%!Kz*JeYxVX}KUV2;c4-DLs2U%EUneR12+}S10z1;fAWiD1g5Z9wh z!206b8&NoosCew_l$uUWy;eJp3Byl`P=|uFBSumcAACMi}yanENi=LW^Z2o~i#SqcZSG+WTYuT);8nTl{ zGt@lGfe@)69Uzt3pu*1^kgE?}Hcazdd|P6$a_q-M5*hh(07b4zJXUH*$F!ELvEJ2# zg6YEGFmchF5xiFydjj*QYZEaZ-j$V0o@L+|sa&5yL~cz_tvszp`3ar+^GJW?(>YB} zF=N=9;tARWMX%AGirI^(@Cfdhids)8(aUvTgOnUJXc>Huk-~3|J=P|}>fgrXfHZt; zDOoQN%hAoCK6>XkBBa*K-STRE3xiJLAW`YIqg)Im=A#ozL5k*sb>P?KrZ_y$78Tdw z?|`qh@~uB@T~3fF9xBUEo5iS%ZYuYtLOs}wU3{O+M%Kyfd+nik<3AQRm$z2BZ11iP zU~1F;$KGO1X_!@kOGi9|-(f`rfqqTj4kUO8E_>b9P`lkS**N5HHIKS!_Y5|71O^hQ z3i0&;vc77pv#oSM+1V~2$87Go!jB??o1w}FK4}{h5^J01NL%j{H2f-#uu$Uk?Kleh z=haxpRYv@$vI+?b|I1ciY5g=O*7IjiUnA0JOgq8FL#{Bwfa44{HOUS-cHHqgs>7OhR1=AVXkE}geP{-tMT zqEhm@3frwk+e|tvUiL`H)#5pWO?P23pXKwdyI>Wtg3b&r-0EV1+jPp4PiitsI&R3!hzI9ZLR5Yj!}9VudfK{Z4{(fW5(x! z{cs1oVj~Tu7(*!!k#Y^HQ(^`0>yoP#@4}TuswjI;f0}Ez9QyG3- zF&he%&zGw(uzj|LJ@V5X>8*y*YQ+wXj7^MdKc-vuV)Sf2@+)yX*nNns2YVNsYLQ~G zSf_*xR1S*Wtci_^o|Itka8>(w?hf+f2* z3!-I{8}pO(h`IJ?$e(MBQS!Yg8@>WuhITm}>+1BrsEPw3$Pgs)tC&hpcQ|#j?b!}T7G82f(4&N z;nv__hG*jHs7}FQFUS3uAsJ1De$DD(_!v|N>M@Av=f|M6aLBV;RnZH==aw>xZifi_ z%mjpEvmaCUKet;AX7XRi(IF>K0W>!HUbw|08=<45P^bw{Tm$^`S9w5!x>siZ%Hx&- zE_I=`tEnA2nGSc*ik)NBZG#LGBa4H#9YLsk{N)u%8Nlh~nA`-!1JrQG)6HF|b{0{n zYrtckmWD@W*?n}pv=rQEG?N+I>lq)ve*be~;i&0nA|D+lY9>7zad$n_3MCogbCrQ%Pn>`jPtEp)>0ru$T*8;dQdXSMdD*KR$=L7Q0~9mtJV9l#tQO)pOY`L z3ksVfu_mr#KIIYMhdTK>c}9W*0JL7+z`&-4)@f_+XM5rD;DqXm2-XtX$SLLXu+q8W zYO~mko$aDxUmQe_l(x%5gcAK9i}!v}Dgq)jA>u+`@U*0^K9tA~uZ1VPdDgeo_KD>B z##^F^I)jw|Tc%-IhKL|9+OuFPcD}>+orp}MTbFHrL31IbcOw2*O&ARe@%jGupYYF1 zF>1_zF<={Y6S5u22^L2=pH!C_Xn`Nr?$Dx;RdF;1BoVm515 zM-gupIiM#uKgD-no+nLTqR|2m3ZgcM?d3iZ?PmY?G}W z_^9Bche-Q`!x15ED<;b&8E*VmA`gDP9VYLQ7jVF?n_Agj3pW?8s>RbV7UR+e|O9?TQ#pB+$72bF@|^F2C- zM=KY^j?zJC?K;%RJ%Y9rlcqkme`Zx9D(m8Vh=}_a8d!!Sh`~`b#qN9iE#QZ!jN)Q% zmtUc%QbX7IR^kiU*b!Z8Wv1AN`cFvTK{_c+P1QJmf8#|s*8c#e?|Mt49PIUMH3FwU zjGi+W2u2`B0XFKZah0NiTwl4KcGUMo+2k5J3DrD<8M7q;pb&a) zu{v3II&QH~wmb>{A4TyWw!^`+^&uHsnK(9l0iXB(eWZrvmH}zd2uDpxTd`8!I_$pyP!&Sy literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/safebreach-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/safebreach-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..63a7f90e35afe24cd7f03e64d797091ddfbd76a6 GIT binary patch literal 7898 zcmZ{pWmr^Q)b|Cs0VM^b!J$!VC}|L+M!Gu&3F#U-r5OYyq(cWBO1cK5hme*Q20^;J zLwJwR*Y|looH^IE_slta)>?b5-}>)ZO?4%r$Fz?hJa|9^QI^*R?w-KqhK~z;^2}%` z1Gh(R%0|E-CELFX3!=?>2n^!EAZiMDtB;7OL?24A=B1`;w?O$sDZy1bs<{4BI-S`f3weCDRl<8q(Wx&Q2ROWPyy_g`VB`sQ_sQ9lqVTw ztpo-1tatC*HH@pM)ZyI@{`eFFGp!!KDtS8hlS99LWeuj2+tr-XM_@3gmgI1_UcXO;^H!YrK_T{rn4Two#-Y>N}O@q6HQR_A&sFXib} z%h7)H?k}H=>2uyWi7=QFbN31@0`%vIvk>=|TLtsukm+h(#+5y8KPRcGxT{CvRda>s zswNGKVtnVu_hTZG{BM6`?yed04|of{lsrWXX_*QnbDA5z$VSFOGu}0;3n7!YFZhF1 z`88y~`F;DX43&MkA3M_v$|Qyk?%I+=0_!pb?Hsj)iPBk_`jgM3+3_>jsgdt1=(>R+ zZXHw647`Ip^x){chW{Io{du?UC!ZM?tNxpOP4AYRihVF+V;Hy5Vj>9t0d-WY%VzOL z&v5^U^?K@~+nEEYq06xzgO(6hvZcw`x2f}BEJ(w30SG^AC9etaQ~Mnn^KJ3^KcxNg z8H$hEhd&Gif?y}JE^C=~d*uQi*A8w->s^0o?(ffE@_vDc>p?uv-tBh%*V~nq;W{ta zk~i0-nT16x0k(2j3@eb9DPhX~VQ}mk5DXc`MyffFD>4m61$cgD;amOdFi`mTQ#@9RET`k)NX0pEt0-95R#IkORZ*|>7ymt?b5BWDf=;a>(Zn$`?m zI|p1%IjV@kYP!Zwoa1Jv7}iBXj7EB$Etm(%;M^%cD1+dON_JJ*GmA#(X(_zi#Xpi` z83V`l*}eg1xXW2l2oza!A_DajmTTkq@^F7{G)8_Z!g;RYf;7aqA?>^Z^!(8WapWU7 z_mT(1X|5@MvE`1}tn=gEc|*_byAyS3Of|`Gu%>BExdmnotd=qvnmFKj#{Jjw;RbCM zdGlyL+#&d8V+|I~j9Ojb88E9+<)mM04Dm}`S<`#;yP%>vveCfxkE$0>3D&b%M#W6a zpmty{J>>Nw8OI#he2N*isSL%(N)NvU;XUz~WPqv-Al>yydSA2K{l+X%tNrWHk)N_ym+*P)0}voR8i`Gn)2FgcKL2L)r3oHGUqSlV*%%c zM|5ea>*-^@FN`R}4?A~H`i_VAC3B8HB^;X@v-z&Z%~(|O6@AVXqhqaASW+Ke>=2@d znSN5pMg68(4Z%sOqeq*K*)wz9Kp09ch;Tf|ewU>#SuyKkwJBbWdW_${pFtJVv$9Ft z!Xu>idg8P&k>Wv={oEaNmTY3j{Q{x^RI^_@T8u!1BX`p-XVr=9KG(RYJb$ndq0 zx%5O1uD$7calfOCh?#M8-I+*}3&*ova{r#PAVGu%NeRF5R?OOa314RRv82qZxQPAi zZpI-ZLC`pON5U=05`QWbk{>AJq5wVY;QnVN&)pbiY%D(ipp|@_{?ELjUn3Qw`9WGXTdNn%wSMx$zPve4Q z9z{FVROh@mkLrXxnSvq}m3C_WPO)>a`pXnoY9K8__Hvt{;3jL`$4Hb=S>xJ$tG=hPgz}zsAAekObay~HiD8a|Q2Di|Cah@hL zvu?pYiyaB|IG8t~&d6LUF6SPcHx_^Y<-exZIZP`x8l1!$%ip6gZzwSEFQ#7bW^OPV zz0xvQ*N!4XgI|H0g0AD|Jtl|}Faf_^_OqluC2REnuC6>2svZHUC=#vhi|HKsH6(kN0Lmoheb8t&*18A**BDSraGIH~NY%G!{cRzOE>d z$M%vjy8MSV=}T{vhO!%h?PtARB<~u#=~dC-S+1DX8H4324_&zdMo%*Qz;xBra(Zfo zRA=0{WR&9M&5ZQ4J4AC(CFN0qvO=XS_bv;OmwrdF3iBd9xbSej-LI+Y^n-(=k{wlH zo$`q42+9v*8E_=syjX2&dY<`*lyn276g@3-;`Yn_+6-iW)Sd-de94cRh`@Lsfe9h4 z6?Yt2px8c<2|8zDY_@AiQL>Bl*WmzE0nYEo+O z<@F`DpMbDJ4j9^>Wyr)Cs;>R3m_;u}zu42l2fcL zCN41R)%ut|;RVy9=dRo)Dr!M2duG3Z9l~mK_p-|`0EovK9+}UllN66VYJK;|0e4`cg!#u2s416Sm#| z!anw>XhF0klW59WomahGgr-#(kKVBq0hmG-+oQQci?nA}VFpU`%!=(hSze#vyn)v~ zqfpJX+D`~_bzR+Br(wmHP8byvC6T3fsTmH=3UEZIiPoXtZ|g!_)Z5-+$+kmcMH0SU z!GJ7diOase?5ow2-@22Nn$ggKgft!RTSDQpc%0Wz(`41@P$5Oa{vue{yQrsgi=taP z{CvI5*_m~(R~D=?--iA4p*vBpZu4MT5(z78GBzhzy3M(A?iAR-ye0W*Cv$pdn6eWS z%wNfJ-P4k=Np&KQuo(JZ1`78cL>6e3jtJ+B+J9cU@OwVQked2nI-) z)AvED&N>8T(!U21f|QCYoI%K5AWUT`-1-H!O0eE265HGjY1^vhPL>s*B1GnVo{9Dz zEE@O!ivtJyA}$KW&^Qm;P?t^48o+okc-*m}=mlk-v1B5a{qsk3fePESO9f|Db}~Zs zhH}``SY=+p%87!;4vz_k!p0$0e~5p0t~0!g2A}~To6&6|jF^s|ib?=SDXmg+A%RIx z6x7n{KM={lfaN&q$?akPO=j@Q6nZhGd8`dKzW| zfCPDR^$nJZdN;#E{O+D867wjpj-}hV(r^bo8{h&_;2K4h5t$|7=afWTvy1wZ>QQ$xs(Zn!y4f|S&c z%4X7l6cu=19l#)k8FTO+j$&vzZoDWdE6PnkX2D#1@Wp%VyJV)?w#`iY#LSY@SL%3{f9MtD;c^d`)e8)M~$Vf*+H2Jn=55f8`vYp??{Z-7e z4Vooh=3rooo&GC)vlQnQUtU+|EehYN3+IH(Blur9ZvPLG0lUgwO{Li&lk+hUieXH6 zVmr(3jymbLedeSP7k+n5z0gnu{+C`_>M`6%a>jaK~Abq|c@iXmL!7eY8-f@?- z-DbIv9{Obpc}M)Sl~^qdyXj$Va+b5ai0Z90$%@ibi4mq({IR2vRG@FTM%KgMoP$d)Shb=jCQuRV4E0)esnZjPoXea%=s=rpJ zmq9*Y=#ZO`*}>F2$dWA_D1Y-(cC;dCtZs9BaIic5P=-~j94pJ~NZM!`5p-d4#JN95 z0$rz6qZ<0)j8tdJoTyPM^05oG*ar@(-_Y;5&Sib^)Ln5J^L;JD93$ z7GxqJs(Q}{2AA+O0OXwnW1JcO;yi1%Bj%H;kLjA1l`kk=5fdV-b;$d-Xqmf_a0;;x zv-h+GQD{$%SI|7Rn2GB9C}n9@=8xw9s%l~?mYSQ)64Pu$V%kWYo5lWt*?+rT&>Va zaPU!z-I3pXV2hs!L#K;r%?FjV3eoiKW+>5cSO-x-^wDhr!Q}#)fL=!8%gMI`DGw5s zsMV8!SOstbqgp85lvg|q z_Mg@Y?YIGa(vT&4af3-hF#D(g?st`mmm$c*A5v%@*%{5E_3}WxLn+(G{Zx1A>KkqI zCn^mx_a;+{Rcp_|VUfc>X0khIo36ej?yI2rp!V>!Zx#3IZ z_8e~55_wkPWt4hsUeXZf7FQ+XMYEt-GlxF>!@L#b zQNfQLxAEKXcZTSD;P3OK{=YQVB73@ zPx~Ec(W`IKYEHk}($gAv!@hvWGQ47VW3d?S{4eOy})C>s$4{6cC<6gU(;k&8P_j<0A_R1}XcgFG_@psHP?Dw~sqP4(gJ zt@r#~GtMizHbhHqI9jP6*`9pqQ@9TlxI!UW2AKgK{HF|(V7SNz9k1;^kR&NArWCJEf#sI z(dVZ&BL+j{2u{`0^HnZ~{N1#Vl8`)dXSH>HP0${Arj`~`M}yOO9!-UVRf&mrp-yGs z+eojxW9V61zVmAo7dY2uuBHz04-jrQsR>&@C&ngDzW#11z?(kQ6lEKHf1wA&1y#Oj z#Helg09Uo`3UTn&Kz7bI@#wztU&QKZY-Q4_qGW5Wi6RAbxb1hd1PLA-V#dRFN4X@I zmS}Hzt&R=%w$DlOPxAYQw@PWvgFOGcAP$|Lxq=iw$ zIak))tR^h+<-ztRi^KN?MVF)Pt)sC6w1JN(Kc4whuxhQMN4<}uzdjRnaJ;e4_TIOf zY6j#PQ5UwOj38N3Kr7khl^95Vnm@k&dEvAN2>hdgY_4}s_B&qhX&RRifCgl+5SZV* zJ{_??HceyQKj5`H7lH!_vxgK`S!q&7s9wCC#%lMQ^ajivna%_ZVCl3{Pa@Q(g?6jc z$;^4wUls4YMuUbsD+K?iGt9ZR_o)!0!d5+9V(2HKf?Y$gorYjpR$9-%M81K9YA9xb zz)LnD4uJxCh-HnzX|hI|OUIoOn?7~V%T*djNN!=Mc4eQMf*OO#dFt%ThUm0&b^US- zZU)5j2N@2QEU95@Fx_zZd1>Xv=Phv)?{xQdC!PgX9)$eZ<2osiV?w+Hc7DQO%))C} zbQkBFTbWycHM_ceZQ0J*dl?1QG}2Kr@FAP%%~2x# zTq_}O?#x`veYb?NzN>2k#Fyi(HyXx18W)up5Ip-7uSR%`dfMkEliaU1>!q?X` z;)qlgR^yL#Q(-?QGtw*PQ4#7(cq8p`zZv)7YD>)d1Tvj9aAvo_-F3 zTUC~h&dDa3B_s>>*L>hs2}%}yO@TB2Ql^q864%!5GiOC1hviSA@YK-653n03437Ai zo0;IU8I%l@7bL6^oH!Kq{clj2=p)%7n{W;NH&HbOt%_!i0RDzz3Hd*B1c$DVlnNK}k<8K7ppg%do7QOkh~LFq}akNJ~xuzKLL zN8n-GFJ2~AY3kI2F-%uf-Y&`SOM7Wjg+ohHdc_7G;#iX?Zva|Vj68YVpEi1=Jy~pT z1^^1-HMpVLFPkEAc2#xp%KkXcvcQ>p6s}Y=MW^-YFpylvHap@idn|;O@bj{l z!WH~>+pL&OAzt=B7Xq%+6p!&p-psvwlDI>$PP|%Sq@zqETDdJz0F!J~%m0vt6M)lc z%vAIh*Vng`UciZxv#M3z%=d=SRy`9x?3HBR<^0bS`$DiQY2u=fQkRz2+h~%dqQxN6 z%9-%#K|XMWy|2_`8NYL;-uSxw*MF=4I~;chc>>(E<<*cz;wbrSTQ2Pem^(FaQnTPftI@W`2!_5PcK)ue!R&>)$EWc89- zyvf>g#^wNGjfD`q$`L_3joj{&L~aluj7U(p&zpDnC+e@z0>@Z?+FK7Z_RJp%ai9A0*rOZa`oy}jMV(?IkJPdoim zw*yC*R9~n&QR8X}s~dNWhGB|MPM%3GiEf^015vT@?0fn<)wTLYna>4+F$k1XQ(*=Y z!iu!Qu0^V@ZtzKuth$ekZ;LL7)|nK6M%%79shBhKRfg6c;56~&2fO{8ph9nW^VbCL*%rUd{gE`cx4M?gR^w&~$8DK4%6PPXKI zM303JS|&sDCsQ9xu*a|TaO}Um&9LfIoa+RuNzb8DE~FQRmQtS9dBev3K0S~u8=Kd@|$Z3Tev3pC0{g3ZZFky*{XJ3GXV*r*HrL9L6pPZRvOY@ar$-E{2 z{zeET$-Hn1*31vmX*)3@aq;lod7o6Ec)B-l)AKmzc6-HBi6nyZ=-T)4b8Dpk-kseyCfQ@1k|^TAP>25jd4`6w1vqqZImo4{W>N+ zqcxuqk+f+;BGtx>1mSbS#SMB{GC)Ll|8$3OG1ko81C3+`HqKhs{Bw7ff4Mu15 z(V~np3?f=YyUtqo^*-N+|NgDDU-n*m@AZA(f5-fzt3iL8{Wb{+2|Zj>_2~`W|E*h8 zH)HSek@gK}+%-+SNJv=t|1DDZQ_#yZjI>LbH*_ICy6_DHYz?+n(|nk>*BV$idWkM`^Zh{_ zBJRo7ZJB9&V5sB)@&V&L``#>g(u9YD@VYRK&23#&+35D1B7mvZ4&<1DGu=6KC~4lF zIX>h1@uTrq+e4w)!u$f$?si{tsWz@GrFTU%hR|_M-P1$79pV=6;IEBj+(nPhRl5{9jr$HPf`f#KThP(^h~o%C+_2cY2Y~qEYUfC;)hPmIaxYP+Zg6cPgx$J zxk|sUc)ibdEGUGrP4mvRN1!#NsI#`-T}EqWfFu{c0~w_Eis}!^WE>vZ3^)16ij81h zyHK(EOds>dmMd3OcOHy1d?=QjWDqLO+8z2j%CG;StESX8?Q8lNzH&2lJJ--(Ea2qOqy~cw4lV)g_wKo zAPmA})I5V80YQp|LN}~pp?!5Zg@CdrU^$3A`7%6%kXo@Kb2fM3{8W(3JipM**8+JOy(oqFz1JK^9gTHV$dFw}P-o1)w0C>8&+{8U1OZ1MZ2 zR-?9rJx4iYSSGRCd;{ic?>lG1e)%d7YN%)LFPbzwvbtoFR40pK+fQ#tn1u2wu*r6*G8dHrjR>_0i2qg;|ZF;PXP-Fw*v*>ug9kPdB?I%%bJg6H{>y zzqw8qpa3+QJueG0d^Q7d+Y@{A{v972u(NNhW3y_7Z8MhYrEc+^z~XvZp*@^(9+A&c z9HBgPIYr&~p3opSMzT6X{p;ZM$AN7H<(Wm8_T|a+%>(Mttz$r{V4}nEFMd$QFcEhR z{q*T&l}STd=0seie4Q7o7Ovqn_!|@|*6I)3OVoX$PTr$tupIjuLA&TR`uKFAL3ewb z*li_c(?E~-^hIv6r|cQ`3XMNpy0q4H;ZkhCva?@06LX5#NV0!9In_{iZOFCz*!ovW zow1BPO(=8clvz|~zTk}X`xmxIdh@#G>O@5QZ#j`l=RS9sI6J*&3NQ?WU6|_~N%EC^ z6fAboG{oVyk1vJx$WCxw{#qsCf}>yV?-g6E`b~==Vlflw;O{3?Ay#jpJrj4;?wY(m z`#mu_dvF!StOw?m8|)8mKL%bYk+cNTh4S#k@)m+t4=Mfj(H7C6ef8xL=0XqGSlfeQ z;?hNKmhT%F>TrSRKYc!eX;I`8l?;Qg9pY}zpA#AsDy`ZElVblp_%bc(kUNhtg z!V>OG?42whMB!>b$Lo#A9Hh>dL0)#5yN(bGM~uQOIbl9hQq5c2C+^qZQ8k|ZHoRD& zF_{EkUmvdvyh%zbAg0GgC{~4s5j3kfl_&3&C$sb_$;|Cr47GH%MvAu>qLvY*A?Mas z$5e*y{L@f*cCqDQiEB=fo2jxo>}@G;GEeBtcj*5_JL^3PD?}_BF#kOMeTD-g^1lu1 zI2g&y|F|U458uo?qhab@=YzvY%!eOd?48d0+hShJpC<*69$p{aX+7G09@MaI->RVK z0UgQSZ`IRZ0pNSB|W=)602tPLqjvkY)j>%fz#0Ie4elp5yLAGbu-zAmWA z!+h>?2UC%C+5nQRNe`>;I!t4&UY6UrpT3m(P5ZMbjiwS-w?dmNZ?IfNcn z_u|rY2zl5TbW+4CUJc4;HIft^gqwB&wdSck1rS|E*uLl0l5pu(xm_tKVR{+z6y}z zvRD+$kfBv(ycHQrLH1p>NJ3R#wQK^rc517q!!oO3AtFXEwvG-^^SW!Ade&>isNYMIw;5#iO6rTko!st$^X64tJ*CwMYA%-F z-tbSvo}puqC+3b__o9Ciu_7wv0$2V7E4S)TZlJOGLA?(_DU*2ogHzfF^u=lfYk9e| z)m$1`N@|MVc8o@boEKGWq5Ge~!`6#G*@jb-2WyzC$cxs62OrvZPTu9n`n)fRb5#~( zKr-3Z+!shqmV5qa?TQ{{as2oW5Z3$ND0sBV!xpXsx8A=BV`kNP@R$9UzykM-%MaZA zfCLE2S7H$e{_L_i(uv04S_!Ur<9MU5u4NU?i5lEORG8y5aH}7lqRuiR~=qERzjE1YPz_4 zv9UhWH{uRy@nerA6S^JB!+48QSXk8IB%YuNi*b~S)SY~Ai!78!-0kEEUCp&qsRGX1BB*Fw<1(Y+Uh4Dl0zSe>qCp;Pe8%^My3b5;i zZCJG%CtH1CFzY^JdgHCt@1JiBzry0F!_5xXfLE1OuZI^YSZ7-&0F3q8FWwj@=?CVoRU&BI|zjWP)S* zB?J;jG5IqHgK2mDkK!o^*Yb+04yU@6p+3%&{WhyK)>F$>grZ32PSTsgx4Evi$Mr5i zGt<7b8c16-YwDx88LjWF&z1%VNN~5^SWFdr`oJOWuO{KOZHDosCAb3$73@q(34-$q z$}tsnD#-#$8$RVqwd7J9PQg8sFxnQjOy6)OoD-KcvU?JGQ>3di2h+J2P2XYkT>*tswuXw-3a#xEANqsZ@QdT_9!H|-Y7B6(7vkpv3r!tcC zhvLZjSUct?!f3+8XcQTEK ztWFS3mz)oy4=D*m`DYk6RJy^$%4R?y>u6gr75caLLJANsD-ai=lS;hU^%j(z_>|#2 zb87ljpP7LZrY^?vH<$p|)ly-kc=am4&~Vxc!WLQD^(NI}^d=f{o=9}tKvIg)o3uYW zs~=aH)rH1Zu(K>kQCISZ_{ooC9`a94PTjm?q?0x2&F)Fe#VW1FyAQ}Gd~PnR`75xf zU$ay)P|3NBAVQ5TzF=qd+Y-g6q7aWG)0DXjsZmaOSi+i?OPq z8{s|k|F)%i_dCeq9%Yh%3_c>Km?=|oMA!N`WUv(GPw220@djjXZvH|G6Y#UuU~4%} zOT9b0T)D;o0F_-P9TgqbxZ##&q zyosE0a4oIzw{I2DnIlJq{l#TC?5TqZ$&HvtQg9Xuz0Jvpwgl4?q-cNKeF*ys}AH2t?KH5Y={!L^Pl^1{G@~TR4zhD z6h3grO@$8Iu=&k)S~0pMaaZzN_w~v%-{uqbP*qj}!^t`Jt%Ty0!3F0|he;|RfEr_X z2;oq)5PQGli&)B4{OmCsnY=HV~lxq6!jSYYp zRrT-s?0lI0od=81BL{YML&4IP%DBDi5$o4)dJzoz%pORjjT8e51ADSk!gY(||7u## ZxVPH(-aP=T{rd?(0$0;jtyZxL{SSY!^NRog literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/splunk-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/splunk-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..925f90b44bde9debad57f48c58890f97c10a5f47 GIT binary patch literal 4576 zcmc&&hf@>G(+)^Wq#LA3N1A{Li1beAO^Ng>UBF=IRhp3!B2h{t80iR7BO*lu2t>Mo z8oG2udhhVd`%iq|%CL_G3KxJ}P7K@mvTM@cFCatPS8^dk*IyfO79HjTqLtCd;jo#Qza=mVLmj*W08 z9L8++Z$S)7M|@SM^_4TV^;L3AMAp)86y?WJjN98Y>t2BrvRFI`^;0J4@@El|5T8{Pg^}PcK3l&AfgdRV0 zt8e}E#t#c~fVN%FN5_uzEm*QehK6M4_1JgPSu*y(<(|$gR zWL0b4D+vh=Dv|)OUU7XTQU}3w4HV+4Fp;A{0O?uEaL_kMRjC;9yEm27%hnYXObc-9 zzjqij7rllnmk{egQkRN>&d<-qQsVnPxu?h1@PP;*m|2g7nVAZhFgwswOQqHKNx@Q{ zKZWvM-CbK}XTJLS`b2Gkr9O;~t?igsz?aa64ABECtE)mB^uuFghW7R<+hJ#N+2M%# z*1>z%@zjI{X8ce*aUOzJkKA{*25yIGUg>bPp>%fthms@bz|p|CeZ!^0bk?u*B_ z@o$Hfpbo<(kIrLgXlYme{uSn+XI(+MC}6h3R6kDzoLx|wlx*vK4>F-F5PMfHkztVN zBBLvd>6opVKRm6m^Di7QEFQ+J>IwpK`bBnjcLSC4gjs>{YHE9(^W+oA>(65NqNDFL zH8lYdLb`>P^ys)K6oT9efY$;(Yez;z{6#`)C;S$cmfY&?5D03RqQ4354ky{zrQG<= zsBeq0XmhsFp|Ng0rwB|#D8W<_EX;*`ByYrlq>BP##T7+cOALae)V=umssa{+w)tGzbv!t?jkAhu?Gy=HEX(($xJox%Q)< zqE(2#sQan{twO86cUp&OYbMqK^xs+RSP`{3*aa?jK{}Bce7`_7r)|safm_urT}&}s zSM2QG0CMCTZ&Z_v;qYtAx1)5SP&Tyi(6u$!%ZtOZ3Kd{$QkMu97gt$zb!oHci^0`L z?_!_rGBAvp;PYoy$)x*W-;jmHVgp4x3dGPx#opfDGy9}J0C#2OrlWt>_mD~&5bMkgNq)=3AbdWKHuw!(?OIeZK(s))Lea0Jj;JG?4;`(Tx2;7h0zW^r+iVc zmo74izfPW5L7|R!^H~%7cJnQA*qzT9>>C1Z-T=wwi?zllU4`(dyi5x$@Mq$QM)rx> z^vG{&8%^T7>%%S=I-flT`T0DaUvCH*86Hj?^7dRzs2HtV6i*Q~D=I8Zt=f=Y>U(SG zE3|e-TS`Q{c9(J)^j|*u01v!+TNu z7#fP33Rw2C#|eS|X_@uP-)&$<9(YitiE9Q-1wJfD_CdjHMgH~7k9;nt=>5AVC+bq?ncM6~Huxpi@+Bzpq<^9N)$trVNv82*qRDH$hjgQn1-(a&mDAVoVruXMuj` zHcd%hug$N~XGcVhS(|lBtQq?%soJYIi@+PX~PslRJ^D8*14 zukRZtw`GjiSfnerS2H6s_dl(N!?=?}2RyYI)~4fwt(+ok2GG3#xO*3|vbrhCL0=nl zuAGvRQWX&pM|id}Qi5t8mw7U+N?CjptNwuYyF8Yl2{*o4d^66kE2QG{aDXu-MM;)9 z&u%1v0GNOc=a);=VIh{Xk3PMW($a)dr}L@}tc-Yt9ZntAj6Jp4O+p<1Zur{Whmot| zOt6%H@KyuGN-`-qzW!qrj@?y5d>O<8r$vFhRRd>31`cJ}t8XGf%*K$0V_Y|n&kQ4tPno|?~E?F)9p+p$nx zDVMkgN_qh)d=Y=-Wk1HQm$5CKnWaCuFHx2v>lTih4X_f-G=uLf7^1s{>#(hh5-uBR z@b_idn5jEC^w&iimu2oWpnbk3eT0}jARVhC+wAOwf`u2f91a90f45g;1)9duB*c+l zyBrhGmg%UF_3_Td-t~_k<+mq4t?yAq9!+dUAsXSET3~%qezaw~chgCpT-|{cl;@&p zfN&-PTYNLG7E4WG0aa(o27TwC7rZ9o9`Wu3?zOU-8aUSh9LQ56PKEx7)~V%S5D{52 z)qi+jo(7cw+SX0{(R!2heaz>s3Ll(u+Z_(!rNQcgcdh39%rn-63%31zhK|#S@M9(w zm@<6(xP{{;@Ecw7iWS;j_D%pMSr=_3k@*GhD9x^{ob0jaA**jT?>kb_1f1c zV~Y&Yagm#qp2J1mXMU^jkDnBFmvW!XhBR-7?EtB&HgDEgMZ7Ss-Tk=#w)pERKiM)? z(2_nmoX>R9sA<*Xx3P|LR$9#B;^MO_r42J7&BrUhE3wMq=(srb=?MbvE>m@vZ@rs5 zXCpeN!!26(x!kDv@Z_+z3|Qn@ow3cRLM`dYt6?ZbS>I3UlF%sk6Fy})H@sT!A18$v#`XCjQ|mo92sB9mY@~c zQnNhI?YYiJte7_m2=As*T?jwfU1j{o(9%|_4799JLJDhUfqu(X4BQEhETK>_8) z*Hd18cy@0cnulHT`c;Koh9Q1N>#r&N20_95HIIlDCV9%4zbdRfdZR-xW2Pfk{gqWz zp7r$%oEvA&JZ-c9drSs)d&_%f6;c7>$V$gto@VFBxC$~=*~M9+$w75FiQQ>op?icb z{tkC`jdaWwF8rg^6neys>HyP!}=qQZ^wfF55XKIVHs?>$dar-u1aY z4E$_6A)#nQT+{tv&6aFvRuIClblAZ*xzdKPu^77tvSi(1b zMxkDyDz64g<7={qF&{wI@zH^f)X%*w$G2VHuXB{^u?0Xq-S#Olqm-s5{MiEGBA3Y= z+v>usv^@(nBmH7QLJ&`?Ol-@`+qXa|1!862;J2VqBB{d3_VxED>(?j^cO6Ucuuu4r z7pI=31(@1Uwk~Sy{>8srsM_FFg@Pew{q!44`Wh$Z!rhv|!FN6JnCUjN^p7n)V*?uZ zXCzDe1hP++d+LQdo zKWFUhJdI%d<^BK$HMMk#VaI#+&n;Z$%{Biy=cSZ*?=GvNBy}sd>x9VbG2ev@Q+?}4 z9j%%U{Fa#mVWuJ{&i&5`QEAI3b06jJp-mWJdj<^psGk6u60_==i_^`*6}M|d6p4|j z^=U`rQzmC2@$t%-5TrxKcVCYKqgpW*LAiB$?l-;%9r%UwT7Ilz;f~qZkd}7d;JAYV zZ!MdM5Z7EE4#^r#;k)ri9HHv)Jo1H-JxLT7MTr|Es%)+aaIA^snF*!PkP9pij|WG? z*%$F1y;*LunCJMOTT@xuuC4;+YWu>KQvPQL4TSuPTO%G^$cHJZqIJH%jCf=I3V=XY z>qvXYEt1Y(>8nWyevlQkzjGEwPkc3a4fUieAhhQ4%i+q#Kkckn{Ldy9J*JxUZ9aNa z&@%BB6%~P*#U&+O?)v}>_-6teZ4O#l9m2!+AQA7Yss_Fq$*>~64V2Sbv(iz?VA8Ct zZ@15Wr+Bwh1>%hk;>mZRYo6-DD&h5Snz6BEsvdWE(igm#3h-F$VVjJ-j2;V=8JzR- z852pPxvF%1kfAy<9r1%3SdquW1Ew{qyTvR-j@snRJhiQ@%@6lPA-B6f7>&c>9IdAD zp-g{HrwQ<~CH{9iGyf3B-KbdIvDe}s8yc=5yDY4z3*9?rVKckoMEb2{-FO?xt{)bj zC$9B&!G0A;YX!@dhKANkqw%(h;BbSs9&V0V=KkrmO}D8nV{fq=l)bOZL*mYnqvvdB#O0 zcErU|kc$=>j7iv+<8P@en5+nV-9lIk>frao6k{WGwX5|uA6{o=O>gOeZACB!{3(KQ znlnuUcXIo~zDz&norfvbRX$b4nu(f~!uxh1g&AjOXXZ#Pv~ZOAABIddast^^WcaE} zHMXKe@g&ksK3&>keo{WJya)DaKd>hn(Neq%?>7Z2MsS*B5OJ?pCmjODCqO)mv}6vw z&?_t&@ewh7oA~SL>E(l-<-A;xnwAe~)f&6>`4)7xS>h5BRMA#G3YvWa7X=gRjWT~Nw8qgA+}(;3q(HF}tXOahR;#of7m z?}z&r+z-D!GiPS!?3~%z-DjU@Ee%C{92y)H6cl`AC3(od`1wBoFaC{#>ldp30`_Mm zLst|O3by}1Rfe#h{7YiFDXS}B{lO;ums~Fwl0`wGZBUk%(e=tb%!7KF3}hV#>h0u8 zt?)K^EY|ZJ;|`06ED)HD*-(U%lBS38GQFi>hh-_h9#LoaWEa)Uw0i9-*fs{sQloec z!?2K5!W-=MqVBP2!KeD%5!x|Y&tva&xw@mfLRj%DrLLpN>L4KhDR6pbf5s_K=UK<8 z^YWFRtbH}`r4!TS6+Rii5E)?1^*=HnrR}Pf*-2V!e4CFdf?z%Tcn;l+Oc*DqXr}Yl z_gB@K5y7d0hHbrQ34~>)bVJs2;SB=niEvABVQLC=hOg)BcH*Zx#b>|L8EEsTM?s^? zgXe@S^l+ji>U_*xOCshfkgq^1vCcc1{2Z#Vj1cnd9ZsUm{}=c*14b4jJ;fN|EerY*4wB*LZQvp+Fcq&wC;ZmptJyO%cC0w%ED} zqvFrU0v@lt^R-%Jh7BSpC~BIuGF#zkSG?61bO6Ce`wUVlJwKnbG>dUkr1!@W-!K-Y zxMCVax-ue(RUHL9**GVwn0*smxASTZ?Y0}^!)L(o0`j&*xF6^2L(z#S-u_>xf> z!Bb~XFZ|vllc`s&Sss%bYbSu(mIJ(=tNHn!zsF9LIMc0!^IP2bks#A=KFRREoTh0$ zQa)QzY>#4_9M>InP3bv_sHO|JF$^J&jCm_S5Yy~NXk;HY!P-a{$o(@gL_m6crVTN{mnGJuQ`i$S!hKsPOcl|y13QpN+TIY>MjW*%Zi*?I!OKFo z*S@iOm!i)!erb$3RgKM5na+w?=SoxlOde!_lVq28y2@f4MF%L*?aI-2c(?SU_s|?q zj_AU`B8Q1iR71jpth%$0fvLkr4V$J{=PzkT8&a%+umF7mi000vKAMtt;ow7P4rpYm zOVXuPC}g6T8VvDww4KQ5WcL&Ycq ze~autn+t%y$9w3eD=}e$sux;1f${l;0o&_FqEN#8S*X%+GJJB|gNJ(4~ z3h(wa!((GYpZ~RZOl(FI;;%^l+{moK?0=NxH9xs#VTbtO%UPRhTl|B#k|0#x#-Sh(EP=xa~ZD?2?Bs(qXfV6Ilio6+e8Xc?7| zs}%^u_#TND0AaDM_oU=xm~1tO3od&(uld@g6q{dju8L{-q!{pIs_H}ub&C(AeX0Jx zw2hd8&PFF~`!Xn){n-((Gan2Lv_aJ`4!Oc!Oi{Z7OpiUkpHG{XmiXr#u$rviY`xE3 zJp`+4NV?mk=n$l)=PX|?YLi8Fl=U@bM7G``EW(JstOmcrD4%lUSii5*IdGJeth!d) z_(u9g2fCEO!_whlx%LCbq$N(%UY-lTr!Y&$sP8^a!>W896uzmFTignrqk$@=mMmN! zpnAN54u3^l>kBn}G9-0W2_E~RP_2#gpb#?PInVF>vA_>W;kPm2GC21xpKIJCk?0*{ zX1V${G7ShPWmKWeBeKow8RmAHx*C41E0Mq-Cv`rlO~ocN=x5GU=E_cg-X0@nnRU~a zXojKg#EKIPW>J>`?bkhu9?zWFh%2^uoDK#GCG9&C+1Ny*th&hbE1Yw;`k9xBzP>LK zvO3A|OowP^XAufg#FL@%3e_IYNZciiE;2;gruFFR2p%TBQn-{S1`o~@2^&G{@W4D> znaKsMc;(FE;Ac003uEN>yu7earH?N_ zV4u9ixk8heig?S}&UvQ8-x)qRsIhx%ts%wE)|~U0Wew!t&}4@0&6k=zOQr!?(;-2S zY_0G_<1V4}`mew5#nk0avJ?hP-YiB!taA7A{YHbXTDOn$b?Bn;K6K~4nji>PnSQ+B z>YJ2`)TkgvoW#kZF6q7dwH0^wFa%Jea))RuxR;IHER`*61vDb^Ti695rKyIpf;v<+ zRmm?*e9o2j`FO=EAA)#q_CGOwtYWP}Q(udM$<|ftolntz4%ynF9x!C$e>&2K2VAp) zlI5u)=7DI95UO4j7U`y>82eWsYwxCcO^eOE85tkGpq($ohHYMqo!Wms4vzC|Wcz*; zh|@vh76yD9LC1~dtjARGb_pkP`&Wm#ejc0bbHtrfW)g)7nD~V zeI{ShPBrmBWjTTqnCIV#a3E6Eo^#rC$LXSnB~nC5e6ja+CetiKdG3D7^E_9MQp%o0 zkD~Fwha=~fSOi$sQi(KipPsB2R@`am1=Mb|uys!{4!eDFcdMMd24hma@~Wn5VkOHX zk_$Sq8zkJ8>hY0gN1^B6x%@d5nO?g{+BH^vM|*L8Oe=RdJA*43EV|==Uj9-?k-9aj zr+#k9_cp9t42`hs#l|0KECY#@E?UWCx7sy~dnzH8KQ2z(C=`-OZXI`*BM!{hDQI}W z!0s!ijmO;n6p~APM-Mn7@XPeriv*i} zT$2H%^C%2i7+!usE$Z<8dSGb)aXt^p-5N43>9|>Ur4#cD<2;qpbbEmyVl8=PAJ|+l z_jsC%Y%`A-*m>131)ytj3S;SY-@y92aVaMjEB(oj69ax|+W2_Sr+l=4IVJkK5iCy7 zyQfomH@nI7iT~oMwuK0}96y!9(2|p?LXe5x=~49eb4b&(e~=ZAXoEK3W~oW)RnB_6 ztY*%YkqVJ!|Mh(T1|bycyp8QfZmOC=>b*fenVx~j$$5RAFAPs7{?J9~yP27rW9MVe z*Ph`}qJ)KgD_iQ8J>iCxaC8~zql)|Q&Zt^Eg@`*=Cv-F5f~|_QzLR_4^Xw3?Ym-H6lu)$s`(x2%E0oe) zStXvRxiPv;dx^QalvG26hYbblqZ;k5nr-LDm+jh48K3U=8;4ZxW8*&UhSJ+!K9PPw z{D1AS&ecYniC1rwe&F2eSA6}q9xqk4J!XB2QpW=s-!@9fv3Pp?cW-h2-wupsF<{~NkozczK3_b6`zi0%v<2-xAzC3JpW|D7-wK%U6=7`mM)QWbzRwZfdNmM@^ zrjfc@!5n+O!o1=3vny*DtQezu)4qz+a8;SkB)QXV!jYvXK4rG=Kifjszt)ZS={u9K zvuv&aT7T91Lfi4BfIKASpa9qCmz&u8lgT&Iwzr2)3}(kEEuBr7z|LV%p-H&@=Ml+H!K)~Er-SSBM@DofU%AWQ-u-5T8_q({oF0Z>z0P|B6n6JX7v2G+f5)e@ z>np9to<2}oEco*!Q1iDwaKnI%w5*mW=*+a@jtj(=x1_wRByEb z+p2Xtc&$qj8E?yWeKw&Mw5w>qjvuUrE%ScAhqNv)`OM?1N86%Vs#;vE#yxtBDWc+P zAkgr+Y{L(oQHT+?p$A8Ke{6%tOL@(4kUv~QC7A4Fu*%fIq@bPalKLdH%1j;`UC|ue z(j7n)P>+r1r$c4XM`PjZ0$-o~TAiqmNH$gC9+I(FSd{c6$`$0cyiKIDgvg=P_8Bc+-eSaWxRx&9Kzt@E z9rlPp;9%%}Fd2=j9TTg}t$MPMD5(gSunjq5W|FllC8Ap>`15_O1u>m=Z;8r zfe$PJA3uL7HD&czn}<-u5fZ!UvyEzw$q&-cLrbLPol2S+GZepf%>($=X2@H z^sAPtufOV|I7+v(3o=TzV+C{y+n%EH3!yc!!_7(QyPxPCJ*kQ$5pGK|1Dk-t{aPtS zv!ie^QDW(ZpZS4?U@eVH`wtA_9a_O{d9;#Sw!^pguql%F1?L8nufnTMGL#)b3oEv*Cpx zz#Me9r}u{1WwEl3=bJXmcW^x2*Dt^O45<4IyzihC6=;D|h3sB7iPYJCXMb99o#zA_ zaH(i;Ft)`azR9|S)ZJG8zAW@*cv(tBbNbzK5w}RI0b%w8;{IsQC29bfvaVSeA}i(R5bD z+BG&vxCkV{LYIF$8NZqp#;!cW3N@zsg(~ZgTK>UAg;S6cjMQ;3o>$RnkXz2)8 zm+7mI%6S1qS}b|R8ds<`caUxzUh7;ag_cgrVyba*@s!7<@_?FWS#0regXz1y=_)$W z?H%Z^ykQM%Wgf>{yVnfNTbTNG@Z%>WQVOMde$x4t5{@|Jb z`f2cHTBws}{n5rFSt74&f^yych`&6u6mu}jMvyv>6)88q)}v8aVnA{Bq9B^vQR3;H z6QMIF*Dm&w8Tfe&EIIEPHYDg;k_KbWo26$Yy_r?I(-Pc6 zkK8r9rQ5n*lYF_H>hQ7b_SC&J!2@;_h3~Tf(~n6IriGe5QjC1T<$ zFcG$KUZ}@`^7oAuz`ZZV^IhOaZD7W`A4QHTzy>F3Oc@wPN-CSO3cBBm^9q^;#FkP{ zsE}G$fGtpexO9ft;iK@)3WL{;X{HI(}Q)gj!NgT;LwXPZIH_#=Yf{9*7$i?hHSF9CFwFH+PQWk@;&wrO3Yx zu{Gr_AUm(hyyDl4=T22cw^{r~09kjLa$bgTAxuF?jA|bNy|kkZ(mXOk_Q z+S+p^gf<${=_kxZ!SOIgvs}YJFmIw!xT;fS1Pp_k#Z$+-wuaYK=oi!Tb@F-FWzAK5 z0N?SJS`)ZoT+4mk+SVS6;S{q z`Sr@QlfZGMJoO37qsYqWe3GMsEcf{InzSaoA@VD&bjZbhf^UR5ybL{c&_K^e?V!=i zEy|vuD_1N~oV-6p*A$fS6W4xkd3vI#DZWrBQq-gFI8Fa27%S8FFJ~#+unptSE;qkw zCI)xqGV*e^FV!Lfc)=57QTfBIXX~c-y`yCBD-5vihv{)5;@_4uhSh7XL}--n-W@V( zC36;q8xUN1=5<5%=Ri>%Sk%f(qqWTGv#f~hF!brhjDUjA z>zmr|I|sA`zR?Dy@pJ{B)ThbMbwqvREP3b>Cw??>L6bmxkWz6nl%K3}nr`#sjlQDd z$|~JYw@(^CO$7xz5_hJ7D?Bt=wts0$wnUT|FNw7_N6XbVK_r{PptzEg$qdq7l(|*=;ETZ%zUI7QS!B4}XVX|nx@ZoUz|2I20SmHZkk6}1{q^Vo)P`fm zMEZSSx9X1igVR`h0q~1xT6TJY@fvhsv#_{Cb8&1kOO+sB;`YfC#wme%#$iA2WCuoQ zW3|wMgWAk*QM=igcSNspFbGXBVmSy`lJWc1%nlC6e~38teXH*MWY5uYhWYcTt7(m# z+T!)c#y^8qP~$s^y*WS{V~(bo1@FjJgacyQxo9Jm8Us8=ue>$JMbLrh9lmvs%lROz zm3yUhk#XO8vg%Bg{uUZFME-mQvk^H^KD(R4puFpV96Ik{8lLP;1GcN1g9J zqj{3dhd|OVPY;Kwyd7~di65ft)Q;VyP~DvJ;B>h?Zmj-e6X6IBU~O$r9sbwy470lg ze~0+D-0|khVPsShg{=!_N4Z4hng|9DZ9B63aHBvOVnJJsEcg6)Yy3@Z#Hx*V1BbDR zcm9Y$t&o6v?{D!!SE?2cY7sP+$!>YS8JmZhauOpq-m6<3CHgn=^MaGMwR=d`KHM>8 z487~M!7#?a*!5ZG&JQX0ri5r4EuCb2sp37@C`mXK-sh3Viw$tiZb+Ix{e5i{T4w=Z1nH`2gfR++`8{Aw6*`n>n3u~5j> z9`c{Q0(S4f%&6R?PVqDpMW<{%qX<)2uvWny^umA;ogs^`m?%bvfj#QXtEs0Qk*gYs zANP|YzuBevQ+&B4ut;+%kwg(=4*kEba}LEVOXgmhtt^g1HgUV& z50m5zo5Z86%@3LGu_c*l zV;>I*?itQAo!3sFkvV=WM*paZ#T$wEZ?F}9HIl>;x_xdg{lwpvrCksM zauXWdbI?GzaQ5CAv>P@TlZKfc00ea!HmjEjMa%4<>NCsRQ?o~ig`zhLmC)GGIkfQg zP-N_@Y@Svh9tZo&WoUmg3&@HE%$9QTFbOJMD}Tt>WPVtE`qkH5d2_HL@A=66@9R@; zi#|3f06Cf^h8m0z(nrz^ft!6XWU!j{~tnHLIcZa;zyLrjf#FmnE5Q{^LFW zBoGsu2E=-1~8eC>oLAf`53aiGG934Tr_i!&zBM8;F+IVbmAQ}*{<}ad zYaNx!JOlMvf!<@eTQx8xGFQ4LO3WZt&{v-*sD3)2+*Dh}GA9os8b z!3C0eijT;b(?9((pXqA!Uq53zmr&| z`bbqt8J-#=p%~or|H9BZ2EoQd1lq*Q7aLntXqU<)PPlJkhYwVi8PV$z9dd!>;>}J9 zKN|{s40_&j9u}wWBeAmx|Ac@1U&HIj5HwyF1nc|H@ajG;h4>dsT%%2RlYN`|zr_tb aV_~hmNAs4~5dG)qp(rb8$k)i4h5Qfajqid0 literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index 64ef0b4db5..efc63e9b1b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -44,9 +44,24 @@ Logo |Partner name | Description ![Image of Elastic security logo](images/elastic-security-logo.png) | Elastic Security | Elastic Security is a free and open solution for preventing, detecting, and responding to threats ![Image of IBM QRadar logo](images/ibm-qradar-logo.png) | IBM QRadar | Configure IBM QRadar to collect detections from Microsoft Defender ATP ![Image of Micro Focus ArcSight logo](images/arcsight-logo.png) | Micro Focus ArcSight | Use Micro Focus ArcSight to pull Microsoft Defender ATP detections -![Image of logo](images/-logo.png) | -![Image of logo](images/-logo.png) | -![Image of logo](images/-logo.png) | +![Image of RSA NetWitness logo](images/rsa-netwitness-logo.png) | RSA NetWitness | Stream Microsoft Defender ATP Alerts to RSA NetWitness leveraging Microsoft Graph Security API +![Image of SafeBreach logo](images/safebreach-logo.png) |SafeBreach| Gain visibility into Microsoft Defender ATP security events that are automatically correlated with SafeBreach simulations +![Image of Skybox Vulnerability Control logo](images/skybox-logo.png) | Skybox Vulnerability Control | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network and threat context to uncover your riskiest vulnerabilities +![Image of Splunk logo](images/splunk-logo.png) | Splunk | The Microsoft Defender ATP Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk +![Image of XM Cyber logo](images/xmcyber-logo.png) | XM Cyber | Prioritize your response to an alert based on risk factors and high value assets. + +### Orchestration and automation + + +Logo |Partner name | Description +:---|:---|:--- +![Image of CyberSponse CyOps logo](images/-logo.png) | CyberSponse CyOps | CyOps integrates with Microsoft Defender ATP to automate customers' high-speed incident response playbooks +![Image of Delta Risk ActiveEye logo](images/-logo.png) | Delta Risk ActiveEye | Delta Risk, a leading provider of SOC-as-a-Service and security services, integrate Microsoft Defender ATP with its cloud-native SOAR platform. ActiveEye +![Image of Demisto, a Palo Alto Networks Company logo](images/-logo.png) | Demisto, a Palo Alto Networks Company | Demisto integrates with Microsoft Defender ATP to enable security teams to orchestrate and automate endpoint security monitoring, enrichment and response +![Image of Microsoft Flow & Azure Functions logo](images/-logo.png) | Microsoft Flow & Azure Functions | Use the Microsoft Defender ATP connectors for Azure Logic Apps & Microsoft Flow to automating security procedures +![Image of Rapid7 InsightConnect logo](images/-logo.png) | Rapid7 InsightConnect | InsightConnect integrates with Microsoft Defender ATP to accelerate, streamline, and integrate your time-intensive security processes +![Image of ServiceNow logo](images/-logo.png) | ServiceNow | Ingest alerts into ServiceNow Security Operations solution based on Microsoft Graph API integration +![Image of Swimlane logo](images/-logo.png) | Swimlane | Maximize incident response capabilities utilizing Swimlane and Microsoft Defender ATP together @@ -56,9 +71,6 @@ Logo |Partner name | Description -![Image of logo](images/-logo.png) | - -![Image of logo](images/-logo.png) | ![Image of logo](images/-logo.png) | From 664365dd359f4e65b4f74adee7d3e1c98b57010f Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Mon, 14 Sep 2020 17:16:16 -0700 Subject: [PATCH 16/57] logos --- .../images/cybersponse-logo.png | Bin 0 -> 3653 bytes .../images/delta-risk-activeeye-logo.png | Bin 0 -> 7490 bytes .../images/demisto-logo.png | Bin 0 -> 4462 bytes .../images/ms-flow-logo.png | Bin 0 -> 2655 bytes .../images/rapid7-logo.png | Bin 0 -> 3977 bytes .../images/servicenow-logo.png | Bin 0 -> 3799 bytes .../images/swimlane-logo.png | Bin 0 -> 3692 bytes .../partner-applications.md | 14 +++++++------- 8 files changed, 7 insertions(+), 7 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/cybersponse-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/delta-risk-activeeye-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/demisto-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/rapid7-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/servicenow-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/swimlane-logo.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/cybersponse-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/cybersponse-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..dbe2849a0bcd0ccaaad439302dbb0e8c44bb1133 GIT binary patch literal 3653 zcmd5<_dgq47dK**su)EHRl60lRtc@36|;}=RBF~%QW2wets)dft;9_2hdfQ%Ms1af zM~zUF(xEYeC`HX0Z=N6DzugXOQObP!<*u`G18KW+(TPY2*rnS(|Y!oZ)BTmG4M;Qo+P8z)X!D zB1?ai1qQkJL?={ixGWiY<@85D2=giX(6#9hD?xLSyca!g=H@Ia9Ei3Cne+bb^$vF% zR&!34bMDtT*4+PH*Eo|9G3fKUNrc-6zC+?waAy64L=)IY`fNN6HusH4ew5G$?vIAv zp<&Z0zPzB7nCi`(t9~N~Bfn!e_TptNH@Gj?n0|MDr54SSAwk|>V5M%~h8--LaVOTg zzHj$olkERKKOd(@N*;AU#eaJGfvkS^`|I_pRD2{tnH36X4HMz2r3y^POdL@ytr)b6+{8d8s4IIH)AT!u5Rgc;pB^Xr;L zCG`)sxNO1Y&}TO)o&yd+@}qR6#Q%k>75C}OBoZ>PhRd9XnI04atoUfgWh)(74FT1- zB_eg$S(VqU=&34_b;>#3)kM^RGhEC1g@4SDvue5bC&Mt-f=ldoEJT9%r#gv60a}#; zA2|9vb7QL#lnqk=*5m2@IDmC%LtO2A+rrj?ovlO2ia1+h1H)8CfJFoq71Y1<`LPCg zwl-k$iq*KZRF<6+`01cpAwCX%=T?9CKXjgy-b;`vFV!M)zLfds<4T;2aZiV^tgQvA z6>`wmyTz5~A;x)rQ;(vJIp=0y$$*{PvHnT%5ScCTr_qKldEWm#Ro=TJcX~~otQ(A{ z{iRZ{3?02*IN!Rb+0@KqFRFX6VgC}WFNFbGPGteYcEhJoq1Gw%ukANZomdBI-n0oO zamLmVk_yhVx~*5p__Z!WrQavH+7k6IEcH+<+#+}6qisuj^NAop*{p8FW?AQ+3P-ee z(36XhV_6Z@flt|~%am+M`leqFWau+AyUxuhg|i7!?{}%l4;3LY7&0A0x6!|giQJu> zD#i?><`O%D)}8oo_@Xd%?y+b|tZqp4o{5n-sJB3{+H_ot6xKxVVc!$VN?|Q7FI&9$ zXv^M)KSx^CD4&H|@J{C5?vJm1lGru@8nI*-&Y|k0O6|Z_DNA~VYdV~hFo(adbeNVF z(c%_=d31~=3%eFk-UF}4hNj@=LxKa(*VS$v?S2OFM>yo$0DwK-Uzgmoy_Xwv#`1VV z?KMr!)qK#EVG^RF;l_^d=GMY;$#s68S_p;bLxfr&e<`9w)OKvQM-TNF*pGIOaM;1T zKXktKuwalVCz6G7_EUUJlfl$pQsQ`k414zIcR0U+&X=TY>7Zq;W;YWh58Ro0SdCuP z5;&QDvmW2nbLB4R2ZR26+yrvi{QF=xuKhAt7PlEC4KQxK%jl>_?2>T=qlJO9EQ#So;gKtrgp#DWBm5q$9K1sXtz!Ds}G0z%*;@&MI zeD(v$SGxr<-P7>>9z{Xn{mU-lH-v$KEy0d|rr+tcKYZZl6=U#dZz89dO5ZxZ2WFyQ|}w%WXdJ^FV`>>fV#TZkM^>rD%g% z-jRYPvM{%v7&or+t4zP|F&dTvjI_&3H;r23m-7BH^LolIG>(m<5^X1WBxjeTEZ?S3 zZwZLp%H}*-ElMuM!WX#OG1C)3E(^LpM*4yV%*?9#SyOu85lnNq`;nIQ*iL;$$pR=C zR#_EToSF*A$Oij#DAZ?_RC}^gM1#s>uA6+G*dH{IXs}G-=12xu3-yNsF*l~ddTSGZ zy!llI>1&URGbP_EKkZZd)OmdFzP;m{#oi7gsnGD@*8vJC{3ysjeS1FtmG10>gQGy! z%@;vf0vblCtE)GEx9{(tzOf#Yf{@Vt`FEPz;z|+!=6x#m33bRroHG|$4-rWOvbl}} z*<8qrL(5UwAcjw9jDfOUgWV@3-Y2QO%Xb3;9)k8Lft6LfY?!&ZS$fou$QQyMsy+j* z)&)VX`8~j-8K;DgGwLKocsK6V1*9Q*9+r`v29!Tzmy{~!97cfTRN@6Rc4}akfO`0a z+uwxM_N<9rI?$0V^)M!nChR4Zv%IW*5~hqWP-%23bglc58Vkv1^J3a*TGx18?lbY$ zG&Y4+sMKY{)xgGsS;dOVMjS1Jz5~gbSG3(6`m4M0^p|vVR+c|o{QgjAZ0wg8P@|EY-YLIosFYlp(&j4q{3l`6de3(+SSwrKLmjg)!Q^7FeA2Sg zu#&{FmT34 zA9FVc2Gf?)`db^Sx*$Rv(D4_LqFk#~oa2>?i8m6s)?2ZWTD?#s>W~Ww)V0NF8(rLH zEbVbJa(E}>yHB@<$E?nATxXN}H}nCzmX24>1-svTtaP3hc&P^5?G(YmtRQcMtuFr^ zc}lyu0!v}J45)~$&V);8sb=*RNZG%HyY%;MLzqvLI2y?J7zy%gVEle9hAn+ZM2L^C zF!WFF>){6%hR)VxW!#WKKPJ~iM_sV9fKZhum$n!v{1W}JJn6%Or^?WWaV`k;3KXsG ztMRj|8?@h#p@}Oi0aoP7+FHz<&+Fc82#S~2Kik9%VxunXsfw*pzfL_`1HabR7UtnN zOYR|pabrq_i05aFRf}Yc2CEqQOxL2MCwg-;r21KPV>>y=;>!1#FjIfO-2voQf-MaT`mE$qDn^!_*87j`*PaX}Y8o z=*pg4g0kkqDK?X)7Vkbt-+q#voo7?Gva)iig6ahqk(88tMIwEeogFMxaaI!M>DZ@b z`nP4{1J=HFVoy%ujrQl*#qa#>%RsbjzE}SHMc|a`;o;%(+FJD_WB z@NiuYJG?b6>Q<>=;7PbWS0;PQAMv1;KnS^v%$`?QSMM1e1vWGa=lTO!ORvQg7B2bX za=CA1gQ}dsA3n^yXNF&1Rw9$hT3TAjrk0|QAOBQPP!N-nTI!t^`+-1!uAx%6E=DFK z1ZWxwU6ILyRA&B} z4vy#P)C$F1^QUE4WtDrIddbPjDKY}l(b4`7?&DfpOAyX2%!6*IukX>aZfk3s9{qIY zM)abEAR1s0u{JmNHu-4mgwuryC3xwPRWv~d8ck&9!WdnG9?c>w_Sjk-H-HO zVGRolQ`gq+OWym&e?zmxd!yWtX#qEj)dmowwtb;hKq&X_#y4Atlp+(fKc8do>N-rL z$;`F{D_+&PIo9^d`D1w5;bHXMyLX@3p+W65x4UZ>10r5CG3BVDjpvAOBmA zpBO^xx@$cxlYT#bqB}qK|KacdUoA-KUpyUuW}5Vgk|#S{#vW{W{x-ep;TA%qW%iNE zYNTpK;R?686RQ}dM%R9}YDYM_T(^rBYwH>sCdOCYe&1sYvWrCnpd}$dUq!w4{X6jdXW6EUZh((hHIj(%taP z|HboScCKr7cV@2doO7SgeNU8@h7utj6&@NI8X;I&UI*B_|8K*227JO+&sBjPuDh}k z1PzUx<$oJGScmx-IEd{DR#(8@#3e!_;LD+XY(PV!UIWX^>iT9KWbZ<#cLP^smZbz+ zqe8K9lF-mGuy8=kZ;4j}AqGFa4HkZ|7?~NfaK;yMD7|LmO*+lIM=w(;+HYN-kLLct zS;y$WQsoW*8@S3SOFc-4F{rRKhZYJs+&yIDr9vb6vV_hT8XE34)0y@!2MS$Yxw$yI zA6J@sqdq;WyLRH6V3ST*>9W(VXm2kX>G7NiA;4;iV{OC=2_nz8u&Cf(dDi_*qa-<} zS|f}YEzOoFEFuB~0@XW)xb({Gv_JmxxlzX!t`$B}#1N^Ku9ICAAAT0RNBs(`8sbdc zI&N`$`+k<~_F07Qp9KYHH6d&P!9PZ9LlR1P#36Pr2lwj@E6Dk!{uJ&{0jGU0{`9y< z5Xaaw4dILa5yKc}WxeU?dCb~tIm+J^r^z;rU4$((dkOl9Mg9>}4=6cQ)YIcAck(mT zkFpdXp#p^rSz3H_PeWbBxQk|2a9j4CXpo2sOZOf4|JQ25!wk;2v(HepQKxaC$;KIU zjG@%(6vT4OP&Bn7)yy>h?L~u&iv~_Y>pLF7F*oTMo1Y*2he!1h_|4_{#o6A9xs9cx zqvDwvb+Qem-b|~3p`59eVEf~t{hEYqp5}$N(R-zL?_=@KPu zOpxuDko{=>M1O^+Iw|BLd)n*!@^&ZRHAzs@`Lf%jiTK%y}Y z9ibC7%RfteKC%qri_c0012??X3Zc`RS#=u8WNFF2p`2J;{DaGFGKbYJMf;B`)7~K{ zo)OWREsdGPyjCmG>eZ7_{iiz*@zS}{2_w^Z@%j|zqO13?Xt2%248{N#)ECFsv(5N+ z=FqEBnp7HNu$2_QhMLGK*waSh1#;(Px^C`PLyw8)Ti>48vLed~-2MDs2NiKt?C#n+qVWAPXI`@;$0jCug(DuN4t*H1mr0bam&Z zCeH~P;En7Zn)H(tvIUkpJ3IRYt&Oqp-HZHir<~sSaUML{6w6nyu26dgdl<>^!JN(I zFhee=Qvox0q+Sia;h{onz@@bRVjzQ63r800Al7uDsjU{hvRJZ5g=%)*nh3gneG^G! zA&`C_|L{6G#LN17`M=N3%}u#zO~ts*NBafs-6WC7sC^MXagwz)YJ|jSx|PxmQnP2c zxypFb>j{Ks_nw3<#Xw7^`?AS>3{<)&?sG_?t%v#opJ>y>2__CPl_0&|9N-L#jI0xR z6CQeZMM7mMdtDY@&n4*iswC*6ds_>MXQdIw9#!V+nsWZe3C#{oijdk#t@?)NwRS!r zH0{L10M8q#^%hr!Ij{Tl=X!cff=qEtV%Vt=e9n+Js;e8nI6f@q-nm@iG7z_GtXI!-| z(;bwA+l2-y^Ok|YpBIX<9nX~xUJ&Zpaa{Q$6#tiwm5Yl^-PjP{%ao0oIZV|~BRTNn zQ~jY;QSBB^WzeG9GSarwEO*5_x4e8%LFw!jkfG)SvaVc9q^4;Z{;&NYN6p6ulsL z{(&NEfIMW4k@V*Qc&iIycYmwy_{)_iTViahwN(rhPV5{VyV;-q{$~+z6LAe)F^@qv zA!|-oY2`s%+cZ@Kvjo9JDk^0z_Hr{qJ-~yQQJ(LPLr_fAS=|Zu4BxIkr~)TeoQoU! zhT34@-KG~aNM%F|t4t=j8;JU(5qw9oBb8TP?4=-mS>Luw9}N=j;olHon! zh{`z|H%AVNiR=&4z7nMCVqQYuTIcNpr0G8K|2C2Ik6w=I*vgjBp6Ts9a;5jAnOPgW zEKP#{gDJ#Os8!-(#L)iu{pWZ1>Rv^R?b>_2=3%$L`|!d+MI~NGNpMoD$1Zi`bL)^V z8#is#5=nw?GZh*r$~L1x-I@2+$+#?oAsudC@+*9Pn`gc=z^~BAb8!v{Nzzet5$@TR zHl5?oRNLIPJ$v+f+UlN5td+_UWQ$L%mq^@DichEwyz7LpI^|e$2E+8bi2Y#`{y|S-#%p?J(im{fw6$HP$yn6=Am(ncv+xMUH<2jNV=f&!(v`@ZfJmuw| z*f}9NTNTO3*d_mwX{7#7V!_ebrOZ*$+^eZ4M8)8iO`&`QuiyRKk9u$1=f(S%3qUX! z+rwr1PJ28f=l+B;n_K!gutcEi!(qCFj4Yv}w5n2qy*O-oFocj4joC=<>Nc&~&7!lw z)o247qe3ySdXG$or=+2Sf`Po+$s9*I_gBs`*rd%fr*(eb22KxFRLMVIET0qM53l+O zvNMo5-K+5e%L$~rUz{VKDk^-HoDoSDZH8|!I{fciz0aOE*Ws$gq}>6{%XSJ8^Z#e) zjzx-LY(ZH#WE0V$ZkA^e!dU1hsir$?$;m|&PYt!y!#OYGXu*%(rK3_zDN=ASSMdN1 zpF%=s1rSnvu^0Lb`t`8Z7;+w=Kg1HPSsQN_HZk zM^vC$%{R<+N}#&%VshgThx#Ri$L+N#t8=88&*pk&Z4~-uWaK9%g5vx?dT|6AWcAL* zYtS0#TC_;qLkaO1wAAo`n(}ae>IN=*jLI~0qX=dUav8=)v!(>kee%BK|DYAEwL*J9 z^i2Qz+f>w8R|rVa#R}?_LyV!P2Zt|C3^kP8n;mnJj~_x|DjdfjTt=dwtdvXHRumEF2--6Sd`utqu#XwZzg;Q$L%jx+5SoddNBYPtiiv_A}K@+kz}o+8-jp z)Dm-SsFaw(7r~6Urq+n)`TWJsR|p5xP01+-kX+6m=&u~z4L!Xlpbyw2xnh%*zHz-Q z!6&QqQAsOzkvkOx2@us2WW;whk?xIQ+gJZU_P=0ocMb?yG3go~*?D>DR7Jmn!*G0~ z8^86}eQor0&%@7{@WQ6#x^)4`LaPx3yJ<2RrPtzkuUm~(&@9PY+?Dt|(ozSinTxpZ zk~~Vt`#EWK97ZN4(Zryz@5}gX9NZM`b4pKkb7`fne2s2mZ?2NCFsNOYW0$zi__+zh zgOT16SNN*#;wCX1glDZ%)Dse;@It@7t!6>aorX1wBdQ}noSrt;?4`K*tx;;>=OqQYCn{Sz@RKBq7fV<;I@gyx#Q zGYwW*$%A1=Rx;f`!nk2b{A~xP4YgC~$2``%KYma{8Q1UVXyLb@RU@|H-A9eWu8m{@D3sKVxJ4WXFZcoT z-BP>xm+D^}iycc*bj1 z`z4Ex_e#mB5axsm6O5_Jp^^MsK~ep*n??ImnFHl-_4QtxEt|!nleFA`hR4C zQfenB4dQW4`SfqGl>8~=kQ8dVcvQ@|%(YVNHk}1j7?t7ZOzs|z8U0G%91eWDH-$%3 z!;2{wQ~lXvMq?ZOhP!69Bf4AT=7i&|&5Ra$C*@WK$$+{X{!Km)t4C+5Eh~zRL^xNWeR!J)}#CMi9bswFzLKe>de~1`(o-YNP1XM98f4uMq~(` zsZy!9Hufb5vPtiO7K%i_(HM9b{xBQI9; z(CGM4kbFPeO4_H)s)Eb#h}zdqbeZ+r2I#!l=uBEk%sNRRFj&Pzo5@W7yNIn%BzW@(Y2umT?4wx^?a>8Tq!niQ9l?JsLVLa92{GoxQiQO@ zvo!X-hqJoa__op#CKC+A740)%*PCSjGRfa0$y>`~F^~(sM|w+|@ml2P%PS~Y>X1p& z^1k=(sDsa7$WX|AtTX)jhb$a!J)gHhnmm%ErmH(BnY)8H_LWpqm(XgWm?M8#Mn^)j zCa>7})mGG$r?|Kz(I&if#Jyi`0IhJ!(Rw;!U{@Xohlt1uwI$l$AG^Vmn)&)psGVn? z>;>4@a6T*5aq;luqHC^`0NIPC#>N;HlKJz>AAqSn_Kl4Y$#AvKQczH=WfO~H5{pz` zY75ZZ- z2ndb&)71pQeN!era=8;q9y*Lc$G=}N7BT{k9=;K+Lbf1(*@p>`2JH>upVaCc=pn_A zk2FmT2#_3wpq>`1Wr0Xyvey^DJm3-$6}B~H*SIdTuzn_`n8;aQeN=n)EV9kmaI|68 zJ3`3?hhe^5EPnJ{=zk9kP1hNe(>buf9vw0!Jbuw}<>2aI1)#Hu z-;rdxwtuSJ&=k)8&cCgHRUM-H8cchtDJM4pzMW=_OpL7oC)7_jyiXXBh@sGRrN%}t z0EXV3EDV?JiIW5BJ(xW>1k<|S;Ro!kyI6MC$OH=yD^-P8Sbt;@Fsex{p%(Y!-aVJT zotszPNUy}O^zVkV?Zin~b|u&QXX0j*S0^PCR3;uDn|%?_~?7w^ES3ma`)2q-7Y z)nu~q0mHzsAKW;K+KpU|z-0 z@{0=eFqTSE zEHgZ9%=S6${BU$Q%Idp;--y_O-Q7Svd22la~m7RFnSvwMuvQb#^xsE z)GWI4PW$-kF&_~1Y}(p!@0+9&JpJTC?5k>8xjEvI$E4?ULjg(m1EM5Z@N1=So1G(L ziE;Y}TeHH|%bl1>^4_yh>COP$nUYTrm!?!1Iodk<@D}OTSY~h<*?&g-mW3I`z@a{h zIX6K`fnRsq8fU{RH)(^}68b4``E;(h$OTi!v$r(6uUvrE`)}ymb!N~t`_8C%o0c+PzcDsL1LV3O{Z^h|^*YnNE^VAv+#T_VWG2(*q>q z!{U688}HL!nFki~21MbjGrc6_HtKj{31b5owX!;Zn-5*okf!Q{u(f`e-)RGh}b$K>Lq=+mE!lagU?xJ_}z`C00y>l6O-+fj^^ha)WbQveOIwt+oDCB_E zE5Fcjk@Gp3QA*s6Vakbbm#3%q@5|1Zk+1GaAfFS1r;`;DN?IUXILwi@+I|VP^tJw8 z&-O-l?hS~vD~b+!OEaD=-Q76+1WGxG@)J7+SO6KH&i@dkWj*mx4ZQ5}yU&eRm{;7~!qL*xp z_RMXZOwKGj={Am6zV%@{l+$an86r025h2vf7Tk@i)BtywRpb z6}OgGH^Z1=++yp3jIJkKQ@T^l*;7c4Vx(SveVisNGMwMV{B!P);Cu^O14({z+;Z6Q zF%A-mOe3SLnL`ZJ<8|Ns2@l5=k{2fb@CC8kzj0B|!V`ZKv~4B*5E>NDg@8$oEu|DY zu-A|JZ%-usX!{o2XF-*bQC3-2*jAJs1qajW>3ZA_Y6nQKj2^|cyq}7vQB%_dy0m}B z*k?XDX)yl*5u?GC*_&$M>)I0O5Q(Xv&6mkN%5xn~4A95==@5kZP&p0tWniROf6{Dm z*fb;k_<_d9e*V{4jv3I{@0bejFIJwIrF2BshTUL&8N4T=8>1_N@)oF8wL-hHB z=UF@=OohUZ|6cjdF3QULilSQFGT|EJ^ug7;ty!+r8f?!aNh6W)=|-B4fnc8Vw(t)I#MY+}AJIN=E5=}`UZXO&$$1u{Kr=|$yLa3n* z8hyMs{NAOSf|KTHdwwJM^iC_A0v*Uk zKfr0QUDtm^lm`^@owee`{X1sv&Bwv zCHp4b_?DJFYjgpLt|{*hR{< zCNk9M?i$|nKti63Ys7ES6n{MTv`0q?e64*$I-V=uH_M%A-WIv=wXN6zfU0moHV0=Y z3~=)>U_|dv%>PdutPf30kzaA}2Q2xKD>7fbrePD0e+|BWr|fzs(ec?`lxEO*Q68|r z`l$IO6bpv{Mgx5GG1gOqZla{3BlQ->dPpI~DCRJigtFy{daI{*;wv?ut&t<`RFq#v zsgC5!90Ss^v)@0iM00WxgPY8>-zdJJLQw~>55nRV36L>=#{Pa~O;l*PW2+SHZDhpG z0bN?A>ar`Zv>uDtYZ7&&d)rcJMl{-oMRE4e*3RIZ#1s{?%a|}TrF9;l&8KFNN_y&2 z2NNCh^2yxHnlc*r}J`$8j&V#jp1J3C(zzsyOU-dqMUz~bh|*O&tX?DePXlJJpMjm7l0 z9~|+z0x=^PaudhXNpBjxyiZCilWJ?Vp4%S!7sVt`lu*5)a&b{K{@ZDy^FC>NYYyN6 z4kxO#w5&~KZ*m~#NK<2F1zu&;l;<~;q_zUF!gD%#q^HU+jwl==Cf+-Ge;sc@A?Kp% zy7ZLG?bz5@dN}9=)m+aj6&IR*2P|g%wyBh4S=I2G=O=(>fJWD{2A(H-Rq48sF*bQa z)cq3mrQP*5zLzL_*T``NPyqZJc$s%Rz2^}sxh)5JLLIt^w%Kqu3C+)mTEb2} z4(-wgL(HmfFU@!8ZK;Mhird<}FE1QSv@+~|mA1QnhoRS39@ht+pH8hDx(mFKiem;3 zI!9;3$bYer{+e#Cf*+f|tB8>%x$*aeE%(w3BXtY^2g~>WFeT5{YO*&B#FyR9L_<4-=b!@^4 z*NQ>|A!AXo@8ugJB6#AzLv?T}7X%Q#U>Rzr@l^+shm~#p`HwQ<)NBt8yt2tx)q;2F zg{tHQS?U9~8w4o%>I08UDN<^s31GBU8JCz*3Q*e!3}6jao#U#(^hu=Nn7164G?~di z^7=)cS*QQpj|!MQo^jlKGpCwPL8zub#?U_z=}Yp4ARyGZV5?c<4i2ksFhIP+0q;F6 z|9oJ=Rg_Jxc@&haUmaa+T~aFcq=R4mhGNrP{EnJ(E#zhz`kXRzLNXRgJ3jyG22R!V zC#NLgTJFi8!=j~K)~M*Et<#Sn&L!0UkyBe!lJ@Q(W47a2@t$#~I9NM!j^eZd=4Wgx zu9#=vRmhO!_>{1q`b75vD@%h<<6ZF)l}wL(BUS9=_TtWIEJd5M+o!;`r`!%vx}shN zEj#^K*;YdqZ}MGcx)s=)CslG9#Txe^hvW$6I_*z&-5+j7%NRpnqLa$(8Y}N=W_V8I zVtIM9;QYLa-(IKIx!z;7;GrI*4n)O8u{YU|kD9=;+b?s2fcnVAtPsCngVPOl%RfSG zW!D;86}Psuj<{VhR$XsN-b(h-n?K*gP{LaW1Jl&r{!p9Y*5MJF-pLOiRN`b+D=f-|LkGkUm>#tMJlfS-{2Myv9DJ1&87=!wW{`yF z>KaK)>ue0#sn_`V$CR6!_ky|5x0nXZ()Xc-$aTdH2L9&^Ahu?ubAi)s2#%9{lAC?l=nby zwjQZmLj*>o8sAf!p}g8?E|$KPp}YqRjQt!|z#g+}y?_4uH@fo)7v_z8j){ywGScu? zHcC*zSb)4Xr+Tf@^NPB90){?L?z`T$b1M3Hv;3tMTKk_xcRH`T`z6hj+}g~(+ks1% zjT?&WI|6VH*0|U-$g^ZasmNb^>t8>#-#2MWM;EL{ZF#aK+$LfU`%|=$V19$-Z*w zSIVne*yl5C(S(V%?4JRR%Ps32;hcyCRo+VUcHE7I?V*VEt{@2PftqI2?2$&DyD&B4 zx7W*_r89RMmVGq?mkwuD`FQc@(rV?rpIOjkGZ^LP@iH}X#n1V|IqXJ8;V zKo5WVkvZN|%6eS@g_NZ|@GUTezwGPQ0~-K!Bq3b<1c4_aL>~syvW>hmZ!V~c%0U<8 z>h=kF#_Ng>td4(7cWRcSDmuJ-mJze4hgh+*3h`Hy^+(^ABAjFV<@{B#7zr9F?AM)) zE0-_pQ->d_mg>HD#R6n32~=kpb;r||4vw6S7_g)z75b7H%ZJ@~{X zxHfJ?`n1+CqibOy@qU6_v~fJ={BApi*6mS;#UkeS9Rud)N~H@;FV(bu^EIS){n}eN zp~&5A9Vb7HwG`p)JX^lIyB|C^=vos!hFZc#1qkj4d{-@j%U+OAi?zF|O%UBO5A`b$ zsxI5iw}{H(n+bUl!OhEJPq?BFcc)()GI~P4-x|MkFD!XJlmGg54z%XD_22PFw5Kh< zhL3|Cq(;aX@>HbsM&q$4)VTV`kBpzYL`FYfHbiWJam2nPANc!#_V~|%()*y2H#;+8 zvwbMBQD(6hv8ebERD9>`Sv9i}VD+h7r7UP!wd@ZMl}mHBKBboWNLFPpQ-8W4`1CdB zhGc4SSjwzF{kB4}_eT;ltcSMxNR3y`d~`~r;aQD*AIy6zzw%>jxrmgPEj=;IsJ;UK&;4*T0dhaqfw08B_?n&sOpe9Z2 zZKtMz9{H7B2_opL=I-?UBLCR~di88@BkRxU!;7!quV#s${b?}Jv&O^pH>>0IVmjc) z<(p$cJxyQIVATHbxXGgC{msPyg3btznIaZnR4-@e16XkFbFUd%VjlK}NHCT%_v+;M z%)Z2ruAmY!tT$mVuN2M#p(cT=LNoP@C#NPaw(^ES2hEY!EhkRaE z`^_*R4No9u!#8h1sa=@{RZ1@~4ltTJels~^nvxQV{p4VaLRD2I^Yg}g9YJHu;4Q%v z!8B;r?*5)TT?i-XVt=j5rXWnJeL8fiH{`|4P1?i&uWQYQA@pldRu9s)=0|~Y(2SAQ zAT==XnL%!wySsd6FpHUxf`7Ey2_P@y@lUna@&rxyR$wu)&FZ}>3n_R zoYQqUm_$bX@0*&(DTt@&18&pj3G1s z#`dmzPOj)~R+?2TH{F&5g_Xw?U)xwpkD5wsK$zO$<2@S}nzlcg9vn@4b}9LT*UNg@ z+gayMho|69Jx^F}Bk+GTd9vL0BKZA*4Z(Wzyowlyg_){|RxmrqcbwfB21UF3gp!wemN@{Lx_Xjfd7=7MvlG8s zVw0aB9?j2%W@=c%>>;b1EyCMPim3?FGBSb>JoBVX1O~L;=gF+Cy=`cyJNcj^kPH;7 zd50^t)=NuIA11y%6)2laxb4jWXW^!NAWbD)R#DM6H%~KC)qUWfw*N78D5S{$nyHi1 z`MtdmgukEkIUBX`?GQFL_GLTL6YOZzRw0csh||$61+A^6hKJ8ar^K^5z&krTfx@+p zw9<8H|MC9_XD|M?w{*_H&^<`@W+NqSHM}UE;nC4Y_x7|l6n4kA#0y@CikPM&5qQ}* zAa-twhrfTC*|oYT1Q_1!jH?4Ns;>a&#^P;o2pgoSfh(x|+qW+?TB! z92@~j2IbfqyEs?TG*~t_56}GgHS&Us==ym5$(J!^S|#ag#8tz&d3iETDmc*hPu;w# zp&Puj8Ux$LbC^|FF+q5Rg}qa{`T6tbZbqJSiqLR3P{=z4QJO%IJ%g8JgstJ=f2yiV$z=SuZ?J2aDI?8dZx@%?xON?1 zKR^4?q4uqXzexUzJW$H{@Ci)`b|p|a&Pjw)eVS^{J~hnr%y%OuRabi`iQw8@81MWa z;wC2@ROF2`2qkT8>2?T1qFtwo`Dd4B!yXKwR2c_{f}xN*q?#3IwlQ<-rKK!%a*tPC zr`r{-c-E$xY@;-iOFL`FJczk^>c?)cx}>rs1dWMT#aueO=UI;j+Sj+^GM354gUFep z%Nd6G&!2x#k!Ny_NF;6-K0JZJ;>!NfFXta#R;l#lPc>xHB3GnXmzY!r*Y9xcqEeZG ziqy1#3h1Cv!^>FDKMwe4n8Kjy=B^nZsMkKZ%r3mdLaTq8OkDdR3H(4>Rb&4$*Pkm@ z7+(1vqHo6ce5RXL^=Z*e>yDbJJi9i7@KrZBt}E`9w=W}4x<<)bF5tJFIY{4Y1$Fx( zpSA|&xaz=sgIrCMluW71Sg-6Yh&B&kKUN)F_{DlNUGab7`bB_kttWA_OP>lK=5o=L z(H*00fZ!Tlejqm*m_ literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/ms-flow-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..c28a05a8ba9298f716619a11068403b831e64d4a GIT binary patch literal 2655 zcmbtW`#%#36xSNFmDkWjlJc5Yd6Tfb&Etw#+7^1480L{Xuj`I&$)j7OJ0Y*+6`DdK zv_yGrd2Z&i0eB52^Zb zAkCqsy7Fa;e&5NA(jigN?;*evJ#dMH$M5%e(wZ7{W#;PR`i$tFnJ%MsbGns)wwj~M znfbK2y*FnmuoNT;GApa0%MUAuVbZV8X8U$jj)stVF;X(BE{YS6AiBB8wuDXTNVO9U zAu!k_1s_qL@V{2oqgsx!Y>N%xk#gVPqklbhzSu}1XJzXCuLj-y)?*FetkN`$b%!?W zNU)R%QV#p5Ntf0|wr1&F9BAvg?8uvaBBs%|zQd}lJNFN3foa!u%c5C|6kl}HB4x{aDvNpuGnxM%_v*U9nzP7Y6(9x5PM-3itg^1EdSve zXCaztI^~%=V*QGBw`8=-g5;=rCvZoMzo*P_wpkMt>ol1yL+ef`0-a08BGOxu?YhFh z94#VwK?FG7?1dXK7?&(1Xd(2HQLN3R)Hmth2$pzseT=$vv-AzQA)R1dD6QXJLBM6p_&MQ%c2)NV0rSpD2q!&`-WlE@gxfXk`3*CBsQ>196i zp89cVa~R!Ak0$(h7S$enDpKE3X?Hm41ma@El^65Jmq^M=lsrh{>}BGnN8rxAl@Ems zkSrq_l&jY41|x`?tFpA#V%|+H@?RgAO~z6Dt?S!jFMa|J=|<9ekmae-dt+S=n*p{L zc>k0U=DmrZEg4HPvya1;$A2xsEMmOBP!R|1tQc8~VZgR!|JiBH+()(r>L$u>tQ)`O zRx`LNI`zMaw3@wrXssZW@$jFYMD&13B35x)F`RFjLB&^pC&n?4BHeS`n!ulK_ z+*fui$ZN7$moL_IaspL{iyJ?`DI)edOz^@hb=DU4_vh~2x}RB`q8IJ;m=||07@aK6 zPIoUjYyF;=-YKtP!YWKv`6}Dq;;Q8vHb-Mh;x}GOa$@Br3Mr`??@E=NGw|{1S&t-T-gP)Uh9HSNPo42bjd0HmKSySYQS{2pBTf z{BbvI7dx*%r{%y!yQt8tnbJQ)UrrBqzE^1T#RTz zXY-xt@$x@EXwOhP#Wgb4yRj}?LBVK!wfwIbkkCbkhqtLpThBIP~utTu(w z>|?PjyOFn&fkk{OLJ|7bDOD3fl`cYv{qjly)r~_($c0N)MV7Dl)dzrT7 zW0%~eNwtgoN7j~Wo7a)VxRIEb{edQtj>QIqZ|;odaQW?4!Rbm!lj+=u=qxh=uE|7y zf}DG9bhYQ6#Q2PWH>@!rxcnYWYLqjT5VvVL)ZU7Qn|wqp*4{J`En`IZdp`|2;ej_8 zLA(umbUI7hNQa%MNLlK-Yl7CDsMiiRHiV4VHM<9*d_8PhRaAGU~qUg;0Qw+rn$*>B|1Gh9iY(h><#)CcRL@!tB&B^8>hw zTADGXHJq&cF4iI#`zQ96)*L_7@>Hy(j?9^O$!?9Wu7eo?VZxSIP_=}EN&krP7tO%c zy&qlpiJxMO{i5u6n1)^Pjs$GnZW7u!-Bywh!!Pw8owx!@MKk%q0*t5}|h z3_B|0a`+9WhpqL}D!-O(z^7iZ9A5pP%#cXkKW2=Yo?Nf{p6mp0UgrYjLGSfLaar>Q z5Hl&I@Z(L)EV|d-%tOo$91U)Fu0p}(#TJv>4Cx>u*taCyP+XnU1xXTkYFi1&bOWwZ z2zyL);3QwVW0?s0OSUrWH`dZZgTK3}Mqop3D*Yy(lS&ZkuEy%#m`U7*5QfFjTVee} z4|BdSYo9EyYchsG4=SXzPUz1jDf$K~Rq8=eU1dyeo?{Lgrv-E1)XifPeyD@I=IQ16TsM6e_q zAMM-gT%XhjuS>uhhajTg-^)3M)T{E$m`>vqQs9FziwKiNELk`Vb=uPDM13v zc%Q-gsx^Rn9?KMlNm5)l4%~I;MBRy!?_z7Ag;WTtV-R)PJ?3UgCzuq8ALs3Dl@Mm` zox#!>4Tc^W6Z1+P!TJ4HMN6;WT)bUpKM?hqjF92R>}`MRjlPZVoxiT|NucdT7nV{u?&DEqEvZ?s@CGz)Qje>3|Rsd5H1kYa$DhkJJ{DGv$ zvcPx`>3NIu#e)AQ!eHyw0FJ4?tab$I_%$ZO53d=?1>`7kDeS{8tal9ob9Tkx_WdQnZYS*LxlSJylX0lOAM!d4Dab$a1LKS+a|F zX3JU{^(mlCOTz^2B-tTrc;q%q7|kiO5TxDt^26Roe&{7t5q3BFP`^WI+V#OWmb<9f i57quI;(w+61j)LQqaKRseBOT!MO+*_?CWd;QvL-+(f7Ro literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/rapid7-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/rapid7-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..9683cf58e0dd76710c8b251f7b66b8acccf74c6e GIT binary patch literal 3977 zcmcgvS6GwF+6|!^S|~ygsZs(P0VOB_1f_?L6hWlJmaq*~=@97x(l!dx5i~$VVgRG` zCMEQu6lqE?0gQks1UMg;|HXfK&c%H5JTvpmeDl8RU29FExv4%osRQVH3?a_zZ+@JBrC7+w2u}*kW1Y;cYj$S;Tm_SM=}W${Oa6ue|bL z5p&t`o~;Tk!qcvd9nUpxo3$JqH&0kABtf-A{Vs2$&4S3M95Tbp22t|*kcY_I#eErI zhg9A*|5rD&7m1iWpXs|qV;4X`#FY!L z6GADWj;40rUEUlA(;-YQ!TN#KClvN)Gs6Gy`gN$d;V{$KEGE?UQ(|LJ@#@+Bml*3W z{y#_m_owPg3nJwD#4mEV<*r;#dxJL=g^DUE1hOFSOCK;0@OhnVOn{ zC;3~t$x$Yip{*tfdb(fCuhPT6o(|v)gRG47^_laoVM-br1a&R+?xo}54AHlQLzcM4 z-`eY=P-M(zvX1zJxyBqGX;abIRuTpRflSt-c>-4Y>pTQH6oXd_f+ib+6cTm7)+Qo4 zyt-mgmLK0@IIF#9RSk`d#(KAB>M~~=f_PH&WMpL*mb0Dy21eHE2Z8;O{!1(*jM~0z zQgrv?%i`k4xw#i?2#zK;HhiFVguvm>4GDXWD3A7(gT*X+@?XVxc$<27jqs)2krq8F zvrkxBmqdjO;QiYL+=+*qu z(c2?4Gjg%eg`dlP3ojFd>oEl(AtA2oqpw{Lwr9oBxmqmt63s~2!wq5H>>@bOc`wyjNsE15;`9+ypT3t;mC%k!+Jdk%iV7d2s?M@sNaqU{Q z*B9C9ni~CQMiSiNM_V5T?-vc}J30#E@#3+fe92rXdRN$Dv=ca}Z=8;K8UnXUN=l-2 z#M{=#$_lDIJUn>$`RSpMxV80lzf?vr9XJYs8U^!GnSMuJZG)UL7MnH)vDM46xE9jG*Dj6(#ugg*WL=~ihppLtB%`C(F|>3AOf z)ZY1O&Qh{Mv#+a8WTb{Y>4D2ie@<#^YAT0g*p~8LdwVXe;m@Ce(}cx_71`#(cTMg# zpQwIeNn;jc$ntQRzQ)eZ9^3Jq3!H#;`>hwIE}W&{G}x6QNbc=zCt+08)IyH;C(vGA zS}bi-HTRK0+ZWHDKcBCOos)TkzK|(x7Wj31c)0cbKNFyy{{B~0RjJa2!C)XjK0XRN zEvFh`2iuauX#wk_k|ghAq1}}mJ^eXKRLy%vwA};Zv?aJniJ#lnBH`cX^zBj@b!!Br z2Xu&~36g6}Y-i`M?5%UCzaG0ix|8n5%9hZ9P*!%a;{)mH>Q>qk+e4!1RtECA^+h5+ z{hD!_RQGV5TS!P~CgNZgy}UqG zVdl69WRI>wuqphHf0mrxLVk^N8~E=q8#aH#d-C_ zl$Bqep_o8W*!tez*XMS)w~lUcu(J9zW=4>L8A}SqyA03FJav(1ThtwpXW->E(Iv~b z){n-`&d1DR&t(i_%X^If{k;JSJnh`PgpVF3WT>17ydYE84BYPBP|Ps!-CG-}{XH=; z(fx+d3}{Cu3FAtH4GatbxkN5!UAEWr_O9BsV`&4}KqZg@1KHWxJ(&5J0c7yG$U&dSpb=To{vv8EC?cIAi+IRb`=7b^}HaC zPFHDUUJSl5$>*h*R_R2eFZ?M`47ZJNkl?^RHeidwgTeh0o+#U$m392WXtYxwo@dTgqc=kqc<6|CAu>HGhTUX41qJw z(em(+q^GB!Bn|x8T}|wCMc?>X^CsC7u@RoCBi?xYYr2#aHdXCG>+^}!_V$(sAmHxo z3^M3!Nf3#AL7_Z&Fb$Nrk||-Zw-+Ga&`;{4B+TK_Q9Jic12MQm6wKmFCx3=8~Z@$|dg5&c3gj3K}gO>TB#<~DBGK8Bj)ZN+&ifoxjJ*ls+ zf1)F9{6dkgHBqgDYG%RP=%|p3LuUGe2opwVv`k;tI z-QK^D$RKT+?;GljLY>Q$GBNz8#lx;~f83rjRnv|18GVJC2|AVIZKX6k`4T4lfCpiQ z*O!45j#jwK)9PwATpwW*LaHQ{*Y6NmYcbE*GzE6EN}g69K2+=C^~{wzgM_ay)WE}2 zSy@^AU?u>xx3~B1(WXs&eEgH{MV-=-T4B23uU~t2u%}_tCJCQ;B5-dppXXEbO2cW? zZmTDdprOQdBuE^yH6fuc1+!aj{4+^O2X2EC-lHurn`l zC#vY>a+ytOESLT%LDSixiKdN1PZz_3%lg~YFejYLJCCn00q+_2Mp=9!L6u!n2m2e-Yq)eLX$BuXk}J@K1|=(sozb zVt^dFj=%*31oHp!F*9<;nHGfhC7!%h3EG}{QY|Sdi4GWaF)dK-tQpcs#-U;Hx8S^n ztRj&uMJa;Ue+CVmaHr{CnhIrGob0Z6<*xFb`&yFblb~Nit(hCvf15FPP3VgXn6W=^ zXX?`#P!OwG$u4he^mFJNcq*gF3mF+6{x(B#R(z4=ddJ$D7)*7QzxVMmX8NLv@8gaH zPD^|HWX$yEiHRCO4nL=bs8>2PWbr$NkK_cau~UO#Fqrf4;XVR^09DM*PEDaqz2&j$ z;gfYE!f6Swjk38}7`hs7jvd2m`ycRwA*km<}p!x*Fp(3w|0xI z2Swlc(+dRf%~NSZ=m}fty@LZwTiYj?>EI?uJ_Sc(3yX{Zbr@T`}z{Q7kT;kZd+Q$;LvOJrs5gSz0YJogYPsi zf&tkDv|;AagaZKI8bGtR>sAXtS36KHP_=j55<<wr&|LJ%1$4UeEz2yWh^&_|hJ6Fwnj!h-5yO&;eADGmI&z z#2iq-*mFFi)rc`fo$q%rAjhWS7B)6|S94yKmeTiCn_E8zU8q)HwTX-5;Tg^WGrz{4|~`3muz>+~VX@!&&LRQNPQ`ABkBIjr;#9aF)EaTjI`S9`k20cULkK)r>seFOTfv zh5zvrFe(newDZ4yS}n3P`k7rNJ8`&$P~k~hqlzCN5(S5f-dUzEo$`+%P>%DZ+cv>g z)*cI=P!&Q_-bDMDrEXo(7b6+?PX*oy#2YuX^SO5S3 literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/servicenow-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/servicenow-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..0c9f72b10a065bff94d6c873eede5b2bd665dd5a GIT binary patch literal 3799 zcmc&%_g9lm)21jY2&h!02oGqeQbeQ*QW63fYA^vrDMB7ZdY3AKbfifQ2uKSMsu+3+ zh@nM5gir+(2!tA{wD4e#0Q6se?&tx-C08A!2MrD9t-p;HYAn17OkVJWKGMGM>k=ys>-GK6d%QF>EZ$J9 zho-*SYt#Qar8wBMZ=Fr0t!??Lv?grDvc^`&#dT!Q>Eddj z8?lki7(&Ul)6;?f!3RuFz3Fxg6kbSPH-N*7ii$)k(_=_Z4E$H5`C}5(Q?$qw#RR*M z;jj|RmnD#>9tUiLi#kml_%78umH+cAi?3nac~eI*1`O=kmqiq=8@d8_+NpOCLS84+ zo(Iu0!u|^j>!Ek=os=5GQ}+g86URZ@wY8#K{zI#t39k?d*;TY}g|5~IR)yicK&9#M zUa8Z$N6m+a|F;IpH&SYHajR|OiXn7<+uU5>AGQ^AYTx;8YUR6*WOS#d!!m5V5z1*^*_*ab2kjfMUSu3dzY(y+`N< zqM@*ckAS+FzYrLql2!1fqCam=KuDhxZ|0i_SMR zF(TYGz%G*E;xbu}cq^0#Kt1tp!#*t9Mo6V#ejc+58+shP zEG$Yh@4hXhE>Tah)B0Kk&CPyyU*sT^sLg5ECkxZ8-dEzlekVOr^BXJk?OO{e#LVth zsgrc}CcfFiK3*laB(~Ptsb$JPs-uLOiSy+MMBny=IWK`=+3cR$@;1Tsn1XB!d$`EX zMeR>6BjLOyuVYPN0dDW7FR=csnuO}={M5k18^dVDboG#*e6JE8911HUGiXFGx)5C2 zp5c8o{X>QxNL7Xej*rYHX82)YJ%YXh5}qnkfH6%Yv3w2yDj>_JZkkeCg^Bjq z-94sC1#A1dz8kYTW}*ue3`koARGNzK7TNOuI?(@%(yfcmzW{T1m60ubXuY+ks9F%f}%4?e%Z7<+-M_svW+G zD6$9abbMG#tO}UZP-<#Y^gKS7T39GNxz^kisLWLoc%(c7d0rOajil^%Op zlgz{fe3H7b(nF6A$)`htccz?*WN+n;>T%YdQHhG)i*PZkF!e6|Rv8EI#^s@Fp6lM1m9bt{<$m@Pc5^t%p_F21t zeR7og(|1od#^V{7RXYU4u3X$5S=nbx5Ji15UrbG-CRDb8J2(3Ko*)d{qqRRB@8=`{ zK&nPr-2)Bg6pjXm?TSA(HnTieQW8yv`sP?ycc{GS<7F+)JznL0EBItMW_g!E%pt9& zq>(Xggiw)Vl{qmXb3HCLE}?dR*=R?JFK?3uT#&e~9#SSL`B8yaBwE88%%J9H&E%o0 zOM~NU8Yp}*b}{_I@+Af%UhtnU3^J>6-y8LiE22Fm_pdzWpm6d$2o{>FzWAg_di3}2 zzpu)gC6bxAaKpo|NvJNAw6vlkRMVF25J@^{YOF#?m=ZHI9d&zef_~0t-k9;-<*45v z^}Wpv=yY%xG@Res9;T|%uNgOiD9}>Ay5iywK+(_RdvPI@fn)v{d5@*As`7pHow@04bwBGB|lCWno`CJ?c z1Cy6Go{Mn`3CV=}HFR@ts1(Br3T69Z+S<~1=B$bgMICWAlel z=@#bEu(Denj=x7GElR}1HI3No%$bKuMR}p#*Vxz&cBn){_Hf)ah|#*$5B1^^nabwu z?RlG(tjzI4a`ENM%trH~AL=pJ!X6U4>~^q6!sag#`t~-}KwzP9yA=;pZlMQ|$<54A zZpP%_Ld#rLUKGJ4|KKgAWMnok`Zc&rP<6CBj|~(lE{4I(+^f&fc3!vaNim11J9!!zG>;GY4X z){GjXwwSAYZ}_$s4+ESn)T($1@?y+b`Eyd&Iq{P)db^@xYXf~dPp9m}EjN`zKZ(*( zL6CUNGvAPpABAOyEm62Lt(BSMfcO2m#I9e$p@xxPzh2aP;V2?5*6P9JwP+0I0HgpS zj_h9G#VU87@hfztE^-3AJ>&1gbGEn9wrFp_s+~iZZ}K@RHa;=s-B$p2y}G*Gx!G@& zl_yYgn;$r$Oa&x|qKqm*Dx7(?ANH|pEqFnV0!`G=vu}eYV zGLWeR0i$jbTdZ?HRqYC(j{lhx;IW(va>U7h&nSVfVHdbf|!Yw7Cqg67*+<+LhLLHgg#r(fb58(+ch<^2PB^07+5igGv;bS&jw>D zMr_MB8{zcFq(HVuZ^`wYx?M=)530yI&fkp#kBu+d6j9Vb`v7OS+HPs|0N%v78qP*F3G;wB)Y}kpM5V8vR&I-SfDF0$j+|mbIK+e ze|zC2g3&lby$RjAi1Y?Q7hMLgF*8F@DCgU1ARZssVE^tKAKy+mzWnnEN7 zgEKa^KgFIsJ-}NaVs{5Kir+GdsNUIUNICn)@xLosfU>B!#UyFk2P;y4sS#3JN?WV(RBO}>irOQ{ z)1pd=5PKG}-#nk*FYo8~!@19O-S>5!`#R_P-@p5uBx_5PE6f7SG&D3Dwa; zH!zU_LKCsi+O-cziaCe7I>s{`3WJ~<&Y52Q+4Sa?F-CCC26#q~$#{t+Eu-xHx;SoQ z>tZI<4^zz7kwpsJr!+Kh@Qe2p%E*ov0^#~XYyxMyWSWOT6c2MF&%FH2k}KqGOWC&D zbbWsh;f`W&Zk^5E*cLPfh@%{N_8&&*g$0^E=P_Zf)3Pn@9#c9%`U`w3dyw0S%Q(w$ zVZDScn}@epzplm47}MW*Z)1tkN}FD25fE}$0_^L|(tPungAdvn+&mXt;9*6HdIAYkcd4@_EH0;Z;D64Og_VKy1%=RH z=D5tS1RF{(di$XgAA>4)bCOGzo}Jzq;Ixa0QXx8OI#>YluwUHm1=0#w)v0pucd60y z2l28zlJ6V%6SixAt1Clgz?}I5_D0@Jxe}N3=nvxz-J*P~ts0ch0}O&ZE=D6H`a6G` zMMW{@<|bE%Je9h3&Fc?4+dLfP_+)K-?-+>5B{|y3H&@v>xxLT>`mOa86&XUGXluB( zkko|&LEYPZe1kj_M5R9Mt)EebNErNpxZmj1RtK-I@sP-n9G!(qs#-euFf~_&f=0Vt zxIZ~SeRf_v3ag3DNhLcloq}ocA_+YJ|48QA59RlejmrM{`NjV%mGlL*dt9unXtf-Q zkUqMKj!p3P0Hxim7}oA8`Od6@?$cp#)!~}#0W*E>aeLKMXRCtwl&Qhs>Zdaw!Dpl{ z61fx!FR6~tai2=+nxDI6b;jQwebTzNV!vHizgCj}beuEy~EKQgPuMu7%xrvh(n$T94-+$Bwjh;?lc%az*9RP#EO zExuW3K|P6KT9gxVd*m6thEZ`SFl0DD`4TtW{%dBTWIG^{GP5lv@9OquKj(8_R_N^c zhHESC&osuu5?Xsu@1y0)_7fB}S-S-^=N*2Jt$A(gT}TLYWlczw>%;qa!&1;6H&W7| zA-F}>4NNPEyogd|P19)LSQqp@$=;`^-cB)*;ZL{BG?h+*%H-z0RMFsB+>g*HE_;`f z!piH~@f6c#>1gUh}2M7>wu6GUngjSDm~M>VM-Xs>IHw{Msz+!J`*C*G3|CUpbNcd&;o6 z36KaY-LWJ&vt$;^Y=fwb%(Mwr!g|rXhrhmLziHE7nz##G=bsB%kgE@BL;lc{NtL0U z6b8{DuU-Dx>=e7kA(0Wn z8g>%dbxP&=Xtkz!=%IEt-_5O-GR8vh-=7}i%E~0t8oU+Hw=C>&M&V;IM&&A~KUk(1k{QN;W z6of7(8cj|#wdorg63esLJvltwS$Y0G_hHmYQ$=zo$v%Zz_~vNC%h8O>tDC*b7V8?* z-1{r5wbtA(+4L*o(JGjUaP{nL-yO%cqJ}QI5^0&wET&u(Cejixuc^|(!N(?0y)xLf z$K+)7sGsGNwUdoSBt$&o@78#z;15(zK{xTpL6QT~Ie+!|xT`Q|tutq3@!7u#KEUFvzeNsLT1=_7*&>6phEtS zJQ3b0!LeS94p~w|m5T2xWxhS$!r?m-9xmZ4=jJyGDBBBXr{w5pt;ta%tKT&F*y@@f zam5_;&Q6jx^3BFx&En>?|JM53Ta$R<$HDV$!)sdH%ehPkS)nB>T)sb%lYtsPLD8lq zwt&kYUU$e82|wt6@u<*}5hX%ftJ(_Q%^Ien;e+n4p@OYV={$?!hoh+Mz}gi=YY+@- zGBos-tv8-&uDkL2^TqnhZ6q--0`0HJXAnQF9;LLzDL0$$<4k6^!2xdx0$u)<_`N|o z7V*Bp;Rn6QLskBQvf9dYJiGcH@zd|O=OH)KZ^J}OrQ(0JVbd;-Jw%a)T}BcM0q5fa zSb6h`sv8{}u+L-yLuL|Jcl^<7o|8*UH%1iy(gQfEwI?&y2a(Rw5B8Rk&f`p-E-NkA z2Lv)(|9Qfl7p>wJoKKHd743~XO!@iBiqE%0;o!#japH@qg9LwD5}rJkSU<|k98P6p zKDEQpZeJFnR)R?X{q)Fdn#%t1sR|&;`=n}l1zE|}IQwZ2FPMB3YM861#gJTFHPpo( zG*~`czMbj1P;xsF76n4T8}Z1Oma+U&z1P}0RC#@&>Q?Z3+&@-+ApoFkvcZ6I2x$GE zANIg>ncQS3x+n+w#5fA-=<0OGDXGXXRbf(Hut1}V`mNsLL^YiR@JVB_As4M{AFeBT z>IX{EA;Z}*oSbMF!^yUHqYCu-JH2eYq4y25;*Ww3gvP^7buQ8(%A(YoJ3ir>%<|@y z>h^QK>4qR9jMHJ>!>CXk!t+XcOyo_a^VPtF1PNdI%(f1gYu5&h7zR?d;H1yZ%{7>? zcOloc^4*hCp8l|B;i~B4Ca8-Q{YJJvI$x!29xOcNl)JAo@>rA{;1VzAx3%trZ^Iu^ z(0FY`1yjq+o!|?x=Bnx#h(goUN@Ph5?&Ux-hh<%zjk8@x@*>M6StW&%`m#)~;qp)) zEvII05fS`QKJ=Lz5emMv0jp%H!eX5_*8NhQj&Z zap$1sGS6HFcuVT1r;8#Zus@^YKRbjg*C;&;?6%8zsVr3+F4-G>3*GLm!-=Az9$mun zmrP4pS-T{C_!{lwTQ*&cgMW*C!W}VY_H&iVjeDVKp)$0mYb@>h69hw91C(hAVl^qT z!nuC#nEA3b*W_I^#J?={2DCeGVa~+DUCfHE{=JO`dPNS~InZnjzL=4z(EVpvtN)#VKpGFaVBF?e6ETuUGH%_AoIRHoCHzy*eW;9glv22{sIN)GMs< z3nT&k*oiyM{UO?N@(L1p7AneWsx2s917LdjMD;z=!UK1uS1GK7-@hZK@N8;cy9&gZ z1QkJ9rS046V5H@k(1$2lu*GK?qw9H{3&S2yq1tJ>QQ-tpW&;0udEKOyQ&JrKWEt^# zq)JDKP0)e6v^H4ZHbLJx8ikO67&~3{THs7cOGW1txIHYqRZb;12pRj06OzolOS8Np zsI_%!004_<(nmJ2rlzQZKqEM;ZH&$q{RBZ^+55T%)Kgysi&X}S^el$iy4oabT(bcH zuCU$Y6Dey{W_OqXFfcZHtl#^pOs~!@<$X5RlrNZW<6wvE4Tqnovw+k38c>13G-~UPNcEIH=yMjnR~g;TMccOm*08FBKe6 zXZb^?`?Uwmm2DQOS@@VIH@%b2&vph%%%?XC)#T-m`~S=j|8rK!`P(+5szI*3eD5N@ z$;HLKxNODZ&U-aY;S=4B*Q5cU0qSKhzLLU{BMbM6wjTCQNC)~J&r4aC^esLH_O#eV>HV+`p4 literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index efc63e9b1b..eadee9a3b6 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -55,13 +55,13 @@ Logo |Partner name | Description Logo |Partner name | Description :---|:---|:--- -![Image of CyberSponse CyOps logo](images/-logo.png) | CyberSponse CyOps | CyOps integrates with Microsoft Defender ATP to automate customers' high-speed incident response playbooks -![Image of Delta Risk ActiveEye logo](images/-logo.png) | Delta Risk ActiveEye | Delta Risk, a leading provider of SOC-as-a-Service and security services, integrate Microsoft Defender ATP with its cloud-native SOAR platform. ActiveEye -![Image of Demisto, a Palo Alto Networks Company logo](images/-logo.png) | Demisto, a Palo Alto Networks Company | Demisto integrates with Microsoft Defender ATP to enable security teams to orchestrate and automate endpoint security monitoring, enrichment and response -![Image of Microsoft Flow & Azure Functions logo](images/-logo.png) | Microsoft Flow & Azure Functions | Use the Microsoft Defender ATP connectors for Azure Logic Apps & Microsoft Flow to automating security procedures -![Image of Rapid7 InsightConnect logo](images/-logo.png) | Rapid7 InsightConnect | InsightConnect integrates with Microsoft Defender ATP to accelerate, streamline, and integrate your time-intensive security processes -![Image of ServiceNow logo](images/-logo.png) | ServiceNow | Ingest alerts into ServiceNow Security Operations solution based on Microsoft Graph API integration -![Image of Swimlane logo](images/-logo.png) | Swimlane | Maximize incident response capabilities utilizing Swimlane and Microsoft Defender ATP together +![Image of CyberSponse CyOps logo](images/cybersponse-logo.png) | CyberSponse CyOps | CyOps integrates with Microsoft Defender ATP to automate customers' high-speed incident response playbooks +![Image of Delta Risk ActiveEye logo](images/delta-risk-activeeye-logo.png) | Delta Risk ActiveEye | Delta Risk, a leading provider of SOC-as-a-Service and security services, integrate Microsoft Defender ATP with its cloud-native SOAR platform. ActiveEye +![Image of Demisto, a Palo Alto Networks Company logo](images/demisto-logo.png) | Demisto, a Palo Alto Networks Company | Demisto integrates with Microsoft Defender ATP to enable security teams to orchestrate and automate endpoint security monitoring, enrichment and response +![Image of Microsoft Flow & Azure Functions logo](images/ms-flow-logo.png) | Microsoft Flow & Azure Functions | Use the Microsoft Defender ATP connectors for Azure Logic Apps & Microsoft Flow to automating security procedures +![Image of Rapid7 InsightConnect logo](images/rapid7-logo.png) | Rapid7 InsightConnect | InsightConnect integrates with Microsoft Defender ATP to accelerate, streamline, and integrate your time-intensive security processes +![Image of ServiceNow logo](images/servicenow-logo.png) | ServiceNow | Ingest alerts into ServiceNow Security Operations solution based on Microsoft Graph API integration +![Image of Swimlane logo](images/swimlane-logo.png) | Swimlane | Maximize incident response capabilities utilizing Swimlane and Microsoft Defender ATP together From 59463d206e29a5ee8fb326e07451b2a8b02ac6c7 Mon Sep 17 00:00:00 2001 From: Caroline Gitonga Date: Tue, 15 Sep 2020 19:20:07 +0300 Subject: [PATCH 17/57] Update value for DODownloadMode(99) --- ...erating-system-components-to-microsoft-services-using-MDM.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index ba4a8aff28..d53f7dc795 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -152,7 +152,7 @@ For Windows 10, the following MDM policies are available in the [Policy CSP](htt 1. [ApplicationManagement/AllowAppStoreAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationmanagement#applicationmanagement-allowappstoreautoupdate). Specifies whether automatic update of apps from Microsoft Store are allowed. **Set to 0 (zero)** 1. **Apps for websites** - [ApplicationDefaults/EnableAppUriHandlers](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-applicationdefaults#applicationdefaults-enableappurihandlers). This policy setting determines whether Windows supports web-to-app linking with app URI handlers. **Set to 0 (zero)** 1. **Windows Update Delivery Optimization** - The following Delivery Optimization MDM policies are available in the [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). - 1. [DeliveryOptimization/DODownloadMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodownloadmode). Let’s you choose where Delivery Optimization gets or sends updates and apps. **Set to 100 (one hundred)** + 1. [DeliveryOptimization/DODownloadMode](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization#deliveryoptimization-dodownloadmode). Let’s you choose where Delivery Optimization gets or sends updates and apps. **Set to 99 (ninety-nine)** 1. **Windows Update** 1. [Update/AllowAutoUpdate](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowautoupdate). Control automatic updates. **Set to 5 (five)** 1. Windows Update Allow Update Service - [Update/AllowUpdateService](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-update#update-allowupdateservice). Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft Store. **Set to 0 (zero)** From a10e369790611bac3a62edf44e2b6440d7be4af3 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 15 Sep 2020 10:49:22 -0700 Subject: [PATCH 18/57] add logos and links --- .../images/aruba-logo.png | Bin 0 -> 5836 bytes .../images/bettermobile-logo.png | Bin 0 -> 3610 bytes .../images/bitdefender-logo.png | Bin 0 -> 2512 bytes .../images/bluehexagon-logo.png | Bin 0 -> 3927 bytes .../images/corrata-logo.png | Bin 0 -> 5920 bytes .../images/cybermdx-logo.png | Bin 0 -> 5352 bytes .../images/cyren-logo.png | Bin 0 -> 2568 bytes .../images/lookout-logo.png | Bin 0 -> 6649 bytes .../images/misp-logo.png | Bin 0 -> 6911 bytes .../images/morphisec-logo.png | Bin 0 -> 4846 bytes .../images/nextron-thor-logo.png | Bin 0 -> 1390 bytes .../images/paloalto-logo.png | Bin 0 -> 1900 bytes .../images/symantec-logo.png | Bin 0 -> 2629 bytes .../images/threatconnect-logo.png | Bin 0 -> 1986 bytes .../images/vectra-logo.png | Bin 0 -> 4844 bytes .../images/zimperium-logo.png | Bin 0 -> 1888 bytes .../partner-applications.md | 121 ++++++++---------- 17 files changed, 55 insertions(+), 66 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/aruba-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/bettermobile-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/bitdefender-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/bluehexagon-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/corrata-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/cybermdx-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/cyren-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/lookout-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/misp-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/morphisec-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/nextron-thor-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/paloalto-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/symantec-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/threatconnect-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/vectra-logo.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/zimperium-logo.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/aruba-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/aruba-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..037ca3b833579383b59af0f32e406823ecf8623d GIT binary patch literal 5836 zcmcJTWmwd~x5oh$mSySgZV43x=~$)21*DNsVs~lj29*Zs?gphhmrm)DUQ#-xVOQ?{ z?{nYW_xHY--#pLEGryU0&i8!IJQJqzPKgjm2gJg{B2-ZZYhilF|1aX#(@QFzYfWStNFPJ$S6|lUvN5)a6w}y z`WVr&8M&@qiL!*I414|SXbtbU!lz_D=G^3_kfR%8}3slBkSC+4^L3- zJE*Y}lp800VM2FbHH^6)TacMZPcCE=xa;@CL9Td|GoDAXcEV|D)E%QBVr%%cnVcAno3;} z5Kz;da#=}&S|4X$8k0~3>&anJC=-azyxFZ^mAm?YDj`%&d)UGG$-Bxwqs+Y>L@j5) zoTz!e(L+!|!IQdnpoqFnHJaSsq7R^ycl!+?PF7`;Jm?G`u_q9N4XfKb^si2+1L3*2 zM%69*9}5^M85DM9z=kqxP+CKIN*aRgxguKdl~{fYy$1VA$)IcCdPv=CSj5jsr{pga z4$D@YnmtEgjwO@h=t5o>@Po*o-yf@yRKvu09651fl5>ndNIh+m= z;gPv5bQ-?QITh~tWh88zRph&t@`aa#(=C zSR4YUQ~P`N3rpg!_L2THN251`ufIg9z^H~BA}zlwJRVL` zfG~<>n-rX&K-56?Z?cl*UPkU_ifqi<61Ph5h|}pJ-4Q`x8Jr@b7#O8IBxh8EeWK_e zu59{P;jIn#BAq^I8SxeAt5fQdY8h<~7&G&A@&swSOI@DinG6aVdeL2g*N=K4qNsma zNh)(CFf$<<6IR?&(@jFhin>dlD9!3@I&tT6p8=91(F`#~7z;US&RAmeSG#MEsV8i*-gx-biVG9*gSXa9S-piu>EdQJB-fcAbZ4T#J7A5u zZ~D~kd`%)&Z&wDWsSG=9m+hKf4Rt?YUab8rc)m3L(YMO~@5sAe50S8i+}9m} zzDGAXiA9Kz8dK*Xtl3yaFAczjeiu%p`HO}Ms z1_Y~B6A{9;)RT_wSxsTfVtjW&$*jo#Ap!{cG}|6{=nzf^b)RWz!#nTHHkbOF9N+UT z&MasX@kD{e^C>HF-IpKjhBOfL=cPiSS-vL<@ie!j6S?54I3h$p=EE|vAO!h)Vdf_e8(GEKF+H3 z+&tv_chlaMrijz_9Zh!Q-VF3V`dv}TxP3zG*LELCB%a?Yl?K4O82~af@gRNX3VwqF zM&9CGaMEvQ1n~(c_;B%y)Ez#L#A^?4N3DmYRvpu7JBALn?>sv&`5u;!qnHBi2x)W_ zfH7GNc$P&tytAkUfDN(x6~{LX&Z@)Y+pcJ58g@b%ZU{zNlDj|)N8jDZk>{d5<0!FD zNnqhUQ0IP=S#nx`Pc(^#byj~X`k=w%?4$g3P9;jb9qI?@@4YKfV8`HQ^bow#`Tks_ zopDvcB60p5xdcq&lRQy>zfiz&rd#TMnbMQH_}#t)5@~V;mNtS@nKQ_4V)Ww2XBGaK zgg(jl4}zkF`bNEiT;aq{C4>pxWvgMpsNTh%)AjoW<_&|}&lA$qOWrpJ7!@4$8dh-p zyng<()=l?)Je7utq+JMM3Qgv<|EvkDIH&@)YoH&zb1W1P8f5}sIOqb|#3a>%%%>f` za9et5kr6`i<0&~ca}S2xEbT>zv%YskHNezew$GdJGJdJ%Efb0NuTzG5A3{mn)8gjk_CEe7{_tl+x-Xq!-%CltY`c|77b(m1 zBT~GEd?kq(b6<`${4CLIg{On>eiw*SY`hWsjZcEqmU8#?yK2Y(lB7wqlKduGgN~9TJcgugt5BHHja~TB06nKmi3U6g%)h3`GH19cwj1~ zEdV*=A(_v{A%7zg&dcgtBw_*~F(F$&gSfTDkuap8=?YoI2RVLxrvT?+lQXFwhka` zH|4^*_ujQuDSSSRvvcBm40fMgyQdO?AQpP!5qJoYh^>{Li=krAP35UCDI2GB1&mbQ z?L&(91Ft~YHv33%OjcWfn%E*Gah18Vl0fW>2U<06a@zdhC1Hp^)IN77Y*0{f*pSR! zC`{*pj!z`x28T12`B2Gic0iQvwCvVp<9m$=KJ%T8h5z};yT)$)la4P8wwy&d$9?+s zJ%aa%4(T)uQ*2Iml5W8g@j@dc+o>muHpmYO1F>xZn|(`X20Q{I=Bxd-^Y8&5{!h^i z@Wm&46^06xG7)r5&xO9l$I(p}+SDdmHdss)d@+73$H zcnJgHCP67l+n7ynoq4p5O}8o3J|_E}b(SsyJ-Dwr1*2TIIaBOU_HA2?Byh zkZ3#@CeNXL10=UPB)dIrZNv*s45Ev}gtBg_grna~ni-Eq{8?K4>B_gkRcXX z!zW5cZB&$WZ(cHXTT2qGKl{Y_YV=$2-829Kd{NOn)oU#kcxWvrv=piP4~vbHe!&&{ zU_;Po{w6%(xW{=%D8T;2`;wEMG{Q!se85gKL7^d=`=VPYFL5~ndaJlLF7GO4X0mK~ z&EAgSNY&$2uk@iYNAHAXpypI8nHSuW9G4cvq04vvuUV-q%x%4+CTu$JzrdXGo?b9j;lfJMV`i7tFVn}@S@(QfudaRXD|I}5kAAcEzp}Y-wg+R z#NUI#sB5l8`lBvu5605gGd$@~HYTJkUNz0D*TB<*?{IpK7)0@dQQ|cE^QD)yPrP{`s3exDj!zL8QY#<3!Cc z`GxG{w$i*`=D>@7PcNN-foS(7=bJ1PciqP2B-H7>J8H|{4m8(N=}is_id))i_qWNy$M<$%!+(cI0xJP0@eiMpx!<4L zvhFy}p|bIS-U%4G<|Nv7TgybYIZ=pu%nH`SnZVXWULOhXehqvo6-oQyxpPwUsb?{+PK| zv(SJ(rCD8g(C~7ao0~^QMw+E@<;M8ho0>A`YJ@gk9d6F-y@-s8`n$>8A#Y>DzwRh* z9TFB72a&mb-1j=@&<9PZur54TQU6RzDpCtLT(f(4SWsD+U0wYwI3y%i>$$LaC_K%@ z)pdGh<(s7eh>&o4c6M}PLKyS+q$FLh`#V6;_8IOnp_7p!OqizN$B)#aBC7^_M0R&~ zAC_|A?%rPC$u)Z+2Mvg=@ITh)d5u~lU-^BFiz~eGk$F39Ve1m;=9{7-1qB6IKr@h?^lMj+G>ZbOpm7_Rg=8yH z&;9QYh)mbsG*tgXQwoJCFeenu*4BI=@Jm&Vho3+H$B(emxkY^=XS`%tSntlc7Q%|K z)%_&5tu3LY1@{=?zA13MXP5p(l^5ez!0BC^i;K(KGWX8JB&z)b`jXO8ZiXmfVPRz` zlsZ>~rehT%?IQFnSg^d1Bvnwp+g)3vg4skE7#T^PMQ$j8_vAt5<5Jepqxd$zX+ z-`e?8U6zNF?XaP~b9F^@b-Xe#TRP`)SRMV*1EI`$=7kV>DLOelJ#2h%QqbZhYEqee zPHjCjG-NgVGx0GFc3@F;=Sgung3)+xp=}R}Mbj+P-QsGq(6laik>2c{@nwlCCm{}v zN2IB(t?X&AxAnY&WZ8Gli^pln*r7Xm~ejALGlJXBgjvPmQ`qYaM#~l0VaJaF1 zX|o-xHlS-UO;X%@n*nQ>KY1XkxUgvB+%x}O@bWUl^A|5X9hV+4$o>-~ptjO{|6X0* zkBRb+WkF$at^X>vlT!`c##AnRd|>~l4ukCHub3bkHP~{Aic)5eLmRV`Uh>kneMo16T@mDcEs3l|{pFRzf0`Eb%G!z-r*$+_}Bh;!-* z*Gv>jYHHdwki^2m!f{-h-s4P3X!HDbzG?l~=wvQki$Fc@jKgw2G6hcmY*wUD`;d;8 zv!wze0Y#mIkKU^96l%lLQe2K^1m5NyB-E6;o?T}yCWC$3QkPMNus8tg#O2_BvhswjzMlf;8&t9}K5oahWEltncV5{S0btpRJ3k>B1Vn{SI zJ6DU&#VaNZys4t|f6GT%S{B(@3SX?#kcb!9%vRx@+%SnuqYH)-42XR*5?s6Cy4Ul& zrN-!Rx8|<|)*#x27C`WNh_@xqIF@XS0gBVnfF=%=^Ms!^44a45%OuLc_^A z6LWJAcL;H*o?dKfth~87IU4;)Tc^CBu7F~=M%;J%Dec~#wyt1tadGnbj!;#R7vbxm z2=jN$3=9Pg6rg1cW;@JZx!e8(CeA<>}chX570} z^PPr~@sEO?w5#hS27^wAnVT1vm(%kzZ_Ulw)xsl&Mn*bMuFrpG`C?AFv(;J*!2QM` zc}0X-4vPM;GqKK2K~4GjwDV(daPTXSQ(?@we$v*|A2kM9zc@3NP`Duo1adrG`>0!P z*wytdlH?W%BH5W_gBo|X_2p8EDr6>=@k`B@3LPh>grNewzb4#1c~&! z=V8pu#88-fYkRxKc?Yt4e9TG~rlF}hwxkqA26(*C@xZdK5&8&^XmWOCv|`196!3Vy z)j{@4Cu&t(EqJL0_wGGPTRUO>-0SQfT~Jt5ZNFl;xVX4`bYSkPL+RJSJS_rmo>JhU zVIu*M0fTs-KE=c)Fly{wl1{>Vt(pW3#4+w35*jSd%gb0_Cl$%n)Txi7HuXuRAM)&BXJ1CF3;z10T3xV(z80$SLuX>5wt73}Zcv>USE!b(VbGk>a7Co5 zrUtXMef-4ccbU~f4N!8+-FeR};yjI1fBAI1EK!9+N0R)Oey z;@J53QH+Z$pit+HEftrQo{hc;5{0$%LNglNlXmYk3@vpl%C-h$%|S$;#yY& zqq4ZT+t-C)EuQKNCGX ZlCCZDx literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/bettermobile-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/bettermobile-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..03c731e2d6f6019fb29ca1e40b05ae0d0e4393eb GIT binary patch literal 3610 zcmb7Hc{mjO7A7-{U5zzlk1uPDEm_7|c3;SnDP+kuVK8GGOMHqbB4w;0*=6k6YLe`U zXb>}&u{6UN3=;0#|L^nMd;d7UbDr~__rLT0p7TDov$@XAah`*TiHY0%hRIDv4*qw5 zSQ+nU!mcGFu?OF9K`=21%KbZ-&2P$58BMk@b8Az!Wp>`P0zzF>#S{j=-Q2{`0hLcF zhz{eQj*aiZ=SGynYUgdOl2A8DU;dF!6c6-=YS)qxfm{(cFlR#i-?yVEjX<34qA*|Mv5g$#;+V^UL8A3ktl_geGdQ{k>z%d zKX@QXqg@b*{r&fh;x$O>Yo-vmSTtK0M}fzWj+Ag_i%qzTW{Bx)zo2|=XWl%TVR^{O zMJWbjl5}2PFp|42q;RzZIxr5j$WXBh4NJ%>WiVjH%WG%;H)vEMskdrWa`soJLpbXL zq`g^zlvDYD&2>9!b)Jg;eOdzFpQ@>$d+UPTIRP>s-p*~3(m9Ydy~efr=o4@GbacX* zVx}s0q_I|tYpkx8ej$F~#q8W5W;FwhdfV5(8Kqh=d#u0;1n3q9d3(Icd0H2~GgJ*z zM*&ZriKKZG2q(5?*e26ySzPKXm`}`qowT5e{I+J#41CC(O1^k&Sx)WpJgB!dG-$3U zkXW$6Gum`?b%lobwjzV`bjKf{d@4S9XblLsmJ2vndZ$ zkx&>vh*^PebQx~Ef5@2Q2ioy-aTLcVe#E^B`D6Yj92$~og~)qFQb$ycjBTCo6l1;L zUV!zB*9tY4ZUCAZI(jNG%DFoC$+z(Kv*zXUy=g$6i}+H5+O$F@1D$Czm@kvvmnRS^ zg`Iua{3&P3(0(`B1hjW6f67|Ml$R?!e!hNZ)|%A<8$^Ct@VT)Q1>m^bbaZ%PE+nLv z@HQiQ985TphfRjFo>fp9O7ra}t20JpLt$^(J}-{3-;m<_ryFH!+pu%9goU~7*l;Sh zl~>e8kNJb5?`-hVLlB|dh|ShkShnZ!k8HL^5Z4|woLcRi7qrCagAQK*9Q#e9OYydM zcNTQiF@db___YL4H|~AE&4z@!cd1`vNalE)YR}b%u3rb)iZZB+1yS5r@@=eh1^LYOLHAQhZUN z&mO@G_rtoyOE@+<90vX0{|;2Fro66GjJE?W3_K0BsaWmB7(W+^Rk<|sF4Ip#I*DMQ zirmH1;W_fUf2od$=!em3Uj*q>BWBAar-|5wrIAVrh#pW=l^)|K!D# z!L2V+4XZPi#!rl7BGvl^=i{z7PjMR5tWWY(a9l`l+~2FzVimWLvQyjT_mm|2upq9~ zysaXbq-mbl8(%bb1oHYYwD6QXdENEYSt_~LjwZ5h`e%tt5%iWq#nykQPPS!^Q~xNx zT@rOKL|-8V+NAd8r{Cj~!sTTXNEIKbggUnB1}a%;Olf@0TU2ZspP97v&LkCsCq|c4 z5sWZJi%o6J`-me)`uFI=*jSEPW!hOBoZk1jgSidV773CS?FNVMd4O7;G1cLNioT3hjXN-fc zKl9z!P=ov&oLS@-^I<94wbCP*h4k!3NG3z$BipxU`W*PtVNI{bFr7@=N@llgElKa{ zWx1S3Jv4VkOm(Db&IuDAXGH$$47NSDmH%MLK&9ibrX)@7^!9bbtmKFy4kI;Hq!;+~ zoix3XCaGKKD}QZ1$qsm3v{|0rK3^~*+l%`WuY2mm6FzC(^WuR_%W9&|ddjbOPt{ZY zvay~UH&Znd@ao5)bX8lXJ|;aglk82KuxAQ_UheZFb){ej%!PFxB}Kbu@83k6vziH6 zN+%YIR%r=lS`hw(Y!8pTlZvOkfTIxuV8?a#@qG2u)ym3oVn3^-Mg3os9}*Vxe6_}wLlC`tsGvD zh5v`+I%z;pBfFKSGifo3N9+K#QmbEh(v|_s*`yNgR|9C!n+acKLJTz_6U~3G9FpLI zx!*$>UJ%wFJt24 zEYUlkOxWa*at(W(X)s5)e^gXnDoAm-8H18u_&}>Pm$l$mVOz`qgPz^L+z=YYp;%Et zJu%hVx*NE9-&hC&2~x_-{_@(Kw%7KdO$JE!8JF!Bms2{|zLdf^G$Q`fq0xT$IL26H zY~&Q^O;jD`S5;Waae85&&)R?I?(j#X45vWD_FbCGp_X^1s5(iB=omr89kV>R(-oww z1RMGXy;4X#FzDr#nS~soyN?&KO8NOr>FG6dTPxTy06n+t+rBcpY7r%9x!#Qxt?Mhs z35l7^hm)Ew8L%Z1)I^*$@dFThaVX~l@@_+|)B2<~ctO#^$D=TvRO;kHc)a>a7j>_K zE%oyb5;(mdq#u<7%suM4*r4v&LliE*b{QD>2PMu4NpNTL)v7NEi`8G%93Iz<^Hp}b z(^he}GI_Od{3P^`(A?gRTSkxl;2w}`!CizYoqT6oH@9eZph~19$QK26?yB8K>Zxa& zHuc+1$YY%8s~B?wYHJdF?8xm7y~W5cw7#(xK97K%{)nl`G+S|ij4&j*>?N8UsrlOVkw-Iayi}yj47(-y1P#)-Xs7<`!a-BwP$`-! z+I#utpR{F~9; zOT%N>uWr-kkq3^PLTu*&W28Pmk7ngwx#8hF;j?9-R=UDmcJsn6PjfB5>)YU!hR@@| z?MnHL6rHceT~;)f@YOZLWA^#by1zGFH#Z8{*w`y&ym8<9VrhhppldEUvpst25DR># z_f=D3?z6;6opUb!p&`XOP@)OgAqwyFXvw$o5+?pnon!@T)uhkbbFJ2buHhD}p2QQg zsSyilf%_RGK<6DnGFhMkE?Jg=<^jy?_l#tf-^NohD>Fi+vPxMA2=@hg)9I!oX>-s! z#?@=x#$2*xi+w|1m+m0yhvg&_{Cwn z)l(9{^9tLU#|V;LRApisuAcsWMOFosCE(PGJ#On+(Cq(tt1vhcf15(m%YFP{?q|SZ z=fo$#pO{-B+wTLKnR$e*`F%_-j3lk7h{{b#R!HN1DK85yLk+AYDCJ76$kFz6Va@~6 z;F*>`_99Nwt@wN;D_+|3C0KUF?91;*Kv`psp&hP3{n;-G7bW<5o#N7`M}N0zjoEng zq{g&W>)?NBgdz>vTQhDyV;Qk33^AzI)HBaKn_+k=_C=ETAjyOTRq)>LZ$GA6x>02n zHBVkDA6cTx$HazAJkVm`ycpfAqPcoE{}9$K3?`D|uBV9G>GeXZedlRnibWLTyxj2) z^5p}^2=^j4cD@QI(u46aNL8E#jd7 literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/bitdefender-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/bitdefender-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..a04e552d0ee72fc2b17bf2dc1d9dc36d5d3fa139 GIT binary patch literal 2512 zcmcgu`#Teg8y~_rWNJw^$dh__kE)#MUDW08l#eFNwjOG#5oi>2SCMO!}*gg5th28wQa}qOeKodus%>TUc1?u(2G%we-w9Df);{R@ z{diQ{+_vP0wyCiDX_~QRWYT#Z($`sRQN^2u?%b=imif452y;2PHQ?mAvjywjac7NA z&nsNiPP2CZ711YUyOsfV40)QE9Cl|rs%3LtWA1@{D}U!FE2-}M)JfZb6wF?G{m03N zCBdrNW#hJDk{4vPOq?v<=7`H?|Cjhbc4gR@&qg$ne-NIup19W^hy+`5@Xwx~sW(J| zG5-E({4M4={AK{{t_JV{McebG5|&pooDGMw!P!&3v9T%uUyniNupJw0YHC{c(2BGA zLH6^xO;*beEb~QmwG-gH0UH|B!dLIAnGslc=Te!>-kH*LP586t&%uBJXqIag%Cl-< z4ciHwJ5I0?>x*G97X)$q3Wm=u4Tin?MQzAw2}q}5OBIf2GIf&p>lYyv6G09d; z$5dY?YBp?TD5yVis!Rl(jIfyV|1LgGL$ION$hzqm3Jir(PB#p%FHASd#tBw}vw?piju*7#rYPi)Q5)@ zQXKqux(=8SX0aF94|nth?-3P7bbaHPs)4_|;;`QX-9+`&G8jGEeZ9TA8%O68OS7K< zMIGsb20y*6eWM(BBkZy_H&P`(f54;Cg`$!;H8>Q*K#28Sum8vlRXSeO zo?G7%DT~b*WhV!=lrVs<#=(cNTu|gZfBB8pgqBM(hZ>q2tDX7lK}5~wQEG%4Yl@lU zoeC<{lyM-Y4qpGGWbArz4hdmt~#7(Zm)k*$I?=$zJbcFf$MmS5UCmHC+f3>tva6? zXBbj6xjOy=TN562>^Px~hY`!61cl@Af6_hmO74T&f^}s}_YF{WOYY0G4g2D2GiAC2 zFPtj-T&rMSFO?QDCb#xW)bNjMs3ghp*QEmv=%DZQJ(`$Jb3f*9dcS`MM(?;oB-3{5 zduh9?V3faqq$aiXXNq5)@l*Wc#wB)LzvZWofzsB-Xv5;weWcB)A!l$Q+4JRh@f?$E zOyN;8RthEP8uVbUYnn-R1HU`Z8MRNesD6Ga6}96}IWrgxCaHq9#7)$;E2NlRint{+ zD}ei+3hfazyg(mIE#qRB1O*0>s>i0wvApz|#=ll$PRF899g~w+DuZGa(2Q2J}0SlUF0?WGzEwiAN5L9X(HpSc5KLl7-)g72ma3P#i< z&mpMlB@gdPj*N}j(70bYLZKPj)t;^DmEh+m5mdNTfbmcQ_~LMiJpp@1Z|>L8(YaJa@4S>EhZvusSAyM@KJ;)>wtVxHKnKKTVRqA4paEp5bp z5D%&Mln*MrBI?j<6`11iobhE&@$=Ezdtt<>g$6vE4Q6Ro ziZ}MR+j&xALJdkP)^~ zC0)$Q_U1MR4_S>de_cJ(n5_Za!1^EdK%uOWyI9L_oKML~(1TMz#AVEE31qYbC)a)= z)Tor}v7%iv{T8R{(R~(W%-&j}Y;>kHd)YPum zlWQOO$`SxIs7JM!s>?+T`>UZUj8|8I@&DxD(wT*0b~^#Ys{m6z6J$#8a9sV z>wcQ_SILqB9&-2b=?x|>j5cM2P4|BLy{jp5Ve;oxr*Lf9Ec^^aIbDo{7o7u^X9Lu-qQ-iMpY72jc16XzF}0OKPXM zI4R!%O}SKJHnBdUCmrFG5Dr@`?$)Q=;waU7l_K5T%2eh z8X0*vJbcjA&25ur8aZ$8()sjNt1Sxk_zAaGeC!QQ;=Y=B8`&-&0Pyni+W57-)hF!E zc!x6^zc5shkE~GWkXTYbmoPrZd+i98Ja(yM*Q>1yPMz71_K}ehi)a*T^TUNTT8|d+ z(1-%z{ZN*$zkg4)4}&1un5pkQqz30WtFA=lESnT*`PozLP={ZyANqr=94lRX3y-2> zZvPVAr3JDk1*JlK>+KFj=EDbH73A61;^}ptSg<(mCpvaMO}x$nIXjtQ8mq?jBAp z2&70py!Zb`4F91M#C(g3=&&LkBW%}zJEhz`hBbulRnr&wX9zhx0t=+|P5L>xqA<_kx;&gMxs7fLcde%Mj1re*qxHuYJpBx_Bb@ z*0%5?AYc*vi+ehT0!R2wGJhQikZhftmY#x}{7rrv0Rhc_I$F<+gYx$C-Mp=)!#X3j z4xkgYrj`SiIyOTH3Fwy%)~^*ro9u)%9>Pq*5Mj?Af1}{Q z7+4uXsYe9PJCPNfl22t@yNDKqhJ(Jmo||!73Ow9B!-B-?-Z;AdLul60fxIbNXxJ+7 z3qQ|0Ro^<`Bo{61>H6C2++lCQk~}&3Py@gO6uq_<7?Y;bJA=m+-;b+eP=w2;PIT|T znQTGdM=95hSm!-OOv?WJrF;~mQV8PZ+I+6yKa!^w-B{fnDyaGI&;}nH#foo>+IY7j zT(->?d>9M_8e3+R1Ar|6tUA8Lk;C9GJ$HFHuSm+HCFn`Tp;3Sj^(Fu5e)!% za{WiW!!|nkrItYmOh<*A)@`=d+P}a2JG97idv5{53YmP_Al70<6W_Dp>r-?|AZ}W1 zclF;sAkAwEtc0a4yy4XkKi8?Osv6p=*xj3JAQKhj;^GoaQoF&Sn|57XTtonSs^hxy z=|CT5T8S*!3hl-3ogH7|EV~U_vYnm1PobQQ44^h?o6pQFf`XrKga#j&cnV~IftqIa` zc6J_jhN3)sS&w`!&tR5Nr~wlRFR@yom*=BdKZvM-Nz?XAHK2iutLNp9;GdZ!ILYTyygul%3woxy@n%<%JqsxD6$;s^?O>RgWd`1 zW{pix%hhq4(O{(sC~zDxUB#NQ+GU7~RyF)9+SIY8^hYioN_`+mObVuC(kR+hVq|3G zR16{JC62N8zBsZ6W7k*eR6kT!8k?FfzHHBOv~K8%rUR-vp`LmJQl-d7dTadQq63`GQWP6=f0RA zn&r|0kESERP9ydcvWc-Cld|N|8Y(w!<>ay0)0!*~^VCO6eAbT4Q&QPnIKTzl7g}z||huE*?7; z1aGnzTqFu_& z4GLc(9HjW`uTKE@Szn|YGI)HLVDpgJ8J`^tkGFdd}jxd_%LKL{|yZrSIDq)GyB=0ghWhH6y*&QO5m}&CF!uJm`-CZ&cA{x95 zXUBU7Y9XY;pc8NvsrqGM`UgS3i?-6xYBcP4zM$dy>R0&yyI)~v;Q;&fLhah#eIjS6lpGLJKvk*axaR;D}fZl5TGOgM4EHDPe43dXtot~}s&CmPC&;v4TC(-vni}zaN9E7zBMvu0_~~LMK9X1% zH-kkIQTcORxmhS~=Ek}@c_Z+hfOOiRkL!~zn*z)qFA(lWiqkuvmE9=Fa>o3$$3x!jvn;q?&0c74HE6YqG%WahURCjZK9JjDkiaYZipi>J+HeFZQ zsYj$xRW1qgQ3+cOW^N8QvA7tb>-|x+^@=*L;)m=BUim06S;CsHM*~g z4SL*9R{p#tP?K>uE#b?Oj+6i5#UHwJ5BJTla@0LC9IBCwzMw-j7EOYPmYa$$=A5DM_i{Tyc#?1CqM<;&1kHkXft} z`ctM&67gTJ-tA?1tbttmbiMR0l;3ga(~i*Sq4Lm-$)Bhycr$a?zT2n0pX!}IvpB97 z;Q_*iiaD-C7q#eQn2w%RT#2ht0wTqmnb*9dHLL!0GI*p&P4@hoy~XF^rmS>LAJ2W) zr}TDuz=1&j7k^bt4;(!fwl$B3(rY7W{WtITj9|zpcmbwC6-Q_`-SuY9Q5GAsRWU}L zq|$)Q=oYaW4)|RYqZQ{U!Zd&ZmZW9LpD8yMknS6}j^2=)BE3<;U}%j%Rv=tck)uxd z?JW=O!eUIQ*l^hWT=r(f=6CHcsd_RJ-3=iH_Lh4%@2JB4!>yJ!=eeecx5f2TJl{6K zaPC>TZ1%yaq&(B4Pq+mH14?)07NUy;!}io<^YrUd3oUD_GPj&=Ra4>1X|#7(U@?j= z_1pGTEMfF{z~t(xRt#oF{)@n#l!^zPQCDKWNr?Wwnyi-Qk5Pq=&j{zGJqJg>xXqud zKujf4<*H9dzH$1~Zx-k03_PdLW+40YHfrAQG9lAJ^AyZBtl2`-pX?X*4V&FOGW@w8bhQ!wO zNS?KAoKIQ*xp!%-xitxP4XL;V=3REVd!i4oz^vP!%2wr6&4nAuD4!Rsi2wTO>9S_` zkVPPlo^R=;DN?&vT6Zb;py@&Hx2Qq=CDndb1xZJvP-5QYv`{m93&dT>mOF30lX>eK z?>HzX>vJ%W3xC{iD~>Wh*hiD$X?ORk4SW-|24C>Sh{i|3=O>z?9(06-jJSoWQp7mg z>kSXvVnRtGPFEj2gg6bAEzSDH;~i~`oBEz#tPtvr+~@k5#h?xi*yVLf(eT%T5^D_G+R~$E%@RxPG$` zbFQl53Zb`j@5OyG1NE)=n2tU>Sqx7}i~T@3D+3QgY z|Cr)lsrqF}iFw$t8z$Fr-om0s1$mtH-F^V~r#qO^nCV%g&|AmMrR*~_^H={VX1<}f zqr*43uc%U-*>pFh!N|LZ1PHMXvf$tnO*Q&-3*0 zd!f3YRIE5;!FtlrQj)w)}4H1KKZf>vSqJ0RM@sd?$Fsc-8aR^Jn7+)L3dmfv2Rc%6k#ebC{2 zKw*>MtW!lw2rvsFH@h4>upL0&`sEK90FtZ;zIV%TmO z6my!5sJ1bMRM*Ph?1f}INFYnf216IHE{f`uCn{qr>BV`4z2}+(OVXV0Hb%`gB%!u~(k`MSMD=6mCc^;btl^t~XU1cu s7EvW((x;Y%w>oekdl;0qSYhYS_L1AI6%AwEzGB literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/corrata-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/corrata-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..be75af835c065c65d9ccc09e899d9ba774bd70c8 GIT binary patch literal 5920 zcmcJT=QkYC*2eYTdvrmRV05Al!ziPV5~D^iN_5d%lnfzJ#)wWx)QFzwU35kXB3jfT zYLL;n?w5DH|G@pQ&t7MrFK3^%*Ym9Ndt+pvMM=g=hJ%AcsiUm{z0cnN4HBaJwg302 z?tLQl)`t1v;4tz3H*j^Jd`I_1;+H!5VB!r@YFZ|)OroQJ`?F3R4K>rC-2J@ZFzcD{ z?M}?H;^%LZV!E@>Vek2^mgPiNDZP81lkv#7f^08^NKt&J>1RFbC)wXt+o^*aTvs<` z`gHI;)Imt35mU_WE8LjB2#??uKC3#W7j|0N;akh0%UrxeNZy>(?yk&>2$hc)+keKJ zG5LqenCo%LZz)g+U7zT%KwcC9S5j=3yjITM?~e9X;6WH)=EKM4vp5+v^0%=B1uFed zYc%LtF?^3p_rP;xW2h(xCFx1U5bR z_=RwX6Qn8KV|7cZJL8L2ND^u&^Y`i_hD7tU7R|W%NlJXrVc@T3z+B#d=S&Sux-z?; z*{$My3*iPuvWFqbs$HX|CL~x_)Fba6j3zxA?eHWK`tVA1U{5|VA`DnnvD@V2#8~|! zKkq2GSK2tX%l@lxM`TdX3R60xcTH6~ZgO(PR2Zbh$-X}9`g^cG84CI^H0k5qEyKsp zRP#&G6q%DL`l%ntj8ut;NIk9?$6wEk0>%WUU5n9Nth!oqda*R0ise)2G+RNWF4-Wz zKp=3%JdvuhLS!rHkMP!*2=~1G)z8bZ7rGx%+IGzS?@}l80d1}#PkK=-h&MAuv@=ZUNXN-RNWdET&X2~kRVswb_MY=@ zp;Tp-RS!N}MY*u(xrOINHml~~k@#gtr>5*Jm4tONw>)&6C6v_6R=(sFMeu~-EHZs- zW0uiR;FCc7EPPtr-rDe~gmPj+w4TC}Eh5JL6G0<@C4GnT14;M5KlGus3EpddQvcgX zu!66uu^8QeHa%Gx^QYn8;;G@)>kY6htL$WOvk_kc9pmcXxJS|jPSbwgzbbR(=b|JG zP$eW4@Qvxkc{Dc0pMvVD>QdRx1kYF+Re9m^LQV}z3t}XpWH3vLPfTEdoW92Eq2Os{ zGybGjw**1%gQ|+~P6B+EMe`^%j;oP(N6fI=$1f~uBV|hMO&^|nE zbvC6e{?hEl`d5A$RYAcj$p*H3&7aVZV;dHt43mN2q#r%0Tc!veIyEzb0DTT!h%p1G z#oz^+o90Wn?nr5U$T9_M%cU#Z>D#=V=k+xaK2L7cZI_j22j{EQBASAk4Lgpg#`12S z>aTqjpuve+%YNMwLSHs)vF~85uaQ0pHzO2JE#yup`dwp*Q&T~fr6Ws0s;oX)GO<}x z*HDQQDL%SDjHZzot$iF(*piU_gul(dA=N=tSzGAA5y5$5Bh}w_=SJU_=93ETHcdi2 z(1$I%IH)&0h|uX1wh(LwN@YecvS@b_n~|`8E9-K7AXJ%c5)EJ|L^BioZW(@lP+7ia zY6Z};YUvmI3OA6jgSDopJEQCOC$dP>aC>iQ_QTa<`#G)zn*#{(1eqFUl6ggBjf&R0 zCOZI@^kb>4F5Kasu{i#GmP2S?iP9j}um8Rf_{S8DntIw;8{DN7Fs~>k04sT;hOhN* z_xwg!j)~64TD4rbj`RjW#+qa+*B^Jw1;<;39eQ6_aet7nrzMoLj@K9f7k>oAlCE-> zpkn>;!6cGMb`8C>Mygo{V}i$z6Jb)FZ#f3gK26Q!q@#n7%>}j!p;6zzi`ZUv&jZ#( zNHJ=oME-msbk=X=7{V^QJJa0x8TqG_!ejG}eTV$x*jA=CIEh1@gkqYHWhyHxqkC>v z)Uk{0xBDE<=g*K}$907yS^uNO1>!d>kJ2x)uEz=%`=YZhu1{v$-4%a{7aHc~WsIkt zEsb+k!?cmp0sjv6D~hj$KssVLpYb1dq|UQwmP{9=mQ66k_C~pCgAfKf=1he1V)1&!*N8q2)lA_*f z4o(J=;t@Plh~a4#r@tmG+z{#Ymg5*ou&5p7P?F}K`MPyjN|D=gwcWXK6wiF2vLWJB_P01%~W z0>LX37eMMpgf9MabGWAIqXHzO`|fAlfv2yDH-eg;nyK&q;UO_ zjcVDdOiy6?&xN=T{ID_$jEQZ!dYXONw0A6Vx># zEu_;K{oplizM7{szfHbs!6A6XD0UUU{6BG#(Wnn3YA^!@v{FOrpWxz1ZwDxZ2oZkT ztc==l3jg$=fDZIQEC|QH8-JY&B2KC21?)*B%9v;2iEVN(kZpmoByCIkV^<*o$eh$m zTBqA%J)I8=7|g*yL=@^-W7+lJIU2VwQpBN0fl5>f>iYCMM*~GjZ5i2II@3|T)gHy6D(S0RyhG#!Q2$3TE?`;ULCCVQ1vX`4(Lem6nGDCVHq5sA{ zo2BFpfaVbmnM0$cPJpFxY$lX}tzOlOdoV5M?EdADV?Dfq)!^11pClC0h_7dym(u-L zTjCkIVU_gtr2d-{VMhh`#f~;4@j+AmFw!;6R!fcoTi~`;efJOeWO_1Lj6Xo12gsXF z>}fTWF$Z9qC!?ioItbo_B}oSs=FsJoNGkKDhk9D}wKvW_YlOvb6UCwPF~pq_X*ZM} z6hu85dT;RLMTE%{{Vry?W@-xID%e!UL>n!(^HuUg-^yn4Kyiw$A*{;n-kX&*_TU;b zv(@s>#X)`DVOr2{>em-b3tz8y56_HOp1cyMlj7CJ6P1npiIj`F*J|F%q z&*bh}_@76+(seOgElhM&c+@^bjp^`5W0L;IEa=*#KOS#PsJ?N0CUeQph|?ZL_g^j4 zhJp+>9d+-PGy0e%g8q5qhjLxgF5DjARzOaGHA)UlK_99J!6c?&?{KG8Mzkaa#nt)F zi_oCs^gI%trjDZcxP!KQGje!gxp40?PLAy1+I*wi4)*e5e7btA2G-QxLZ<&tWyUr# zB{C>j;7ho=ygSqF0EY|%ywo`KQpqY=_BW}fwtgMHHzu&4B>ZP`5s7E6NzYR+%buu9 zCRwgB0nvFKry*(86vxK808a^W2>JQ&rBf3$uPgy1&H&%NDh)bqmUDS;s6bNeilOXW^B=iAH_hWzi5q3zn&&buw*0AmSqrCA1>J1E2JDOZ@aj!_XC zQS~8kOv-9y0OdW>BguL5Cxq!eb5b#;!RmZ@PQ@@`dN|p3K^Y_I z!Pas|gdq97$q;j7#*kEU7-Oqh&P3hMFHEvkHnC#-cQ-q8Wgafhx*i-dC(h5my6BDg zre^PPFQn6rb&i2xYE+5C0$j3REael;$VZGBoj^e6M$7w4%1!)G9@HiNGjBULyt75M zmBDEHP0yi9^PRFM_pb}*V*Y{4TGCUB5cwZJ4GQE`ec-}@Rk@04whU3&!z9fQmPg6mM3`Sdl%@1uCw zT$dt`u92#B%E~gqPuz-m@t)kp8jNdo9PO^dwMxvJj(zO&4@z{n8F(0yo@LURK&}f( zsB&Z!mZ$xrR|kKPJ)?Wr5(Q*W_pN-0#@Dy zyh4OI7=~AZ<39XK$_cgiQP>?^-^&Cc~WbhpFQO;mv9(xEFdEE;y>?lrb<-C)* zWy#sjBozA+uW5!53ck~0vyF^*ELGkb{hSazLzibyvP*PpL@{&8hjw6 zL*F0G#m^D0u7q9O{SinFeV@^Nb~h3t`(t#VsKP;Q?889v4cX=GUw5Fz0AS?_=&+{1 zifMG?E-W0M@q4pFFYl{}#z4sWZsx}caDC#Sj^A^Lj^CYl^`W9nad=X82{P{wpW^o@ zVA1q1IgRA2Dg9bk$TDzAPxlOm&H}2E=RWtNXvN}BISQ%f_3Gwbo=ZZ{-nEFVDSDtn zpWQ%PNa8Ka6x-R!^JSGq)y9QH8t=P(85FZVig*&oO}I~FB7N`of*e4LFqbJG0!S`o|zLn+pCJ-hjjHDC*|1);dYn4`G;8g-m ztbd+ZW5!X_wjt!r!Y;;JUC~+LQY%?90=`&OF8_r!yJ%t)JGF_WnG{$yIaQ(r3li`W zg?j=n!MMigF7eJKA3g;&bgZs5QYc;9_I;wjL1&)V?FQqxKV?lbmcrko{dy?-^^eg4 z9e9GDdkwn;1tLssJom6$oZ`T?G1D>b-PaRHv&UbNd%wZVvuhEG ztRON6F^+2xNOiP*vY-iCY(^}bN`_XnEQIPTn>-;J5HOeK%6PZOKl@3zc?{| zflJNy8FReYs^vorqIl=N)5&h)nI>(viQs2M>7%zA7pUw0Y2$ku;&^duG|H)BYPi4} zIq40K#Dq`8;D%^TuHfe~X7>N0B_*NkN>^}EMMIf&>}BwcHa;|ZrYJS*y@tM%gq>|; zJR4I++WWoSlsNXMlA9M<_mF2_GOZm%0%vyQDdxM7%z067Go;ku!(nfOxtB|d3%s_r zLuuJW$UPiFi)M|r7g%YAYXO~GE{C*z-tOab6o)M9b^KcIM5>x;3GixWlj$;I^~&)fu_Ka9S}0Qk!C zlEe*Q7U4RD!FnHC3yj&|Q&5DG?r56kPmec@n!@!)iuizuC>;d*vTDlZd$A;$fQd<9 zti876bgn7GrevqP0?c(N4e>)@+6_`KV}~vv-kVCIH&m=o3fMb-czOS!b_&h zxbUBqOmOBcZyPhA2jx1d4KS~rKh7&dk60D1#3^*t%!NmU6Us%h5a4Nfi@DJnK>W0) z)Az+G;2X1sVM>R&;zckJJDuHwlStIH-E8xBe%S9}Pv*8A$k-GQU6*uM<70&Xk zFs**qdw+4`=gNC}Aj;Po-}xeDSREu3Xh~B!H9zy~CLHF`N16ho=+9WgRBo-_14{{} zQh||TY5+6!+;M|2J5j-@UP!g<2_plD{)bHY`rP}e7oRSI3`u2;dOYOJWL?D^fG5|a zyyS^FD+`usL!6&1bj;yP1mkJL1-3hRdZ+wC88#p^MKLLUR(+|V$_ z>=c#`fWP^>g781)lt(trE`KZDBQJ(}>JQHWhkAvpqUdF0Z%@q0fFw%u-4x-dSk#75 z&zhXcw7q=M#8(M*_if5HK?xh?@^zQwG$<+=4W^o&Ut8TQG1*@}|0B;SxC2jnPwO5@ z);+eEyD?qsd9}*gT(>a~SP0)HyS@;gqM|w3-GyO-&&Z!yebB~h^Rxy(xY*%gHMQQt z)QB1}UHCj@QnFVy3Te9uNgEt$GBe*X)Kjm1G(sbL$a&TfKeOg$+afVg4$;0?^4eJO z&su4cen6^rl83%?^}Ww7kkxNH&UQpF4f*6LsL34Sw7RYzer3W#7)qR&#Qa{X2xPAF z2=?s83k@@V5isVqwCOu=R^gmp1P5k_^OBMp3T8FP&^)t)sB64Vol{miJ$*nmgXB-< zk7W`5JN-|Kr889UJHxJ>8Aux%G6!b_NO1m8n2=D1C!!ngjOEE_ELXw$3?B)54Q~{) znmjRGT3XhH84qDZ41$y$Uzq&+{#D`?cC+-w%0vgh_S>^2z@0e$$MzVx2MAdGNUNXb zPDn+{n6daHNKq=r^V1baHQ%xcE7=oH!Lzdq8Cg08>g}kW$iX(Lz(iT0+70A4F7_ESSOE@Axl>Ah-p3=KAG)U#vEvR-18z=St(a(e&RoTyf z0+|hi&cK%HsbJVfzgOGF|)L?|O3Kk`nZKBbl%A^XaFi6g(De!8&cx zZL{`oV>Fqhq{|e%cjsus|4k|{oGkj`uI)L*O0w2cGwVrQ*we*E^J~6JZr%XEM*OAy zU=Jyd0t>bye_E{j4adzz?dT)5+}s|<16(J5u9g(eYr?Pz`CXw;%tV=*goGJegW*yo zGpDm#eAy^n`QW;wDlu_m*9*S}=Izpt%gelX#dBQ8=7N3LTc_8GKTc_CbiAqDiEZt| z^O4j3qcDZAml!~$Vnj|t9hEWkb^Q4>-tD8AhOy&T_FinAYMh&0d{X3!IoPQ6E^o_? zi&hPyvye|%(Olft);gIA!m_Y8^dM8j3Y#=+tlP75Mc!!e!L1o9cwN0=ap%PqPWH9sLcM`g7ok*Ae~qVtS)ss={YUkFMMdGzwJ8qA5C1WeUh8~sbVQYjU*56)UnQv zh7S7$om9J;L0BU0$pQ9uJl7Kz(S;oytksVU!^5dDDbwF#ySnb>a^l{NR@n#oh()R6 zZ!RZ)M#HcLeCRC!1(8mHN3d14OMCfKE1q#xzsN$}wr?`8%ZC^cj_4f^rQ{z4)9Sy9)ov3NJE|&Jz zpV)5o?s0_u$}iAsv4y>GN6fSpCpO8M;9%l}U8PZvu&TrbRW&)3{`)tlSX!&}ni+GV zl_sjK1Jc)Fkx!d)VJ`16Vql4gE*UwG%Fk<3+FzcF0&XTxH&&!PjqtnGsiwT{%A@ps z)C(>nA;TO;O|8YJ%y_I~+NYT`(z}Vf>R5{MG=o4Cw>#|;C!m6yiF7h0MVazGxR~sZ z0k%8;`d%KJAhL;8rDM2xUvd=?q;7rZNtC~63_mWqp7Bj~Rw_*3AqOb|O z+<^G^i`55b6}O30DY3mJ-x@Q_rNJXJ_VWxkH0J{ZpKI0p>&hrgl@v2EiMR*D^qf?pj?>^mdJwobJ-&f zX?bvq0D&<9X6+Rshx;CX68PQ57C>G^pMv>)5H)l4*X^pIL}2TZ>kqe>EnD1+A|x|I z;I|bIx$tUV5F(PvbN7fjtYA{pDw_h+KUOa3Hmc7ebUEnta@IV^iuZF zAATZ{#n68e-7nC!ix$K*~)MR%7Ddj^RbLL%fX{RS)){_btKs?AbCWH7D zr_v9<`SCRV{gCbt>8;ZjS}f7giQ5si6?)HcL!O?Nm72N>h{2r+2ZpiAPW zxNm$-GIz}C8xx&%5y>vt&@mcv8GZeE5gSbWFjOb0=e`7rWlV;)&g+@*YjyusoE8y% z2`FJp9Dj_1>Bg*f>1fsWS*h+HqK!EU(%z>Bb2w%!Yx{mkqh0|E!vPj*J=4&NRPYnr zy%6yK3F1XNnDXEWW{}vFW%}x!=MH-d>5oMlJJmiLh+}>YEPI+mxF?2lXqS`6B5!7S zgcl(HqQ0}SQzf)54A9G;sbpZTdr%t(L4Di`BysU}9@FL;_TfVte2Gnk*)GInTK92X zdiLjiWAudE3I<_d*`b`Fe$UV=DHnIaEEiTC$0AH%oGroS$2g%zr7$V<;@4ZuyXG{_ z3)%fk4#^o!VSTyBjb!{ERvvM;iBXcv5P!w8K|a1<(>Pspd~LdxJCgLz-v#t2c7@>f z-`U?rlK*+hEtbQ>ucG2UH(p+@@7mL+-=u6~5D`HF`Q)UVE?^E>UwTa^g|(V#DMJ#K zgx|W${%Y>n#=x>zsC`0K{hWw(4%+*E$8t%w&BvjQ9x&H$?=2S|ug)nwc@gZ~Dz4$P z1+&H>(!&#zLG}4%GpqOS2{B@v-Hf@vBDw%asFG07`7a&2Wq9TBgMYUz?Wc&9ufrT9 zlm6V+NA_+_X%jPAX>bR((S$BlK9Dg#&wi^@@!fYSbOEpXN9F-yX=lX(C^2z1~16mqPXE7cn%adabA0Q%Bl9F=c_3_ zIWbfWpio7k&LqmI1nX3^lJvX9iUi?%B#d+I*r={965>ItBYR7E)+KCQLRAy+_9~jN z^aKR{gW=}!6$oGl(t2CDzV4`_12U8Ic-xawRNSGemY+BF*M<=E&!*n8xg+P4rtajI zgAfs>t8+6NM0K#d9z4Nzms%>&^Om%0F)|g^y)`vaYt0hUc1cS|E_NNzgjoG+&%4r~ z+~g_u?3tYwP$tBQCAZ&^g5r(Gb#Cg;b&a!r$GHF&M`7OPFq%E4Z`U+qNC!KzB(UzaG77|r6w(Vlcy zlOK%RCfy2LQQNmKuO`*^}T=; zw!5@^Uo6L|88*u{#_!Yy7>KHc`f?K;XM84IVyVs*uf6=5Vpu+`E%y_`S~9Buv66%x>Ic&6PWGOUcJ*vMZyaNdV3R@*GEVjt;EWJT^{+IxtBsx z0a+tLAC3!+<589M>dum#;K?oHZ7g7VO`EkcT%2t(z8YlZjRmmNcb<_fgQD z@RHblHr~qG=k6SiHbyG&_BeiB94Ou@|KsQz{?~^Djjg){1M$1C}-|aUlG;+ZtHza`A`wo+PlQsyIqu+ zSw$??2&c#T&CQm~M7N#%R_}d1eeFmQ5b&v}DAT)jq-8#RI6^FgJ!5!eWoxJ93FT#n zgsjcBLQUt5dV!-qI5~$rAY)fv-`L_aB4DvC=wiz`Q*r;R3&Ze}N#(eB^hqcKLo|I< zq@p`F5ZcohH*6zlc52X(GL-u*sSK9YiNp7GC5ic-n6ie2U6t}L8sLfL*#rdRKc#nqO9UQb?~0p=Ik?!j`$|qt&0Jij z5{Qy6EGj^O%}E*d7wtsQb0^Yjf1gp>$qmOd#AT>|9#e%;>sCO@JzX1AjB9SyTFJFT zL4lLgg9m00^RQIkzl%r;8+x@0utKcZ%9ciBjeAVMu@~0QU4X5UYKjlQ_k?{7t1aKX zGiyA`mwNc{d%s;$Q!|1{tQfzITeX%|^AJ{I9k#W_DfhCf7yY6yA#2a0C3e@7r^NVh z)jwOuh~1*1yDar`Qu%4WNqEz%i;I)y4_JT7+vGAt5pReBDAl?Se$SD_t3n{`(;vUJ zPnsEd9Pq{J99N4vkA@Ym>coYHC;XS@RlX;DVMH6Q9lJBLD9qH9`I@_(7_n?BA6zPo zuS1 z5($kxK59JJ<|;V|TB%^lVI=M0<+7V-C5$Cw0ULJuQXjq{;9Nv3^;GQ zrXmY;Vu8YpWL;yA#tH5C@x&~b09mT>*BQQiM4jidG2OCvCH1570owc&;+XO#_rhOQ z+*4`r^&KTjcZO>3hYidtaWR~9o29u=*%l9O<9*O{`7|DI zCU$mu- z$5kCur=0FyQ49@?*477l2@?s~A0AYj$wFOHQsd$#CTy|3>TMg5m1Y`UMIRZDRwWh( zzt)TAY7T7;hACCOG9y8{BbfO`p1h+V6BkxT&M5j!Luz=tew?O&^aS_QF{lVpuND;c zXcD_G*?_X!gTn^-H3M0u`dUPM5_9qW9$secK4Nam`^<2EfW93RsIOmn+f&(@>iLHZ zf&asP*8lI6@!KNE`ULt!#3usK-a!|dCbv7}`8p8{cH(Si>e`PfZ@!sC%gbT^-g+hi zqLi`IP1nWq5Z{i^X`t8XHJw`;)jVwl(k}LM&avKp;WsU&3bPAhiJ)Vc}M`X0QbWHxHH_cRwi}2zzX0YT_7O!Yqvo z;oo8FZI6qJi)wLu;1vwc_Dj{_d@AA=GyXysqo|J7ShjgM@V8s`Rp6|U zhV)NT{bF)5|1O4$ask&-S|IV>xSC>MP6*1V-TGTPs-<_v=b-mCRwZsBqK~yJlu&m6 ztyKFoi>ZAuIeWDGrbI4N0zFnCfla)Pu@PHTP0Fua_6S*B;^Earv%DDF`VVKx;Mcc0 zNP^SC=ufE*TzrY{L#%G0+qDv&80(jd3NqKsN&tN z_0o|t^|&QpmdMXCB`K^VRHnWRU3Lv~h@F+h5|a@kpcdw3qH6nuc~xJ zSVn{Hb+Fx0_fy+`9$e+4nsh(+b-1#|A|J)q3#^`~F8Eh{w7@&0OZ%zY!C!=ir4tPN z=!-%`g0Iq;PmjsYP5Tsw_Q)xl1^iE}p6B&g5@SWB)4^+dj0e8HmNGY!wci~U(EILe zF~WU3Wn{3VaPu%!)HUg2%NGY=-lv|9L3gSnbf^mQ~v|k z1-u*LI)i{2)Q{R!=o)%pdT1ncy5?~^ve-~{yD-AvlQbzC<0-wn**?^1voO;GiAugAg8NY1?Fbav_qiGlgxE#trgjiaPYB{*{yAyr8fs+MJ&FT zE~}1B(d`b!b=-5V?Y~s&tL2RSq56;*fxEX6JJPb&C(Nad_vB_~^62pzpt}B~2UX=~H2t8fbdtQ;RQCLXDvjE>MmSECQ3I^(9Igl_RIf;$gh z7)M9pk~9{|oy*rO!aD47+XbKdOtK*Fb5mTCK;>o6b%K8s^obyj4T!1_`X_G{G0bRhJe3<40mWF zRdxj|2|Ln|+Nl}nsige~Tf$v{;M>>t9xYu7v~N9@Xo?y-mFGsZ{czB+(WXo)_zdn; zDHG27d2?VwGHU)R4{Hu$eXa#%=Z!lG^ow2oL^7H51`;`f9_O?E^}XNh6-* zNhZ=J#Si?xdT>W)3H+!nrA3w@DrRA}Ef}aU_g6-?1b>hLlKw`hC{$hVL3R40_ef$X zcHS4(^dS(Amrb^fT)rQTV z#5akU&;5+~n0zyXCt!xd=?MbJ33!2~h_g>o<+UZ7p7YRU;_lwPoL6_!v7iXmPVY^t zRK`=TN5q{X^Q03X>VKxG#O>RD)S zvT)VicG6mcUxQ1n#CuI7w*Y|j!=1R<5~Uimp3OQvlmT^6h{5O>w=N2?Z{qiecsJdq z=W2^v=k|U)`OTI>E0zBWzy*q*_qFKfkffE!rPe7!}lLtuL3Zr++v+oG}+F@p(0o`a+aGxIC-Dqd%LugwWpdoRVyYPX`Hu zIlsr1y!19X!CUx-vKl4kXQ7B}-T`*7TtPGG<%M@G|2i)>^X+!O=A!RXZP3P`y7g0! z0F*A*w&yw#=!O4!jmeih785?@VI$+_kRtk zn3X*!?(&e6&8*lTPxi661yGPNp(VHbZ^@eZ)FG~j8;B$Ji_YI_HOxhY$mD6393!*! zgKOy_O+u$hr9Ll*2+ib`qm{g;LMpGytzFi-GhxIpoBPh_o^ii7SUv+$B_fj>3Mk8? ze|Wu82P4THuK!^@|6?oxQI~SCte^30Y0j4?PGG|6TGU@;X6TqLZp)UcQXnq_usD#F M*;&(PXS|aC4H2%by8r+H literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/lookout-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/lookout-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..7d3c2f51e469bb1c98c7b1091303d72af8e0cdc6 GIT binary patch literal 6649 zcmaKRRa9I}&@B)`aA(j#2X`MV5Zpo_xCe(I!CiyPAOi#s!Gi>c4=1=ofZ#d|Ft`T~ z+{s$^;Xd5|f9TU|opZXos(RP1>aJK#4JABmDr^)K6g(AW`S-})^b#1HWmR9ISMY>crOYHWu}V!8y(-=<2*l4les*E z^rv!D=5*B(s5N)9jWHBLj%#*~hC8U{N|HMXDmG+!E6WO5F=f}Hq4aHcf26igs}}+ancWM|1319etOj@ zKcgqZfZoP;HuSggl>}I5@h7auKRf&f?oePq#8>rhWRC^|qpO9^e07R{11or=nIvOi zz{&0<&Sed3`E#TWcyw4;Ld$w*^b;7XI6bsTt~l(?yOxX>L9hI}14LP0aHBU8W*5A5 z2-=EL{8XH@u1rUFvvA?AhMzu}wW?E}XtQ2|6fR||_C=Xh%v)+yB}CJ@y>$1dwI1WV z(`oACKEgpyeLR$jUla*={1nt%@Gzq|r%0zvHxgq`5qOh-vUS#eCPSI-&uLn6(JjyD zfLpl*m-VCD7i+Mu@n2^NRW7ws$kd^6D*P7EiA-xU-S>PWETo2SzJPG$zTp5Tekne& z#2mUIrL!DgB#I$&yfUHa{U+fVXATTW@oD#Ns5`QC;V|sORpPf@k}Q#OTMpQi@l3vH zzo{*P1C7vr^egT*<1~davV(Ob?f~SGdITkj#Hz>4zRr;?Tz=rUVvD*Gwo9H-!dbcc z@F+zv5zDuil!&hPi z$koG#jQITUJW)$cf9e~XBj%ccxC2o{xgq(G1oi5r5hsK?pq0FKI0&!gn%I3pgDdW( zuAXMGnlKM~8zBf6l1bD@M=(Qquyyu<$t(O%E^gyy(yQsn;K{FKf|fLwz%t(DXx8V_gu7Ykiynmq|+S!wQXDtaSYKy9NMhbhGt?mL6Y;EyjUKI3Ex%|=H^ZsnKG z|KiGVGrlZqJS>b*rB6;)@ryMn z``yiW=%0bfnl@#^Uuaes6Kr~OvM|y%!ek6Iz)HuWj`65t6dy$lejz1R6*-K|K1xv& zho6+rl3rZir#K^Q7)9>fqBj=PjVaM(kF7q=Pz0vw+%nFC?M#dG4^o4*?Hp62<7ZmW zDy;Ip3GqY;*I^p0Fkr7IGo3+nzegg8IDp@qSy#q%uMvGEcAr1DG&jvrHm1%@gp_)> zr8{f6NBjVTYA+s-aHdxtLV?BPW~OA4LaJjpz+vo~c|>Z2V`x$vI&k8cnJPhz%KzNDmaToTlvk#{3JZht>zLGIilLBwBnf z6(3fP#F~=6y7KZ%MKSa<+kiX^iVns3r3PJBmF&Jp_sRX~VC(Kh`rl!k%Ll8ai8OHB z5ZXKx#1KKBi8(`K-^Z80-?zw>b7p`uDCMf3<3Oefg$8T;X|Q|GCBC~%GNq2g6C?x{ z|K@-3GVA--zyovVpzt**x~+xJ?32&wEzw0D`3$&>{%Isn0F8U2ThlS``HU*qbyg0$ zPnxB$p$aDCX%D5Vg?FH`u3Ti)LzTCiIAf&oMke&2!w)<$Ns9V6JHOhMpdn9iA97va z@YmEke_1WWlW?AgmQRXdJYkjqd3OB7T=3XEdEujMt)-N(GIZ$f%GP6h6ZUPKTV)VU)) zqpmG0LlnW$IC-ang9@z3d#{8w^vD_mg5q~F;I5x8g%eu#lYx`;+0f&vG(Sw1^%`nG zD&q{rc3QZ2+;t=X0|{L0dr=yzF(m2{lyUg8#7^+xGp*&%dANho(-3)ghu@~#!n(q((9l2${VnxHQg2g8$K$YS znvzQ*<6BFvY;DCxU9*8qibIi90+ief(^&nVkr?%@gcAe`xMp@OqGZ#)i}Q@4M|&f? z2WP|;`-m@GU2%>Y%TCXYuEQMZ*XnV;h)ofLm$&ek!5k~;L3?RBw<>7`RKo$l>c~tK zso2>Q;#9ll6uRaHdLQqulwRH1ZxWt*9dGTOxjht_$@Z7-YObJIVB;##y}_5tK+Nu~u~u;A7_)NMsaQ5vd(*&yDI) z3|?rG{VC?&?a?Z4K3Lqu4I-@zinpnyJ!BH*MEvha|kSoSSr6QX5*3%uJ~(0&DVH5^>~AGI>A&hjO31g)+J zG6XA{O3?HX+I@r6hd!pTx z?ibl>AZKTq;v6nySB4sy2Cg434se%<*0(+aI`jynU}k1c!Q49xQ06SkYfF*zH7KAx zeMUp3cpGiq&(EWEuru^TnHMJSd*p6ho2qZr+%VIgup!i~-uFwZu*hSFESb-9Sq}Kv zO~UJDf5vD2eRZ&F{RJ|292~`DsI341+7N=g|G6&*&=nVjGHqw)IdOHy-WMm!>^BNkkL}FFD-neWNi?9D#Zc*! zjY+AAk-b)+CsLoZf=0MdP}swn>>1h1ILa4wIPp_ol(9$CXyaEDCliYIq}=glViLWT zXH96wMn9LAq&#^o2WtOl)rt@Yv{cN>N-BGxzO9dSZfJflx+nub)ACG6d0gvZJlDDUUyl{++7+ZG%Y=rFjQ$23~Ua? z0%C{sWNc2Hs(CxURBMVN^OK3g<4?rDWf8c_0aY$1KkgaLjA6w=T_f~A82L#URERmT zYv6-h)U}n@SYs{RJY8OY;ek!NX10jQ{?bJraKDQ3qAqoMYs0P4M24U3ei4#dNG8jX zBn268G&pH}s^Hye(U~!mQ8p^cuj$BBxVz*ZgGck`d}LZk3uk1{$el@HrldqNCBEK( zIFF$t^eq=hOVpHpFhEyJaYlb%P7yPP3s&cU+nej0wlhw_`rfW32XPqOs}kZkn!-pf zC%XXN|Fjd5ggb3_ZDI&T2F{CtQD@&D`@)`yP$DGReXq|}-_=`H{3_B;a zYs6SdJrw2*B}D5}u9p6*0>=@$(@5YzlR~bz z@Z^++N@9;HAjWo8h^~VGXzR#T_VxQ=Flq{jt0MBD;?(x-^nuQpr?uaBtPIXOpzoK3 z<@FDIB4Cze!p}W>^firLle2U|8M`uLU^k~Yh_FH>bZexvZVtY$YV;6>=yRSxJY@%@ zfPA|Tllrfe<6<}HfZLHw-J9=%=q~f^HhLaAI1ZwdE-WuOf8)<5_3LX#)(!v5!FM_5 zeBjNyWlgR{)>Wa%nBGKou>p7_@G%ZM7F2pFK7;Giu$$G^}pwQr$rv4 zz|vajIxbmtU%R_@U*~?DZ1ED?R~^L0WO9_}ZVj}8nZuj>{v|(wc0b^xn8;Hk$%U2EmI1foQ9RwL5eWL3`Mk# zE4GjZ{61OPYg=y{QRmL{S{F^WUet&TM-3Zr@i#qWs3)wiWBr;1nc!q*7?0R-h`5{f z5Ia>w?t?S!>hFGIf#bMF7T1F>it=DC{^Fq=G@FO(B%Zop)pEL zb#@Uy$zftLjbTfhE~92qsE$Ep|L>iF;Eu;P3JE^1k1WN4vnu%_FEC1LUwQlZG#rK# z?Af2Td{4Nuo?cxYp9D%!P*G*q2T(*U&s@T#ofG@Jb=u8*FlO?ZzMK4r$lLzf@)F;Bjgwks1NvYUj%Lc#9&|%57`~f zdXLJx9goEj6VWFmB&2B^KoRj_q)9Ea`va=T%6`+=BFN6ootW<#Jp_WcSS6xYZ8UN; zs>=1H;k~S#aBlUXkcbFzydpa%@6h3&!b5T3@$u2he@S6asJ4^Y0~cgt=f09wr(_UC z2l4p`rlB_q3NKl-1yE??2ln>%=xOk^wX}NnW>C7PriSQ(654;hH8iAr`7$-+i~TbA zqL&ZseMB+!y!q;AsVT>Rs}(+MEl_t5MeTcaKJ>jxvXkk1bMu$ezz0M8g?XqlNCwkM zggSq%8S+W;k?`*Bj^y=uTXn-F1Sokw%*18Xk%C>cA3?+RGPC6UExcvT1qI{&;cj3083*#`kL3B)?DjV3 z9hanu@z_Gwy{_$4R^JPP*FT+&|I_eqFNqA5#mqJ~x`ka%%`W~LUb|WCTc%!MQWI!@ zeH)q)@?iXQU0&vQkX2TmD;Q0}s&UqDl|+P#em5vbP!~Ah&X|H((|OPF$!SAF5&$pn z4#LRc_Tp?VbvRn;%z6H^>Y=mn`z-G?h&*R)u>0xiW$;r&e%)2u;cai8&(?k!NSKQ+TW`XpQ$gL#7Y;Ct8eZXxx=Z^y%6zg@7=eu1>=4@mv+eNYUPa=mIG{f$dW%% zNMwtfYkRpw%}qSds;pmv2LEZRx_#J9yu7BesIv(Y)#k6Ns%p?>DTW_yRps>N4Qhz@ z!*M1zU_IyocqO=+KAEWT)%S>>Q~@?p_SMpR$0>p^7wnb`D_}V3xYR(79i&>e7U2K1 zE-B)&EbrkV*!OzFCaAgcFXS8Ylwv^<(QA?0+G_A)-fh9-(%o(GSl&u2Dhgw|5loxJ zI#5eFaO`a*lCyt!DDk(D(CPWFV=g#2cdk-jTQ|r*#2iHPMh(PP^PR%SJar^u;gFda zpCn$MLRfZSu||-vtQ-6K>fMa$lg@1zLQacx^(0W^&($XNHN@j8CntxJmX>AXxU{&D zv~o>DO%127udf^@057~qDTx>>T3a6N_QHI92$=ssv-003#7>5p?5q$-g>mC}&{Cwq z=QJ8lB~F8XIl`KsjBtkykGz30>*z8AAbC$+n5af3Of=XGV*+|Pc)G$CO$J!eeYpqw zt^RmJLYNc~`Ll<=w?SQXbP8GqP5#2?1_=vhL6Ob#&DJ2Mly411;rWk$lVS%fs|@O( zl!CUk4wo#S!%(_|&J~dIf1tpKmH%8?%3}67(T%iCs~3E5_JInA z5pr*5w$TM-K-bm1WUFCAN*_EH_V*!n2u=|dHifWScsTX=@EnXpqk7j0WbUKQ?s!(N zq#v}cO?>MdT;Lj0G?X~=`?oxD!^w8Ywh;(zZEZPyJJ#;|0bU1Z7s`eT)*N!ndLU!2Z=(l5(JvvKkw)O^+=XZQOp>&}*( zea?dm$;+aiInQPm0M7HDuvaaYYCi8ZHAA_^kXq|))KW!!ckU>pb&uns`>&Xl0dNCCh z!}aO~|0S0!a1U5E5o1SwFE6*4KUzwi|5|jfyhS5;gq--_Wxh&#L8(K(C4WEV<;ot! zS%kX6-=FUc@8Rq&2$Nyhrxi&KDK>s425JjlQPI)o4}aO>WW(A~+WTJHrppTW6UPs@ zf@!R72xSQ&^2&SSwhfdGVyzEsv`MoI3rdo-LoioOq(utZ;JD1D3s~rAxCD4iBg8xz zI0$9nl(i?0F=L9%mz}!d32VNJsWiL-mel=1=}^v%NX`wfbpdFa5St_|0c{c@cc)74 z5Im*_1vy=xuQYK3aBOUB$gA=T*;-6^Osa7fw6sV`cMkHla{zkwU&j8Y(!>8!nLxZ{ uJ^okbm_wF1+$SSkzKqjLMA(9#>8|%B=KwAGmdLUVii(1Ue6{R{&;JJ)fXo{J literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/misp-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/misp-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..39c75e6b09675ddb1b064711a86ffb5b16a7677f GIT binary patch literal 6911 zcmZ`;XEa=0xJF0_qL*k9M)??>(d%a-qZ7i2&O{%giy#D1q6aZrLJT9K8zpKa+C&?@ zmoY?i6TRK}*1A9MJ?reV*E;9j=bXLw`@GNd?j3Jzs6%^~<1Psa2`%KYwkfgp`L9sk zCSH4%|LPGdDxb$tKN1pFf&U6A#1ybkym`kTVgSCgMn%U!aXUZiK7fRTqX43Y)L1Sj)+L&Q~@8rS7}qB(127N4aFRC{r1 z(pxsdZ`EQNnqH$}4s)O{R+D@XY;k)pUr?7Ujd&2+$spxb(6$!XMBC)OBlWBA)z;$L zCcmzLizUD;nCf3n5#NYkQ)`uEtRaX0+_hY0rU3dRkg+O&NvZRSUQ-yFbdr?{+ebcO zuI~Il9uINjB4c7<-AB=nysd?tRL;%lq0D8p1G3poFA`J4W6#Yf6+TFx9Ze_{F6l~_ zK!2|nvl%l}=&CYG{CIWgrANiGsFTreyia!ABX_N{1t_#JO2>-vxLj-4nU)6WI`Nhe zhB+}Px)z>uIclrUm3Lhd%B!!&Gc@Wv=hOEsDe5ENI~+i~(db6-zO7~p`At(BGfRd|ENrmSsm+(DA_BkOT@app`awQ zoU|E$fj42n>i`wv{ue+~L5#eG&byJf~= zulUi6Q8lD*h5BG{j|Rfru+bA8&2s$X)u|0%>1}Kt$3Uu7g+T9$O!xgE8W`!cbxC!} zK;rvSwPO_XNUfJjZ6BRQY_LlJRS8f0XSm6F=IQ27D(qM$+!7?!@k{-y1WqIWK_O7G zpdnTJblHjwgJz&09ju+DN&tu1JEwQN8_SqS0= zVu*-(P$h5DnBq>8!fAX+&r@DK`8&Sn@)jGaldg{z6pdvqmiA)VHa#^d_ApPx&ia{S+Y z;re4J`F@gcSYcH1ns+%kJ% zp2dcU|_e)voC*}#uJSMZwG2Se| zrh-WqYHPNe@#J}^pYs3S7k}r>-Q819+S?bBr_w+cHTE6ISsNQ8tl+e8`G=LfG*Q+| z5{VIe&Xqt$iC*>(L*wgPg*uZ?%%~|1e@d8-k{Rk*53n|BLCn zRvMfx;U|E@GWeH|6u^_m9}zmg$s{;0~M5o%=k&} zj|r}^&RDIK%nEI^ZBf0{E>g=e$MYO(hcz$t$|XL7a4*y|fFJISUPiIe=Rr<)%Tl~1 z?&dRz5a(Bs)By8bx6aaTb0vR5U_0To><|)S6noel4IVxVw}?tC7Lnv`>)SFfWF&QI zQbPI4>}t;&VB(7`L>SdA@2@Ij$hPBzr_maASg3m1u%~un&U(Wjl;oLidx)r9F8pD%Eju!i_YTwQ6O+yZofb(Lj0i;T`)vOU z@ri1z3qUld^CbqeQPJNBsK}A^$Wag0pK1D~KB%Cq;V%MOiLYj#T_^BzGjYf>DGBgw zj^eXsQ^&=gW;LUZ@uhzXIY_~z_a-k;2mSBGYwA5BY)Be~4j$$3t_#XgoSJf*doV>pt8%s;=LOZqj`X#~-^!#mfm|ZL?4FRTaiiADqn;g1cpuNT> z1LGsE&Ta}=_m683NbL0VW8(iG9{PIDA&(q6)h}j-4_>x4`_6dA(sF`~EiBY^I{W(} zhJ|X~X~jCtzIcvw03YU%i-BlgOptD=GF;U$Iys2EAA2XmC~Iie{!3NAAt8*k+RsFbX4MoX zFlklq8wHG6US8f>af;eX->7<;t^n2Ty?JoU0?FNj;3%Ve57xg_wXcSHw{|tQAMuH2 zQ)gphmiD^QJKyd~Qjc59` zn9wh4FqE%sq~jt4Z@eft{z#vfAr9SL{h4@qMi}mQ#`;-p{R*J%w%m^ohh`nTR2hqq z2}$)To`^J-Td5mNq@LX^B#8J++5Lbokq2-t$B%#E@dBY(K{NT zTE!WsZ(#5O)t0Z#mptcYt0-&GjXN;5HA&{x;LFi4H?P=SaHZ+Czc}7exw-VCPR>t( zK|jmfXN)KBcV;v<--r{ZB;!eWySO!_7`_U~(HHa{4z61JI!GPWnZ((saM)Wcd%f1{ zis*T86CAy`xY+8wB%`9Dzjwsx*E5zQ<&Nt~Qu*c~q*nNSWJI#KxY+;XFLrF~U%`w| zZZp!ydvkhjn+qEeXfNE!#SA)t8qdP=AyzZUNJ1Vy-zhstv2dMj7yeUb*t67arnXgW z%XG~^!-RQMHi^I{?z6fEsa`RPxF-BN(;}2Vl&UYt_Ra$B^~9V7i9*F2L*l+ZYb2AD zlB(RXYQIgl_0n%f~e4O6b3o+Qh&4dRP8%eQ9dl&haZaZ$XIDk{Hz z{2*s8e@!Buo#?MLc(HeL@8=eH>ga84NESe^$$2VjSD&8Tus{WDVIiNHnK?euLunC% ziq}3J3bOrK3sgB#V7(=|fFBx}Z_V?XLu2QNu4u*uZMO+45-!?0gA#(&*UU9E>8rhR zySg+z=X&rhY=wnBOJ8NJ?+dafN+~EbePoo$p;1*;^$!R*n6MD61u`W~REOXmJ*~1e z0J8EkqT1!(=+d*k%gE7Z9jj;MQkUUTbLX+_%&Bp?{!nd}1C40&_K@VdR~LYJuB5CC z5zGiyDX@-7DEja%xff?0>gp4>w50H3v^e59et>0rrY?79u5qE^JB6mk6Z1;zW-X=BS zm;eeM`~2=s@d=%0Z_(siv8Jpa zbL}m})@nJHcFPqGUvJ!Nd+Wg7{8rW=!(OuQIxLhblU(t|p;@K$VPr4Pp?4_XbEYyLy+DGCDP7#Fy3=fU2uP3EL`3*sWko0y#K2_kz{QfRf*zTjjx^#K8>< zQ}u4W=8#K!Y+JAy9K8sQa89vKU7A#b(KgRk*^D>1p-{5xyUGcX^n>4z9r;t|Lj+ZZ6sJ zc)Tn~mOc^OUk+7LQZh03>YB#;_A7e-a+Jt+gGOsTT)gZ$fj0YYR*&NNst6ij6NS@N z(#oaQNV|iB*`SWx;W2)U^pht~S}%4(^Aui?LDK2TAF_Eic;(jANX5Q=TVn`Sr1nS7 z)0CHEvDohjIkC=sJ8{zWrmX_)L!O(m^78ea2iMAG<~G=+U^_~~RK6Vjw0>uwW}7l7 ziwU#eSoVygcq|P1yT!2Vb2J+r&*%1bct2*nZX=j|KKr!{)8Sm?U`&P&gwYKSZ{Ioy zIzOw#137Kv<9-%h4t7Mm{axtp>b>Xe=2i0MV_<${bvb33E(B zLV_Y00ts<*`$v2#BOl~H9JFy1Jl*Vf2kD0A!y(;PPtGXccI$ENG<5{-%qr?=*i50y zX_)TD_~IRF*h2&NdhqQ#IummFE$1zYOfX26n`>F=r%wgmZGRaX;YTkvO_dwr3;rr< zV@t>HVL6XKBWSm##>U6%f44Q%S3K&6ktp=bqG83STn>fK;@YJqBtkC_L`2hiYD1NzuH~W0M%E4OAsk?{$v`Bwf-V zBUe7u&m<6%UJaz~mQ2--$JUwxF-4`N*_J?EFE24kv2oSttmi`^>aK`KBAMTJ0&#@1 zT?Le3i75>&U4~%^2`O=?%*|QCI||d%7+$`7i7G4mSX1**!l4?C2KDszxtjah{2WP#^M1oCzKS?gyBm^( zRU&;=+I1L;WEQoyM*Vp#hlWY1sToRVY8||c?`5Kl(il60{YDIZeHI2_q+$j?H75)rQN zjU_1+2xHgRq|!MwE9H`i@*+2-fPjX?M=!7WNLj!Rdy5;SLR2UFE5np;MMLnJ*?zF| zJLffCxkSy=9Iz#rpIuc=9KP%I{2*Zo2^_(xS0Vfo(9j@7>@KQIc;l=5(&vVT%#2b) zMYt%$(Lj&7s{Pzcg-4>)Fl=z9Zi8Ms(o7l*hEaI89SL@6r0VT(zaH%DZ*o|d&|7sdGZ<81XJq6}cMzN& zah83f>jr^@ljjZUw{&qS_YqfVgrs>=dP7!XHW#ILO|1reK^mOO-)dewhE$^>%pT4?V)p4yPYEcQGrzB<|7M0fc=^BZ+N5!p# z{%o#3?zaEXQ@tlz+GPlDyHCw-PI=@cJ;X&_%I(NK?_NZIHn>YUgJv^Pa zvc!mA`h|L8CnF6?C@+@`n?F4zN4nK|FWKJXK97^=P#KE6x_}@}xvu}p05NNs7VSw$ z_dJD=bWhM0dqmLkCw*TahDzqEbxl;ZtxB9;R`bZLE?=59a~}RFPfD&qF6iKoXw^qI zj{NKh<*+)?RoJbv@`O2@LvV0(1wzx@yfPplLl*#Xk)cfQJ3UoM2ab-6yax1}#fnbX zg`O0>Xto6Qq%2-PoG>@H{uY=-j41cGm7?8#w-Sa@QUO%mlCJLVj!W%rMB-o19dlvl z<`l^2Uk+^Ee8B#(s_H@GT$0z^yA-2T!%|~r30`BS_sj6#j& zX4TN?Y6sPg;YOlIBp}`1B`2rrmbenRx4lh*H-S&cD1UW*FgNJyR%?mbubX@fo=-Nv zMLce7$twpf2E_F21a6#P=TOzdl)Vv4d&NY_ose*s2+=mxsk4cjGkG&}{Dg&_08inn zugeB7B{jzDnQQqYP_B(xXRu1L*Iet_`UwO5>3(s_*^zg6_wtC3IHgL)UjPK_4;;x^ zB!-vpi^Ypqgh4l3mEhM%Jmx+Z2Om!%S>A#c5c7SHAl7%w>UT)(esG>juA-Z8dL4i_ zQ&&n+F`k#QY-T&%q5RIh--xVux#3*z8Bmtn0{pz$cW9Wn`iyuAA8f+li$JXW%p#ia z0eo@{^WyRgv5~zykFsoB%VT?S$cl<+Gigmw?x4Wd`Bk{qCwh7B`PIJBV$Ye@co-&Y z5cTnkjm@jGpV`{QChqQhfBzmk&VVvmSc2PZ^~Zk5id8^&wfxTS``ZlvB-hi`OG7>p zHW+JePm&4B4htT)WK$&36ta6aoT+IP2q3;eXI6emR1lM)5=K)_*ism z*@zUFf{{!|X+WX>e6gtF;|kQ@z+$B*D{Kv5Fo7sudQ_$3!~n~C1LbdE6X)(&T77*( z?Ci_5rS=n^BHkk5yAnJq8nREjcU6adS1u{;J-B}Fqwq^cx!@D%X`&nAhojW--cs++ zM7IA_K0Mn)vs@eM_K$5Uwj>waq7zsJ2A99mq)4QD%s5FYF3Foc(SY zB4%Ua*&c?Eo`NzS7Cfe>B;P-K<%}E~y9!rVD@<{ghJbPf=qZ2sIw*Q?6Kyy3Z=2BX zpIt>qX*xp%^M@p*q>=&su*b32GiLe-KP&K4|>(X)+NnJSiE2&xt}ngBd(4Zo`*rk_JmVh^JZ%-Mi(! z<$gANvsrj>k#7zqs7lcR?9(nC*l%~7;;VlD`O|}YAtNOPAwyxH;4p3P=+<;a z5BF06@o(JJ0gYf^R@%CQ+h3|~e+@8HsLbDz^sN%#h97dJUGvg40WN!?YA*rG(O!leK0 zrC%VbM5Nj4j6&bWXe?g}ohGv%N<4_U`muvC*Kz`LNZw_HVMo32tx=wF;^q|z1Z=2X IsbwGaKdxPc>Hq)$ literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/morphisec-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/morphisec-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..a0a63ce9d6f6c863d4ff7309134efb601f7be3ee GIT binary patch literal 4846 zcmZXYbyQSQx4M`49zgoh=fQ;NI2rq-J*cx&^?6G4Kk#(pdcVIC=C+QC=JSh zbax|fTP832@m6D8!3;+O1bv0#eoOb;uBt*Ej8+-Hw zr$}AZjNAc$p68$7scUoZ;T{rus6SO9ULvKYWnqn7^&J6#TXE{jk92*qw{rp!%&R#) zt&RM@j~CM$77>YNO4e=+u_-KPOiN>;@O=U#UHlPJg0o&i`N964oJ{_<%-Q#fx1631-)1IRZ(jHTnmapNtAcGK3VQ z&jr2k8j)-C%bnlxem8%3Dce}im%HlA$ITCBbs+~&ym1I>?>Y?JuTtUwc?Eq;4KQcN zUa^92#hkOk-SXArIW3b5NzhB-toU?&|G>O+|EQYGy zh}x*z!3pnjvQ^h-`{hMb>2i_$&at zwVYBE+h;0F0&{Dx{Y@YO({hrT_@=AiRV&FiBZF-oz3n7@mLc43E<n;+8A^A;jD(_zY=ojT_E_O7k))da$xa>$Hl zsZ}Wx`rplQ0x5KLbr(lgkW)hB-FG3bDF)&D@j2x5C1DzqpfU%5#b;NF1|3)C%h|Nc zYdHV3s<1g680DAjD zrO~G;V$Mi#Nd7$%Q(x+>9)mWER?@#zs4t#*5+z|@_{qmEz=*qSKD*HUdk|n3Lc9qf z_CF48KOaQg)QXjC_n5W0j$Aw}3W8FX&7Z%_N3GH}90^^eU(hrhaDWQ`V0i=D1n~Ey zEq62tuLt2HSw4sl!tKv0AKs3l-x}nc3vy@Lc-LM3D;(^K2PPa3Ys~j^^)8M5Bl7YR z|B69~bL58OD)pt|%VSj|b;Kn}Aq_Q3P3(Iv!N2cXE4+{o`E)-~Z9nGQl+y~pnQOgIv) z`U057#Z!dR0U0Az8rk}MAO%ih!ETZ+R`re4?y|ca*ap0tJmxC_d`o`x)1cCNQOkNn zp5zb^!i>5Ziq87eL~Xf3NtL&lZvKrY4n4fJNet*cKszNU)Lpw2&Tu!|q+tAZobyVy=WmClo)HdjnZ$;Cr z&Gbg(>O^$lSQEdAKCfQs_$dS~ho6>2s1gk9oP?o$W&bYXk^WJHA?!EXFF<*^8Q6SK z@J~XoEv|vm-TEgnrF2E13knG&20lZ%_VHx)XD07Fv$v(%A5pdpySDFN$;;na1 z-?t5m<%vHSktQmwzvj{9kx9C6a@X~D(5NPbb@6@Hfyf@WpV{w~1Q@<*&(OUQJK*4+8B2^L?x^r^#0H%n=~i;~8Am>R!7 zNnUFUHH147MVqIg(zl~gv_&=OvsdFSayn#mHf*7Y4WlKH`-*pSzKK3xmH`+?vc%dP zCzR^0Aw`+q>=lcfTn-1Mj6`<@S?%=_I4d@^w7V|@(6ZM;D?^kVmaXw^szPV;?u#dt z{=kLr$X5!Hb7{3{H(_mWdDK|MF0n40CBfR0TbXHJZ>}VN%%MnLE9wZUD4TYPB&&h? zi+Zm-Baw1u7daBW!Y@Rh59~2AhTu@d!$$+fyvNv1Z zQ_wgA%&g+0$5EoP zkX^OwYWepf62H8|m5#{XU)j+Zb*rdzMzsF*L%{OWW`?08tEk5WyVxn-)qntQpDMA} zQTqv7M+Gbi??2v=*v^@wVAHw zTdG?>YaN++(i@Ph?ZhPhQl?h%_s&jJ1G#%^ zAW?tL?OfaTb1}RMJZu>jv>*%(NMHRXrY>!yYR3w0Q}6G3449WQB#UM6;1$gcx4ArH zNuZU)TlXXy>9%&Ayg-TH=W`&{0pSs}jD_9=Fk$UbHh=`*E%Jp5&Bd<`1ONeFezv2M zolJkk$)E7o>CqG@=%NPUlk7=HJh$8^_3OrWq--ymqvR-f1>9~Yn!h7|aN6#ZnRxUq zP)NLP#h2Ukd7|<+GX=k9+FC2sra?91MIm;eNOs>H!CVhekVlge+=1634lqgeb{8Ydz<1Pfu6c-sh8nu%ltct%bOdqQqq zUCTW~@i>VYiAHE!);1+ z#DzI@Qt%3E6Xn}eaH+m&Tt4J_Y42eqa(kt}@4_i8PeE{sS5{~r{d>EG{c;Dx|M#)} zFv^KO0H9?9TS*a`U2RhK!W46h+aPm5W$5RCznm-eo_7}iN(j`_s8<4e=yePo|n(OKFQt+>%Vi6fyt$l z$nep|O@D)*Iw@@U`*`7w0ww%(8IR^$nsa)==!^U*)9`Fl*|JTwPWR9CDn*xHvgxD@ zFaK0sRuH{1fmT=I`nyZ~mXCwbS93PDp*LvsxEMEww9PaXK_#7P=F~_^?-F}Tk9*gY*d0)MRA@de^3Q`RV zSf45uV|CUi3z?FuB-^vBRST)qbk$ z(avKd@*BSXH2%j|ryaP#BLWG8RtYZri5EOC6H`8_8l~Nd@6S)+^t9q>^y>Xa2dfm| z;gpeMOk+*$l#9OTQ*xDts+lo4(SLZwPd}z(;Y$L+BoGjWRvcWjoY0Qx$+7N>PTn6& zjH&IiR*C6~zI8|?E;0Fi>o#m;JEO{*$vKdSNx8yQTGmd31h-=b55br z?#+{=+>+5Utw{u(SCa)**%KG(7inK~McYWdlZ3lJ6e4iRQgV6F>x0oP@?J9J!uer; zJx<-jGy8GyE_>exjRmA;-(12nLj*&GQg4lB=Vk^Kb45@Z4ijT~kkC#!kdBpH-$xBm zM>d`wbMr5*Yl$lZoD(U+ZI%O%aVcjUCT&@FPK?8Y(np;X@|sp}l5MDk;plz^EUxrb zDaV3eL!P2?p-$m-1;c0n)`(*24Hl`H*DSc?g$uW;tHr%!S=EM(ckHy5MGGg!qif;s z-gr!@K5s6WG6j3B84f%F*u5~AYa;XE+HyId^tVOzVob`S@A>vp%<5&;p$R#iPUWns z;#FuzfSrefc1c?J&mVT8+3eT#kB&~sZ1Nw!fBeYGd}?hB2fCi^lySkjN97iCF4ZSR z+n~g8$yQC=1`*jv47H4_^74#j3Z&}2y_GeTO~Wff(e0SJbvL;VCVS#KfO!^+H5*dL zZ3{Yd)w-7@ zN9(S`xWzMCm>~UT=&r$}zA}#%L#Nle)ZDmRCcM+$(?NGq2x5o}xc232?lL|2!m8Us zwo?#ozT153erw=yYWY@iVdb7MYvAkhU@?gy|B|MdiE8~KCzY6(=G{XE|9OjA*5TB2 zmy2{8(K>t4m32BJYH=K~c_UV#+1pMzBWs_rp3gch$2$L<(|;k>Ozgt125 z#Co>idNJ@}lIym;heN8t+k$xsk_yeIj$<2Rd>?Q1nFxfc(rhB7p@?}z*gfb40)d7u z#huU^#Z}S(RW9T|wxeAQAu7z}uAQjY{Kv4F2~r$6n9S(y z4LvX&^8wk?R!Y8lFq~&f261(0sU9AqqUO-};H#Ci5ceT}hJ^=itVx8@oE?q{$!01` z1pi{(*A~|IVPFZgu_5)eBe)tqV3j_gG+DNAW(meoWs1+71ef&B3uY|GQry|iA7*-X zba59U6lW0DLW)Ld(y2|eZ+iEh+dG(5Luknj%^Dd5>G{7Ge{*a9bJAWVEe;uE6E+=E z$CV`>(9p{%InK-Y7rzdo%G=RT{hDi?_G|j3qYj8_1|aF~w}e)?Ga_P_;!*bg=6jmT zXWO}0u3H7^cSRWl8*=VDvUTBbz7XHk6&>2qWO+{Vg`G3Q%J>)#_cwXJrCF>0zI%_D zOTkrN-J^26?zUaEp_Rx+dWFtLa?@=NZ_x<=5g?Tyfd$H-poBd;=Ea13x|xl)IEZIt+PftD{!Z z5%7=as)F!#{(fC_LgCX2yFjP&(hE zUB9ww@<%_Y8{r%fG)wbPM=sR>ccP>ID?joqAm(LX#KjvXD}nO6Y2$ZxSZdjJ!QFd( zdnd0v9mLsu=m}>Jzn{WiD^ibr(jngU{7yTq7EWahGF5qsdb9h)!6tZMeY2#q-S1Wy#E@V%OeE2 W+vh(EkC!^gcHL literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/nextron-thor-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/nextron-thor-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..e0b5860da67b1a1ae56e51014bb89455f713ece1 GIT binary patch literal 1390 zcmeAS@N?(olHy`uVBq!ia0vp^1t8491|*L?_~H$uI14-?iy0WiR6&^0Gf3qFP>{XE z)7O>#2`9gxwB{or=|v0-th}Bsjv*Cu-rhZ%tz0T|{GtsYees9G`alJjXdh#1vctny>l)pCeSE$o$&|RL2pxR)F7Ncy3Kp*8 z4TlUD6!2)sFw>Z+Td)3XM_sjksQKHQ^Xm>=-CNDj@JW07t7q|lf66KK%a>JaENp9Q z6X-sgaJ$U^TluYBavv^suYYv%L&VuF`|r&-cDh@hnL#eDo_DJBR>Af4zdX0MUkuO@ zYtEci`|Ki#qtd~PW*GBqX-m19a+imM!M?^$4BuX4CT9$cj z?dvSrI&J^Q)**@m}F?ec40{Vn%C&yuXZj?irn0VHz53vmjT;T$ym`a2 z{x5%@|7DXUmtQVRei!ndiD|{19i8cQe?K0%ZRorCr67ll+n4)0YV7K@maqT3U^ye> zgZbI|b1I}~`Yd~BdSUr0t!2xXC*C#-S}DTS>J;y0^R=@gon>sqD4?TLMG;P{617l-h9r3cYx9;4@$^PHz!qn-qX!F7Hn=9F6 zYJRcY`^U(q7n@ftdwNrVhRCaB=|++})^&R=z4VF0XKBzuL34Y1e&5Riy>1UJ{0_gK zT`w-RE&u+vZ)GpOeEnL=&@QiVyfEvTWnZ(8+U1fxbFKacuXvuA^1S%ZzjyAr>mTjP z`;Zp)xp~UzrwOx`WtQ?kOHngQ{K6{>ocWFV)>o4x|(A2!pqgeb;K6FwtDoj;)U^?|LNCDn=h<;%~rnh?}GIE zt$j7cyWgg+?mw`&eD={t|IbhQSRpelRdM?1R=15h+B4qCOZL8tTl(r|?2D=KUKQ_t zumAY`^?R9Y+uPd~uF~?k+_Ff+l(GA$643Cof)Tdo=Rebbp1*#6iS2_8e^U=vDqC-F z{9FHeS+%%6V`zNZ?seTUdg6P+LQQvMZp{51aoxDS`mflz>t7o#20dPXTB%>|LDa*| z$@!b*=ilGe`d^Or85LX>T>q5rrZmw*|Cpm}mSjPB`F8Qg3-~^YXu*q#Qgg$jyUWid w$y`~;c>eRP-~BQ#VjgLRSg?seikpATIa7Lf_SPD&0G5>up00i_>zopr02b_!-2eap literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/paloalto-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/paloalto-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..fbd16e8c9c665a3316ee8b171c0849f074f2ff25 GIT binary patch literal 1900 zcmcJQYd8~%AICShVIrACZgnuXu$B#TjmR~3)`dl^!;stNHn+cuEQN}4$>o1gJjlv@ zjL=_foN|VQno!R+m+i2*|Ml*?I4{q6@%??D=kxnL&+py$o8#{0a70o`5&!@kalB~f zdFZi+iV_z)ob!GMKTYD+Mf4#&uK80yM^BBlLkNmn#mDYw;9rJv6W>EJDDOjT3e&uV|NA$^=hU;7Tll=VgPhI3F>=KGMSAsU52zztc z-ENKM<7X`)E$?--G7^fM@9AJCX$!|J*LFea@$zK9>x)U_;VmypYTQhOeR~wCGcT2ER6o*ogUH9nWGlC);Pr!687cKyozp)Kk&9gCtm{ z7MVIF)J#;XTlx>VBvoRdW`=X;w6%%o1h~)Q9kj1wTEL#ZEiwhn*`mIT4bdP|C%9YN zOp*w6=^}R*aXz0n({7L@CS`16&i(M*MB7d2CWM1cH)!~%g8CJ8BF|~F{9|?q;C0e` za3eoyMLo+4KOSgZN=bp8)Ko7O*({ne{h_coa_P*Bn{;ggj*;H03IwqrMtl97IGNv+ zoB7>s*PusSx|X-FRFRi}3V*CvM^> zpMP_V2PYuG%9DZ)^ujVX>|m!~r=mv~ay;XM8f1;J+RbQ)PG=j!WT$(^T8424C(PFi z@cg2iZJmQ$q(TD4;~Q?4=u&d~0!Ez5fpUbBr;|fxTKJ`W;OnQw3vkKYlu(nwzGLb| zD7eflDaxduy}Bf{miV~ri^`kXDdNSi(hO5@Sv0*o2{=WZ2*9r@V(ptuR7b{9kNh$& zIh*^@gb9cYfz+6BICYb)+G4AmpQ`qMy8GpgU=Dl#l|SUu}BseVWvDRXH|gOcNE7^FDFbRW>t z`=wT@)5eH+6eFgF8*PY$)c{F~_w%HFA06FxNF@xJ>Mp?d9I(qSJo>jAPv*h7)Sbl6 zAqsYn^{XBGHA_Amm!U#Qyo+dC-Ed3U9pBPlP}x3G2bAy~-P5dSS-JOY!KEQG`q3o8 zU+dYcDxp%J;d#NN-gSvu+?M-5=XtnxI$i<)at84VH$<0`bI?1VS=F`Z7MDXc+qg4zyuxlh}DMpv+N~=U6-s;3gDfuhcw26R^y0jc)O|h;F>=OmCWG z3O|3@$+VTgm7g&x2(lQd-=BPIDemi1$nZn3|A&J_;6zNeT}^wv+on2l5)DFhS&YZN zysMTPO9_-7TNzoJzwC%!`LxkMY}W(-T7kZiS)W-^j4#PE@0~!O>^zMv z{a`+(?9|XsLs)s07Fk){L9?Peu2s2GMxhY!)NPxICl!W*2=rnb!9?x);$wsLhH9J+ zR+Jk|Mzhjp!{3gPUv6QLTU|#>i|4E(@$oKa&poRFTSg4u@@S&&Lq&=JJ`7wzaJDPF zT*~3|wTG6dvm0f+kX)y9I2kS6N{(wPgWo!U_{DoOG2anzevy#tJh8BN`ODeLQ)UrJ zRKH`YrR5FMpHGZe;q{4)gzArxrbuVic%%fAtbZlo`c^3C^RRm}jEn}S;zdg}1X@oQ z*L&NP6I+`CDvETPnn&*|Y6aduE%zc#TG7z8z>hXFpue8m^~z&`2nyd!q_m2ItPenS z3XhFZBY@DBvM3X2M#d}9C@IQ9WIv!<5Yc63%UJN9hbc-yXOWg328l|8o5noFj{Q}5 z)4j13rEy0ulK&m&f~1T|K)^h4Ds{KpN#XMQ^|VT*3yn4pWOV#PXmhy}#&hQ$X7M?9 z`N_-J*x4)eEG76aT^(a!|C+kLrur__+A4tEQx%iCoBM-D*m(a(Wu))F8~2CJkzH=p yI-9bybe2^qLUphIBkWqd<|B+dQtxNi90=ic(ne~B>!F8D32?mNX4iNgllgyyQh{** literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/symantec-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/symantec-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..856c312fcda74b4f7cc6cadbaba91ef3315fd69d GIT binary patch literal 2629 zcmcgu`9IX_7atk>zPpx@(pa*kXXpoC>jf8A5X@;1wOUPE_ z4lxSJeyw3Lb{a0epML%R0r&Mf=Q-y*&v~8KdCvPhujeE?J6Q|x%J70fAOTw&3l~6! z{bFuTVEy>djy)iF!fdXGgFuq!eleS^i_!+L$rWMiXvwv}BP1erarAZIAmFxOYhmj8 zpkS@=YOokhJ}LH1CIL-bdI=Z8zO%7x_W4?`H8K{gwwnkxa3Pg<1?&@-U)t-;scP}iUG`+<2 z4l8Nv8po3uT&8th^)t;=9B8z1^c98v)BE0{FoX1513mYAn(4R|!47&iI505$jwZ-C z-X!lF>xG*VeSFUJh%dBbyuQWfV7r~S!@gwy~qpTYP~5+t~sqWxwmwPxW1QPg_ZSCydakx9@DmkS~KC zP^*OU$ZVh`h~DNry8x@U7Cg42hZt|0_I&l!RwV`Z;svCvJOyft8=iDW_`ZPA{6rr! zF^u>F`iV8k+b92J05r{;3H^Ghs0y&k69T^{TU}0_PlksTQ z7SqGxXuypP)LiKcKnI-q&d-y#g?%7s<4|ecCs9RJG2ufxG1ey(#-bC?x zruPg#pPjw+MqV(9_@=RB;8EOKNou%%9m>omSKIa}!A5CtDa^aE&tHG(UK60248iL4 z+0%2Tdnk&ku3V?_*IwNMrrDO&f**i!Ve4~al??U5 znRV+-rJ7C7zrEuAF#9J$f6PxAl73d0`*bF)*!F2LLw_$4I|t-oFP3caEit8Meh?;5 zUT%g&Ld$X;9TKgC8f#8jN`3V5t|G<03((J|`IUX|mU{gGQ(7o5Kg`&4PMUI(#~P#+ z8n@rp8*5RhK0+W6^}aJk+4NhDLrf+n?E^lWc$&js+jQt-Q}Dk;LxFG2qYR)1qD z|Cvkg79Njxwo`45Vd+fhUb=*=!AIyjUd-jMFyDX7PS(NiCke^>tl;&b%20 zVH#zD_W8M+dvSvm1KPT^Ofmr_2q)l7K^=j_eQ9Fv`hI@zBw{(J-*Ud@^Pycpa;^H= zOxkIgw7IOa)+iwrfqAB3^tYeW?$2G%@y$n{v$D3{UaLa^or{8q5*-k5mW2@dyXC%yCVI?q)r>}Nn}QEw7Yrz`^Xre2oLMx7TM;?vv*lKIHEA{ z-e8XGieQ>6uj5m2Lu+f^s+(V!H|TSqIH*{K7k;>o=H%jpH+A*8jM#1P*DYRmr4x=?{RuCR_Q%SV*vZ8-$m81(z>E&mYJS84CW#tQS zqk*V(s|z2y`J^P5k}Bc7H#?ziE#Dtqi_d zqE8z`3550b;(L7l?C~Mbmz0!HS~G0?rZS(Go0U-;*t0*v;k)$XZCEf>-rqhDz-JIf z4gM{7Max)QqjQ9&RkvnwhRtL2^XRA>*37gbb#)! zNYO!RkuIsM&u#9;|2X=x8(-!&ok(5SEJi{4Mb$lw|C}souY36Bs~|#%Kk389;nA;a zv}jB7XFK8m41uD?7!?K0nrQ4;`7T=B!Q4LNUwHq_LsLDv&@h}c!v>rn{4>TV;qdVD z=mg)`3asJ71Fs-2ZE>8DK_3)Zt8Sj{@7{tH_@L}mz4vwsvm*kcnmO#&c zrh}BYZdgf~T0cT+L^N)3t@wV#73m@t+ zkwj0uHqAdm1i2=zi7)16xh3Zr4~97ZLUCa-Szx}tT!7%}s2#}?rWBo=nz5_CsND$f21Y=Tt)-Ji IrI|PGf45WFVE_OC literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/threatconnect-logo.png b/windows/security/threat-protection/microsoft-defender-atp/images/threatconnect-logo.png new file mode 100644 index 0000000000000000000000000000000000000000..f06fcc75896ea85084af68618bcbc31456b5f89f GIT binary patch literal 1986 zcmc&#hgZ{C8jX&Sk-C6{A}dN01*s7tQbeN?`T!zo#G#`@`LWahiGs)^OE8;>0YeQU z1|}mzS)!q3=t3yNFj5RXumK5)2$2%X{@nc|=A3)qcg{WUymQ|7-TNNF+w;1joVFYU z0#QV{Abr3JeC4;Y;MzUA;RcqYfXl6T2n1&Mm4{G12A@C?nt<}S3SBs=tRiy?f&aw| zRDw`QXTOx9)#4!h@%vhjN`=$a$+tw4ABiavcjS)#G6@i7HL24o=s!uu$h$RtBIUM~ z7x=pQ((>2ik9qXWw?zQpT!U7VA)o7Oi@x->pzN80jk=26wn`iF&FRp}=$8J`sTe-V zVnk%bHj1uo{p46JJ5j2yEDA!Dlh%TP%s3m@Ej+Vc=3+tH(W9cy?c{1#|e&0 z3t1)0R4IfTXB=!#c`ZfFyo`^|DNYX59gmGzJ#RP00;N#FZlAuqk5<3;;U1?Q0&wy3 zpVnBZFc85F+-qr4^m5n($Y-t$Z(_@!wB3(CAkB<rGDBbL3r1b??IKNgIvj^HRrwa0*f{LxA}=Z?#O+<$YLx$msd*2hx{@)w`Jd;x`XR>y13a zy)5H|D-I#<9v);D0|=l4h45I1fV&!FiEG%0&w*>fVPQ|AY~0N9zoB~@&mxpq(IJ|$ ztzzFQzxKVJtL4KdONZh`lNTTb1OF*kOZivJM=@J6x|#L?+WU=#f_^ihnn%R}oZ(1s zv-~xzE{|0kU6}4T)Zeera9fdES7VwJT#FZAkmcXiO_;8w6g_BgWus+Jo*+>M!f)MK zadf%x^s!jlKQzQg3_6xM>kLO8Tk?gGMR6y-Ha$@Q!(|8jdGWm@AY6gme$rCJ3Dq%SHu4A zJ1oF)M8(7$wy?E*BW}!S4z7Lo;e&Q<05QO{8{E_tY)LFfn}Izm_B`D@*Y?M()NwfS znM9I^9_xzJ866#UF;F#7J?ek+=9;~7Pn_{FIn8WmJ@RZH)dbQRYza{%9P#z_y)siz zmPy)g=vw9Mv74;-k0kGJkA3%}ri)EsSX^A~X{jj}9Fz=?)j>4N=SIcG@-Zh$1YiOQ zNIi6GIxP~e?QfY-Kgo)AA2~vwirH*wniRsiW} zp_}ySYV*1s<=(!i@=CS=1@)+e?euOiO*&=5o{FIi2|CW0S57}Z!q4M|<>iUGrz7F* zA-XIjC^c1#*_(eND$sRb``yEH1YYIOMCy?<#=bp^3Am;@9yi$D6l;a)3}ys|34cGm zJh}5|@Cy_otUf4mF=+4HO}?gO^9wNubklvTnbwYi`!@M_W9RQO7v#+#p8t{Fpa%dfMO~+PShhIXMA& zSF8M9cpGP3_9{ZCxSAZ33$>zI(8N7kH0y}LNnVYF#95zYY(}IDes&XR%+Tv6u*Uew zlu`oU#NBNF8NnP!sbx3~PE+L}!uPi0Qm(G%LH|0kWZC@HM3j|-gU4Cw;YQkOqgh^< zrGrDRSc+~*rLx%<&|`~B!{tGFPyuK_&~{W;aGD*K^gAkTp!qx3?URy|Q58Nfea_6U zAtb5A{>(0s$c&ACIx#T;2vb`IB`agJ;^M`vHU69=6Op-P%AN1dJ+9-Jjv$(E>GX!G zj=(z*3^a0iOI7h>_3;3%{LS;V*sTct?g4rpC>d@7Y-3QTk1w7r5s)jcD+r{ z?^c|ce(l2CN7y-c8)w!HBhPHlbWRs0_IOH8UeZm#oxFDCGifD-KZ-}T}|sHHEY zaj;ADXLG{`P`T?ee2Ap-4$`FvD4h~ZC`iXjN-T(^NGvTOT}w)rfGl;$MM|U=7FfC$ zkZ$gtKj412_ruIQlh4d=-k4{gul3XcB+Mi@I5+@J4HZLd>G@wGBEaSY%ct7dg4k2T z+#3gnp7+0mt7*t{gl#1B(bQEXTqmZWA|_N5b?n5!p^nv5Q8xC^!Q_54Gv4YLRNTrj z&#;jY7UbllqoeekEjF>Upaw*1)2dGLf&(VAQ7AsK9o@WA-R$O;3vmAV`HrpE%|f%x zM6r80v^92s*PsaZtEwc-mX;3B-f3(^ZtFfQAz`FkmOE2(d~oY_=o}d12Ht(p+ak9h zEpM`6GOIF4=V^H)&k7mglMn#+2J|cDKJ&iyXCjX(%3iDv#ewnINM;^X8p-=50<{h> z9s5xUi4*u_o<6vbSuMM9)EPv(|G(A2wNk#2R|a&g4*K?q6OzWduPD1Ymw;_BL0Mz` z6#M<=!$0W1F1QY=n_eyoybMC$!QWMB+bczlb^C3}Y;`Q;zfXkcoM&ymY0g_vFPF;@ zd;AAVx);^YxL$qJ@fl6xUs4@rb$DmBBqX3jsdVO*-U|D!@fop7)o7NQxsgoIGQ)s( zd2mx}_bpC`<9S%V?hS4@*J?+=_)_;%{3;ih<+I!n>yLj4Ih~_FM~C`>viFlTw`sKX zei_HXT?!&Agw&%Hbsa@>mu{<#u zyfkVPp~|TTS5$bol@mQh;ryacKBS^9SXt8$pHG?ava1;J9VcPVnL`aP2N zZLWLRr;-Gau|v2oXropOJT!P>Bb}ZEY!?#|>F6+zt`~nm8b3?s{BUF;=EU;!vM=f; z0!?f-JEP>V2p%CovsM{M(KXuJ?iNJ(iv|}@))W?&lT?(-yA6GXj_74anv2_}lI64+ zj{dA<2wEMy>p8@0lCyua4$1f3Vyk$m;+gM0VLCgHup+Ou4LK{*%MR@>4ztV1kfhIk zRk}E#TxNR$<+vd2qWPU(o)u#tDXwr;8OM>dlWa2mdUV|HA8b(c(jg*p;$P*y8;P-u z$hybqg=}d5Q}7Dp-%b5%b;OnIPki3ibb_M^8){_Zn^2&IWnY=p#+alsWrnP$Fb%c3 zP2-K<>A&e_-8I`1N83rzIJTsfWD{efv0rxCL{fxC?>@!&ZlEk-o}Ttxa{`IhQs%Eg zB`ubRR90_r=|H@~z*OGMxePLyF}WE(3kTmFllgUW9?hOY!F>hqjMZ4WvFD#TMIC;AfI!inN;_FAQKg39pgx<#q+Vqn3w55 zomf4`{ZO6#_ZLR>_kHOm-IOV5{k@I#j3auVf?2nv0U)$I~3 zr+3(+CCO&l+!0(f-zZ=sJ|#Ko;5uW}X2OEU&T%bTv}Q4W$zZ}}eKOQx*(f2SJ8Dj* z92ig-r<(@1fO#&2l0}~Bb~;%FJno`-P0bqzTgl_E1?lo4oo)UenVZGamvz)sf0Zgh zCDDCq5i12o1GBVNzQ1CH`}Fi5U`P;m1BdM_w3*#a>%^9OAqvGp0g?@dd=k5*+moTy z`51@sO#P(iI&p8~>B)nGQ%CtPF7Ix)MlW+i`Gz!1e(|XFm0Eiv6t3TbCW*u|hK6%g zqjv^^1miKL=2o3-*|rz06;DVWWtG;SObw=5zSsdV1<-WSP;wTbUpGX)_*2AQPzo+D zUoY0Pv3K1CJY&w*KUh)n731o0E8DJeB;_z=sK-p*heBU=(f;Pt8etWOeys=lEN!?( zM@DLje@)NS^?zMHximHRGI$Om&(<)Q7QGie3-d+|-5F1T7C+$zP<7E#TC3;?N<`_j zR|2PgdzO=U8zZM3VraToO^w15FLe z!OUtC2-wKr$8PG)CK=S5p{FRdsD+QS9hxg|q~JS!?0QqVe=Ep3!q6l{qVgiSJ3}-{ zAo$>OW@bqLzY8{#ZK~)Sx(L=6R*?gXs%YQOx+V}1oApKJt9S95pB{J7zox}&FyfOC zl#VB-@J`Mma14j4W}2(Kxsk=Vc@bhk15QDG4UqjtgJVED7idcXI@@X&=m{FE#m8fO z#u@%Soc*OqTT28prx0YbSl3QPr$T%F`WQnyor*iJ@DF)5FAaZf&W1%wCl{JK%dL8< zX-fX#Dan825EYdE@s{>|R%E}mqk*He!M_x;m|O_U)dtGB`3D#AMQ5$rv~dRsM!+Fm zzrNG9EY>aX){|Y2IkBp>IileeAHOe2ubrXA{+?j7k+IRlTJxa^p7K$^vo$QH@Kh$t z-P^k(N{97QfYDfS=|LbR=QnDASSn#d-7_K#^N4u?U$u6dGpT_zTOV;Z5)Tva@sWT?IftDWgIZhDjEv^!NIzn(5y!EokC2$VhLS+MRnlFfou8aJ1mUY2`jR~S0Ow6?P;gOfH7ve^m*(G`TK<_cfouEPxZI8V0|*`qjrI} zL`(9g>{w50Jlv-$<=6Mj^ur6Nzqx}Ua5nRA^~2)W=aG1( zXr@jyZ2Ppfx*7lvoOG978F=4O`kvEgg9e|fayn+n6;@OfJ~lR1W7*sCO>>fxm$-3G z=XKJSkN}-(VMz&o(S(MlXWgX8uy_O3^j5QpiE8m&!QhoNj{Bt2O5NL8k6_)v_N_gp zi$m1lp5ncjzQUawz3|9J$Wma+hDTR8kLDP~0$Y51e0$xgYUj;@w_Y|3Xq;+V=e9?$ zrLFy4-Zut;01{BJ>uetBGw4pw56u8M+C2_Kuj5nz{%1Va5_x;i02_}92NG7+n`b%Wcy<+M;3Q2f&vYqRUT4t7l7nG4PKY^_yG zAa=Qe*76KqtB~aFZRdT+vxr4;0F=pCn+|a^U$ID9`9diG%%yLqa$Dp{e zkp^U>d96i_4%`)J0ku?A+}_oOtW`S6DkujZ~E)$%uTb8#WYGW$dBR~cv-=$^5)Csb5a`8&zMfDP+I{9z(b z3Mwhp))vuPW`>46$1Uj1uL4H?7=Fb<55?K(W6s!!h>sr;4RLb|Qn>EoKShW$b@+@y zs+4#wht-y`vYN?6}oj?q@0Y;QSCA6B~oDY>F=5b}qA|#A78Vj0XTD zr6vC${nxB@Bo1byC^LXoIb+C&)HilNYxUo3DX9+!3v!SHq~=T8M__PG)O!fS0j#YpYheN3tlGrO%Zms=>Tp&uEz8>3 zC5hl4)}*5PI`V61rKRf%P*PGdCa4MmEm{5*!TA__V$nIO{Ec%AWO{;Z+F7hfnQ1m* z&$}g3yt!ggQB{@0fXei!*xAQS33#u1+!DXwMb$Y>I&O|@L_|uuR&;kGAn)}B|0ikNk9cx;cwL<+{rVFC znTbi^A)i35(k#7yCNr-tb<*|X{*i8gG{y37_rP(wz^upCBQK?y}Aep;`D7l*1~`D%{r=Pnnb3Tei0A zoS9!QXL*82X8tDO9I|BDnS(^iIy(MbipfuvOls%VHaj0w{Cgh>7|B*dJ9S?B@Hrl| z|HR&X{oim3WSaviuX>`mq93lItlxI<92H_ow{QbhOrc`##`d zTGf@F2-1BNJUud!pjJenb!q75l^7$LPNsYWF%7?AU43Yy)0q6pA+kPvvP?gvMRwd_ znVd74D{(YK+1N*NZ)WqR>7Uc@p%f}AqMycG&kyE?pQ11EVLW1rGA(cQDcj_!a&vR1 zW@pjoKMnmN&d(t@TwL5&vs-yZ9$mq=+i9j(e-q!?Sq8t@8qY6V-!?F5KOsj4Z9Z$i zT{WDkdb4pJ{znp^YLJu59-7wjr$_c_72avJGftc#UjUs1X?@xbsEZa%}AT6mc49lsiLb+RY z%_9*PR{nX1SUJM68;oDO2)TWHRXJPdFia1jqo<~&{X&36ak9K{JjZCZ`oPf&<3f`Z z3}{<#wh;WiK)ZeK6{S8`nUj5zf>8D%9MZVGu$5C;Q(Dvf4ZGyiFHvxhYZ2{lDeJgi7WW!a&HH6rI*Ev7`Cc)Il@;)o; zn;N?FAWBF|N-C$OqQ|y=*;BR-g^6R5h~$)c{E$8Dwd&97Yr3n!{ygK$moKPqcaG07 zS~oq-bQKl5jdRg?ULA;oftVJx#oWLq6x?0WhXIrK8uY_uvy9NYFu0}qD3+SSJp@u$ z7QCn}wLRRhw-<(+AYvU_M9R3l{fI!eE%g6b9i;mR0@a}u9&BUu4p+h9X>V}>1l(Ag zK5nqPm=?%|t4w+VV^D01?lMx~tjJYQyuMn$yGG9FN6Gfv&H01Xq4HtjOVEjlE3T^$ Z-VCibosS?l*qvPfA)Lud&#I~GyI9VST3Adbpt9EpV14s~>0Ra=o!w$apGG(zdD z3L0%6WiUcrA+d-n?kjGqT4!rEZ2AZ6uk$|7dpz$C@B2RQ^?BswiB^<{$O8bN=!S9j zk?5GOd_hJcdlwIWkSMtr%+0?8fSUeS2D$mbK1!Ujac&+ivMX|6chpY8^O_-%Dl0IoZJvVZ@>dHMHENp7N?S2>A z_r{HM9`AdA(zVo4W`F;6^a3YG6lAPk<-w5gRuxQ6Y8<45gj`jSL3KAnl`^;Xf7)ia z8-y9>_pcmx>1D@SX&D+Bb-y8Vp9{DB)(c>AFFl#bVo<#~f!o~sEpL4~mJEOJU;l6} z{o(OF6PaLz_rEVom)$2kU$CXTe_yn_Ham5wx=?QQr;3#y+IQrr&uy^x?pcqFj$XY$ zHLGf9P_?(Ww~ASG98N0YOEdm0(=-FU+e*E%xVOsh8yHA8q+N7@hd-W*%;;LW(99X# zbbj!Fv)8kF_xQvyR(Dv9oScs^X&PyO)itjkeg#H?PtZi8z z@MwzFU(7ry+naq@74dnkmF%?b{;V1`vf?(psRF@^w780mTvTV~=S#KD zDYeeATfnklZD%YNtfb>mXOu6JRyhwc$d?0#M@Fc3W*S4zPQ@`cOkQ!vmw)ubL5mZw z0;+3jI@v+3%criw@$rz+Dv#>wYDYXCLizC%%uUiaU*9UyeoLVfAJroTV1>R(EoCH^ z36;9jIBPYNq}*}BO;`WW5IQVO|K#MvD=3IwP@pQIbUUb&Nw$x->d#O9Q(CIk zK7@ki=D{jhEIEK^4)LphBgiq4ljM<-lFEU}MK#%mBT4W&3UYjmWqdYlC965HrhA(CHi6jt__BAjo>x>9`)xGfMIh)LH-^T_+NEwH8XD#m@SLeewZ`~}%IOT4o8dR# zJWAS9fT3qw;=g@r98?1tK0XLH)gZpZ=N1;OA`C_>yd*Lfj|HtpfNJd^@aDTOETTcCuMys+`L9uS#te0X?>6hj1iD{ zBelt$gobzToa%*LL{p;pL*0>9S)Y+XQij7zeZ?N&bFI#wIVDTUGr%&Yyuun>+bH(A@lfrN$tba(=|qX zJ|E@knz4|wr>qg>P&+Q4&HcG2OFdHz34PYl&K!%|Bn_k@D!-gSZ!rJXkGyS4X(p(Ly^5?_-$jf9_$8hJz1-?7e&j{$oD% z{{aUUXDVp)Us=(~NdHpmyh(we^QG5U6nOy(*L_0Ttvdtxp}wEkkeNnH&=GKR@pNW? HN2LA_iX(Ay literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index eadee9a3b6..0cced2f956 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -38,82 +38,71 @@ Microsoft Defender ATP seamlessly integrates with existing security solutions - Logo |Partner name | Description :---|:---|:--- -![Image of AttackIQ logo](images/attackiq-logo.png)| AttackIQ Platform | AttackIQ Platform validates MDATP is configured properly by launching continuous attacks safely on production assets -![Image of Azure Sentinel logo](images/sentinel-logo.png)|AzureSentinel | Stream alerts from Microsoft Defender Advanced Threat Protection into Azure Sentinel -![Image of Cymulate logo](images/cymulate-logo.png) | Cymulate| Correlate Defender ATP findings with simulated attacks to validate accurate detection and effective response actions -![Image of Elastic security logo](images/elastic-security-logo.png) | Elastic Security | Elastic Security is a free and open solution for preventing, detecting, and responding to threats -![Image of IBM QRadar logo](images/ibm-qradar-logo.png) | IBM QRadar | Configure IBM QRadar to collect detections from Microsoft Defender ATP -![Image of Micro Focus ArcSight logo](images/arcsight-logo.png) | Micro Focus ArcSight | Use Micro Focus ArcSight to pull Microsoft Defender ATP detections -![Image of RSA NetWitness logo](images/rsa-netwitness-logo.png) | RSA NetWitness | Stream Microsoft Defender ATP Alerts to RSA NetWitness leveraging Microsoft Graph Security API -![Image of SafeBreach logo](images/safebreach-logo.png) |SafeBreach| Gain visibility into Microsoft Defender ATP security events that are automatically correlated with SafeBreach simulations -![Image of Skybox Vulnerability Control logo](images/skybox-logo.png) | Skybox Vulnerability Control | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network and threat context to uncover your riskiest vulnerabilities -![Image of Splunk logo](images/splunk-logo.png) | Splunk | The Microsoft Defender ATP Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk -![Image of XM Cyber logo](images/xmcyber-logo.png) | XM Cyber | Prioritize your response to an alert based on risk factors and high value assets. +![Image of AttackIQ logo](images/attackiq-logo.png)| [AttackIQ Platform](https://go.microsoft.com/fwlink/?linkid=2103502) | AttackIQ Platform validates MDATP is configured properly by launching continuous attacks safely on production assets +![Image of Azure Sentinel logo](images/sentinel-logo.png)| [AzureSentinel](https://go.microsoft.com/fwlink/?linkid=2135705) | Stream alerts from Microsoft Defender Advanced Threat Protection into Azure Sentinel +![Image of Cymulate logo](images/cymulate-logo.png) | [Cymulate](https://go.microsoft.com/fwlink/?linkid=2135574)| Correlate Defender ATP findings with simulated attacks to validate accurate detection and effective response actions +![Image of Elastic security logo](images/elastic-security-logo.png) | [Elastic Security](https://go.microsoft.com/fwlink/?linkid=2139303) | Elastic Security is a free and open solution for preventing, detecting, and responding to threats +![Image of IBM QRadar logo](images/ibm-qradar-logo.png) | [IBM QRadar](https://go.microsoft.com/fwlink/?linkid=2113903) | Configure IBM QRadar to collect detections from Microsoft Defender ATP +![Image of Micro Focus ArcSight logo](images/arcsight-logo.png) | [Micro Focus ArcSight](https://go.microsoft.com/fwlink/?linkid=2113548) | Use Micro Focus ArcSight to pull Microsoft Defender ATP detections +![Image of RSA NetWitness logo](images/rsa-netwitness-logo.png) | [RSA NetWitness](https://go.microsoft.com/fwlink/?linkid=2118566) | Stream Microsoft Defender ATP Alerts to RSA NetWitness leveraging Microsoft Graph Security API +![Image of SafeBreach logo](images/safebreach-logo.png) | [SafeBreach](https://go.microsoft.com/fwlink/?linkid=2114114)| Gain visibility into Microsoft Defender ATP security events that are automatically correlated with SafeBreach simulations +![Image of Skybox Vulnerability Control logo](images/skybox-logo.png) | [Skybox Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2127467) | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network and threat context to uncover your riskiest vulnerabilities +![Image of Splunk logo](images/splunk-logo.png) | [Splunk](https://go.microsoft.com/fwlink/?linkid=2129805) | The Microsoft Defender ATP Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk +![Image of XM Cyber logo](images/xmcyber-logo.png) | [XM Cyber](https://go.microsoft.com/fwlink/?linkid=2136700) | Prioritize your response to an alert based on risk factors and high value assets. ### Orchestration and automation Logo |Partner name | Description :---|:---|:--- -![Image of CyberSponse CyOps logo](images/cybersponse-logo.png) | CyberSponse CyOps | CyOps integrates with Microsoft Defender ATP to automate customers' high-speed incident response playbooks -![Image of Delta Risk ActiveEye logo](images/delta-risk-activeeye-logo.png) | Delta Risk ActiveEye | Delta Risk, a leading provider of SOC-as-a-Service and security services, integrate Microsoft Defender ATP with its cloud-native SOAR platform. ActiveEye -![Image of Demisto, a Palo Alto Networks Company logo](images/demisto-logo.png) | Demisto, a Palo Alto Networks Company | Demisto integrates with Microsoft Defender ATP to enable security teams to orchestrate and automate endpoint security monitoring, enrichment and response -![Image of Microsoft Flow & Azure Functions logo](images/ms-flow-logo.png) | Microsoft Flow & Azure Functions | Use the Microsoft Defender ATP connectors for Azure Logic Apps & Microsoft Flow to automating security procedures -![Image of Rapid7 InsightConnect logo](images/rapid7-logo.png) | Rapid7 InsightConnect | InsightConnect integrates with Microsoft Defender ATP to accelerate, streamline, and integrate your time-intensive security processes -![Image of ServiceNow logo](images/servicenow-logo.png) | ServiceNow | Ingest alerts into ServiceNow Security Operations solution based on Microsoft Graph API integration -![Image of Swimlane logo](images/swimlane-logo.png) | Swimlane | Maximize incident response capabilities utilizing Swimlane and Microsoft Defender ATP together +![Image of CyberSponse CyOps logo](images/cybersponse-logo.png) | [CyberSponse CyOps](https://go.microsoft.com/fwlink/?linkid=2115943) | CyOps integrates with Microsoft Defender ATP to automate customers' high-speed incident response playbooks +![Image of Delta Risk ActiveEye logo](images/delta-risk-activeeye-logo.png) | [Delta Risk ActiveEye](https://go.microsoft.com/fwlink/?linkid=2127468) | Delta Risk, a leading provider of SOC-as-a-Service and security services, integrate Microsoft Defender ATP with its cloud-native SOAR platform, ActiveEye. +![Image of Demisto, a Palo Alto Networks Company logo](images/demisto-logo.png) | [Demisto, a Palo Alto Networks Company](https://go.microsoft.com/fwlink/?linkid=2108414) | Demisto integrates with Microsoft Defender ATP to enable security teams to orchestrate and automate endpoint security monitoring, enrichment and response +![Image of Microsoft Flow & Azure Functions logo](images/ms-flow-logo.png) | [Microsoft Flow & Azure Functions](https://go.microsoft.com/fwlink/?linkid=2114300) | Use the Microsoft Defender ATP connectors for Azure Logic Apps & Microsoft Flow to automating security procedures +![Image of Rapid7 InsightConnect logo](images/rapid7-logo.png) | [Rapid7 InsightConnect](https://go.microsoft.com/fwlink/?linkid=2116040) | InsightConnect integrates with Microsoft Defender ATP to accelerate, streamline, and integrate your time-intensive security processes +![Image of ServiceNow logo](images/servicenow-logo.png) | [ServiceNow](https://go.microsoft.com/fwlink/?linkid=2135621) | Ingest alerts into ServiceNow Security Operations solution based on Microsoft Graph API integration +![Image of Swimlane logo](images/swimlane-logo.png) | [Swimlane](https://go.microsoft.com/fwlink/?linkid=2113902) | Maximize incident response capabilities utilizing Swimlane and Microsoft Defender ATP together +### Threat intelligence - - - - - - - -![Image of logo](images/-logo.png) | - - -![Image of logo](images/-logo.png) | - - -![Image of logo](images/-logo.png) | - - - - - - - - -Partner name | Description |Category +Logo |Partner name | Description :---|:---|:--- -|AzureSentinel | Stream alerts from Microsoft Defender Advanced Threat Protection into Azure Sentinel |Security information and analytics -|Elastic Security | Elastic Security is a free and open solution for preventing, detecting, and responding to threats.|Security information and analytics -|AttackIQ Platform | AttackIQ Platform validates MDATP is configured properly by launching continuous attacks safely on production assets|Security information and analytics -|Skybox Vulnerability Control | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network threat context to uncover your riskiest vulnerabilities.|Security information and analytics -| Splunk | The Microsoft Defender ATP Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk |Security information and analytics -|IBM QRadar | Configure IBM QRadar to collect detections from Microsoft Defender ATP |Security information and analytics -|Cymulate | Correlate Defender ATP findings with simulated attacks to validate accurate detection and effective response actions |Security information and analytics -| HP ArcSight |Use HP ArcSight to pull Microsoft Defender ATP detections |Security information and analytics -|SafeBreach | Gain visibility into Microsoft Defender ATP security events that are automatically correlated with SafeBreach simulations|Security information and analytics -| RSA NetWitness| Steam Microsoft Defender ATP Alerts to RSA NetWitness leveraging Microsoft Graph Security API|Security information and analytics -| XM Cyber| Prioritize your response to an alert based on risk factors and high value assets.|Security information and analytics - Demisto, a Palo Alto Networks Company|Demisto integrates with Microsoft Defender ATP to enable security teams to orchestrate and automate endpoint security monitoring, enrichment and response|Orchestration and automation - |||Orchestration and automation - |||Orchestration and automation - |||Orchestration and automation - |||Orchestration and automation - |||Orchestration and automation - |||Orchestration and automation -Palo Alto Networks |Enrich your endpoint protection by extending Autofocus and other threat feeds to Microsoft Defender ATP using MineMeld|Threat intelligence -ThreatConnect | Alert and/or block on custom threat intelligence from ThreatConnect Playbooks using Microsoft Defender ATP connectors |Threat intelligence -MISP (Malware Information Sharing Platform) | Integrate threat indicators from the Open Source Threat Intelligence Sharing Platform into your Microsoft Defender ATP environment| Threat intelligence - |||Network security - ||| Cross platform -||| Additional integrations - ||| Manages security service providers +![Image of MISP Malware Information Sharing Platform)logo](images/misp-logo.png) | [MISP (Malware Information Sharing Platform)](https://go.microsoft.com/fwlink/?linkid=2127543) | Integrate threat indicators from the Open Source Threat Intelligence Sharing Platform into your Microsoft Defender ATP environment +![Image of Palo Alto Networks logo](images/paloalto-logo.png) | [Palo Alto Networks](https://go.microsoft.com/fwlink/?linkid=2099582) | Enrich your endpoint protection by extending Autofocus and other threat feeds to Microsoft Defender ATP using MineMeld +![Image of ThreatConnect logo](images/threatconnect-logo.png) | [ThreatConnect](https://go.microsoft.com/fwlink/?linkid=2114115) | Alert and/or block on custom threat intelligence from ThreatConnect Playbooks using Microsoft Defender ATP indicators + + + +### Network security +Logo |Partner name | Description +:---|:---|:--- +![Image of Aruba ClearPass Policy Manager logo](images/aruba-logo.png) | [Aruba ClearPass Policy Manager](https://go.microsoft.com/fwlink/?linkid=2127544) | Ensure Microsoft Defender ATP is installed and updated on each endpoint before allowing access to the network +![Image of Blue Hexagon for Network logo](images/bluehexagon-logo.png) | [Blue Hexagon for Network](https://go.microsoft.com/fwlink/?linkid=2104613) | Blue Hexagon has built the industry's first real-time deep learning platform for network threat protection +![Image of CyberMDX logo](images/cybermdx-logo.png) | [CyberMDX](https://go.microsoft.com/fwlink/?linkid=2135620) | Cyber MDX integrates comprehensive healthcare assets visibility, threat prevention and repose into your Microsoft Defender ATP environment +![Image of Vectra Network Detection and Response (NDR) logo](images/vectra-logo.png) |[Vectra Network Detection and Response (NDR)](https://go.microsoft.com/fwlink/?linkid=866934)| Vectra applies AI & security research to detect and respond to cyber-attacks in real time + + +### Cross platform +Logo |Partner name | Description +:---|:---|:--- +![Image of Bitdefender logo](images/bitdefender-logo.png)| [Bitdefender](https://go.microsoft.com/fwlink/?linkid=860032)| Bitdefender GravityZone is a layered next generation endpoint protection platform offering comprehensive protection against the full spectrum of sophisticated cyber threats +![Image of Better Mobile logo](images/bettermobile-logo.png) | [Better Mobile](https://go.microsoft.com/fwlink/?linkid=2086214)| AI based MTD solution to stop mobile threats & phishing. Private internet browsing to protect user privacy +![Image of Corrata logo](images/corrata-logo.png)| [Corrata](https://go.microsoft.com/fwlink/?linkid=2081148) | Mobile solution - Protect your mobile devices with granular visibility and control from Corrata +![Image of Lookout logo](images/lookout-logo.png)| [Lookout](https://go.microsoft.com/fwlink/?linkid=866935)| Get Lookout Mobile Threat Protection telemetry for Android and iOS mobile devices +![Image of Symantec Endpoint Protection Mobile logo](images/symantec-logo.png) | [Symantec Endpoint Protection Mobile](https://go.microsoft.com/fwlink/?linkid=2090992)| SEP Mobile helps businesses predict, detect and prevent security threats and vulnerabilities on mobile devices +![Image of Zimperium logo](images/zimperium-logo.png)| [Zimperium](https://go.microsoft.com/fwlink/?linkid=2118044)|Extend your Microsoft Defender ATP to iOS and Android with Machine Learning-based Mobile Threat Defense + + +## Additional integrations +Logo |Partner name | Description +:---|:---|:--- +![Image of Cyren Web Filter logo](images/cyren-logo.png)| [Cyren Web Filter](https://go.microsoft.com/fwlink/?linkid=2108221)| Enhance your Microsoft Defender ATP with advanced Web Filtering +![Image of Morphisec logo](images/morphisec-logo.png)| [Morphisec](https://go.microsoft.com/fwlink/?linkid=2086215)| Provides Moving Target Defense-powered advanced threat prevention and integrates forensics data directly into WD Security Center dashboards to help prioritize alerts, determine device at-risk score and visualize full attack timeline including internal memory information +![Image of THOR Cloud logo](images/nextron-thor-logo.png)| [THOR Cloud](https://go.microsoft.com/fwlink/?linkid=862988)| Provides on-demand live forensics scans using a signature base with focus on persistent threats + + + ## SIEM integration Microsoft Defender ATP supports SIEM integration through a variety of methods - specialized SIEM system interface with out of the box connectors, a generic alert API enabling custom implementations, and an action API enabling alert status management. For more information, see [Enable SIEM integration](enable-siem-integration.md). From 269eb52fe6447b34c5eeaf9637b2e7c0560b8a57 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 15 Sep 2020 10:50:48 -0700 Subject: [PATCH 19/57] add mobile devices --- .../microsoft-defender-atp/partner-applications.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index 0cced2f956..a7afe9429d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -128,4 +128,4 @@ Microsoft Defender ATP allows you to integrate with such solutions and act on Io Microsoft Defender ATP currently supports IOC matching and remediation for file and network indicators. Blocking is supported for file indicators. ## Support for non-Windows platforms -Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the portal and better protect your organization's network. +Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms, including mobile devices. You'll be able to see alerts from various supported operating systems (OS) in the portal and better protect your organization's network. From 9212521ecaa7f7eb147f1c2054d5fdbc7028c58b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 15 Sep 2020 11:20:41 -0700 Subject: [PATCH 20/57] branding --- .../microsoft-defender-atp/partner-applications.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index a7afe9429d..dbf3e9b53b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -38,9 +38,9 @@ Microsoft Defender ATP seamlessly integrates with existing security solutions - Logo |Partner name | Description :---|:---|:--- -![Image of AttackIQ logo](images/attackiq-logo.png)| [AttackIQ Platform](https://go.microsoft.com/fwlink/?linkid=2103502) | AttackIQ Platform validates MDATP is configured properly by launching continuous attacks safely on production assets +![Image of AttackIQ logo](images/attackiq-logo.png)| [AttackIQ Platform](https://go.microsoft.com/fwlink/?linkid=2103502) | AttackIQ Platform validates Microsoft Defender ATP is configured properly by launching continuous attacks safely on production assets ![Image of Azure Sentinel logo](images/sentinel-logo.png)| [AzureSentinel](https://go.microsoft.com/fwlink/?linkid=2135705) | Stream alerts from Microsoft Defender Advanced Threat Protection into Azure Sentinel -![Image of Cymulate logo](images/cymulate-logo.png) | [Cymulate](https://go.microsoft.com/fwlink/?linkid=2135574)| Correlate Defender ATP findings with simulated attacks to validate accurate detection and effective response actions +![Image of Cymulate logo](images/cymulate-logo.png) | [Cymulate](https://go.microsoft.com/fwlink/?linkid=2135574)| Correlate Microsoft Defender ATP findings with simulated attacks to validate accurate detection and effective response actions ![Image of Elastic security logo](images/elastic-security-logo.png) | [Elastic Security](https://go.microsoft.com/fwlink/?linkid=2139303) | Elastic Security is a free and open solution for preventing, detecting, and responding to threats ![Image of IBM QRadar logo](images/ibm-qradar-logo.png) | [IBM QRadar](https://go.microsoft.com/fwlink/?linkid=2113903) | Configure IBM QRadar to collect detections from Microsoft Defender ATP ![Image of Micro Focus ArcSight logo](images/arcsight-logo.png) | [Micro Focus ArcSight](https://go.microsoft.com/fwlink/?linkid=2113548) | Use Micro Focus ArcSight to pull Microsoft Defender ATP detections @@ -48,7 +48,7 @@ Logo |Partner name | Description ![Image of SafeBreach logo](images/safebreach-logo.png) | [SafeBreach](https://go.microsoft.com/fwlink/?linkid=2114114)| Gain visibility into Microsoft Defender ATP security events that are automatically correlated with SafeBreach simulations ![Image of Skybox Vulnerability Control logo](images/skybox-logo.png) | [Skybox Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2127467) | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network and threat context to uncover your riskiest vulnerabilities ![Image of Splunk logo](images/splunk-logo.png) | [Splunk](https://go.microsoft.com/fwlink/?linkid=2129805) | The Microsoft Defender ATP Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk -![Image of XM Cyber logo](images/xmcyber-logo.png) | [XM Cyber](https://go.microsoft.com/fwlink/?linkid=2136700) | Prioritize your response to an alert based on risk factors and high value assets. +![Image of XM Cyber logo](images/xmcyber-logo.png) | [XM Cyber](https://go.microsoft.com/fwlink/?linkid=2136700) | Prioritize your response to an alert based on risk factors and high value assets ### Orchestration and automation From cf489095e060eb3808badc97ddb803072e2e2c51 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 12:06:40 -0700 Subject: [PATCH 21/57] Update automated-investigations.md --- .../microsoft-defender-atp/automated-investigations.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md index 807094bae7..23a09e73f8 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md @@ -75,15 +75,15 @@ You can configure the following levels of automation: |Automation level | Description| |---|---| -|**Full - remediate threats automatically** | All remediation actions are performed automatically.

***This option is recommended** and is selected by default for Microsoft Defender ATP tenants created on or after August 16, 2020, and have no device groups defined.
If you do have a device group defined, you will also have a device group called **Ungrouped devices (default)**, which will be set to **Full - remediate threats automatically**.*| +|**Full - remediate threats automatically** | All remediation actions are performed automatically.

***This option is recommended** and is selected by default for Microsoft Defender ATP tenants that were created on or after August 16, 2020, and that have no device groups defined.
If you do have a device group defined, you will also have a device group called **Ungrouped devices (default)**, which will be set to **Full - remediate threats automatically**.*| |**Semi - require approval for core folders remediation** | An approval is required on files or executables that are in the operating system directories such as Windows folder and Program files folder.

Files or executables in all other folders are automatically remediated, if needed.| |**Semi - require approval for non-temp folders remediation** | An approval is required on files or executables that are not in temporary folders.

Files or executables in temporary folders, such as the user's download folder or the user's temp folder, are automatically be remediated (if needed).| -|**Semi - require approval for any remediation** | An approval is needed for any remediation action.

*This option is selected by default for Microsoft Defender ATP tenants created before August 16, 2020, and have no device groups defined.
If you do have a device group defined, you will also have a device group called **Ungrouped devices (default)**, which will be set to **Semi - require approval for any remediation**.*| +|**Semi - require approval for any remediation** | An approval is needed for any remediation action.

*This option is selected by default for Microsoft Defender ATP tenants that were created before August 16, 2020, and that have no device groups defined.
If you do have a device group defined, you will also have a device group called **Ungrouped devices (default)**, which will be set to **Semi - require approval for any remediation**.*| |**No automated response** | Devices do not get any automated investigations run on them.

***This option is not recommended**, because it fully disables automated investigation and remediation capabilities, and reduces the security posture of your organization's devices.* | > [!IMPORTANT] -> A few points of clarification regarding automation levels and default settings: +> Regarding automation levels and default settings: > - If your tenant already has device groups defined, the automation level settings are not changed for those device groups. > - If your tenant was onboarded to Microsoft Defender ATP *before* August 16, 2020, and you have not defined a device group, your organization's default setting is **Semi - require approval for any remediation**. > - If your tenant was onboarded to Microsoft Defender ATP *before* August 16, 2020, and you do have a device group defined, you also have an **Ungrouped devices (default)** device group that is set to **Semi - require approval for any remediation**. From 008840d52d4b72e1ba018671bcb7a732aa8db600 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 12:09:36 -0700 Subject: [PATCH 22/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 913a4d215c..9fc6c51bfa 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -15,13 +15,16 @@ manager: dansimp audience: ITPro ms.collection: M365-security-compliance ms.topic: conceptual +ms.date: 09/15/2020 --- # Review and approve actions following an automated investigation ## Remediation actions -When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat and resulting verdict, remediation actions occur automatically or upon approval by your organization’s security operations team. For example, some actions, such as removing malware, are taken automatically. Other actions require review and approval to proceed. +When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat, the resulting verdict, and how your organization's device groups are configured, remediation actions occur automatically or upon approval by your organization’s security operations team. + +For example, some actions, such as removing malware, are taken automatically. Other actions require review and approval to proceed. When a verdict of *Malicious* is reached for a piece of evidence, Microsoft Defender Advanced Threat Protection takes one of the following remediation actions automatically: - Quarantine a file From bf4c470e1062e42c924cd7fb2591298897793e42 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 12:46:29 -0700 Subject: [PATCH 23/57] Update manage-auto-investigation.md --- .../manage-auto-investigation.md | 30 +++++++++++-------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 9fc6c51bfa..c18c7cb3ae 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -22,11 +22,13 @@ ms.date: 09/15/2020 ## Remediation actions -When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat, the resulting verdict, and how your organization's device groups are configured, remediation actions occur automatically or upon approval by your organization’s security operations team. +When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. -For example, some actions, such as removing malware, are taken automatically. Other actions require review and approval to proceed. +For example, suppose that your organization's devices are included in a device group that is set for **Semi - require approval for any remediation**. In this case, your security operations team must review and approve all remediation actions. -When a verdict of *Malicious* is reached for a piece of evidence, Microsoft Defender Advanced Threat Protection takes one of the following remediation actions automatically: +Now suppose that you've changed your organization's device groups so that they are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious. + +When an automated investigation determines an artifact is malicious, the following remediation actions are taken or recommended: - Quarantine a file - Remove a registry key - Kill a process @@ -35,7 +37,7 @@ When a verdict of *Malicious* is reached for a piece of evidence, Microsoft Defe - Disable a driver - Remove a scheduled task -Evidence determined as *Suspicious* results in pending actions that require approval. As a best practice, make sure to [approve (or reject) pending actions](#review-pending-actions) as soon as possible so that you automated investigations complete in a timely manner. +Artifacts that are determined to be *Suspicious* result in pending actions that require approval. As a best practice, make sure to [approve (or reject) pending actions](#review-pending-actions) as soon as possible so that you automated investigations complete in a timely manner. No actions are taken when a verdict of *No threats found* is reached for a piece of evidence. @@ -43,22 +45,22 @@ In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and ## Review pending actions -1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. You'll see the Security dashboard. +1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. You'll see the [Security operations dashboard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard). -2. On the Security dashboard, in the navigation pane on the left, choose **Automated investigations** > **Action center**. +2. On the Security operations dashboard, in the navigation pane on the left, choose **Automated investigations** > **Action center**. 3. Review any items on the **Pending** tab. - Select an investigation from any of the categories to open a panel where you can approve or reject remediation actions. Other details such as file or service details, investigation details, and alert details are displayed. From the panel, you can click on the **Open investigation page** link to see the investigation details. - - You can also select multiple investigations to approve or reject actions on multiple investigations. - + - Select an investigation from any of the categories to open a panel where you can approve or reject remediation actions. + - Other details such as file or service details, investigation details, and alert details are displayed. + - From the panel, you can click on the **Open investigation page** link to see the investigation details. + - You can also select multiple investigations to approve or reject actions on multiple investigations. ## Review completed actions -1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. You'll see the Security dashboard. +1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. You'll see the [Security operations dashboard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard). -2. On the Security dashboard, in the navigation pane on the left, choose **Automated investigations** > **Action center**. +2. On the Security operations dashboard, in the navigation pane on the left, choose **Automated investigations** > **Action center**. 3. Select the **History** tab. (If need be, expand the time period to display more data.) @@ -74,6 +76,8 @@ In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and ## Related articles +- [How threats are remediated in automated investigation & remediation (Microsoft Defender Advanced Threat Protection)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations#how-threats-are-remediated) + - [Automated investigation and response in Office 365 Advanced Threat Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-air) -- [Automated investigation and response in Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-autoir) \ No newline at end of file +- [Self-healing in Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-autoir) \ No newline at end of file From 54f227e7bac9d89ab1a4ef65b2f636043c830f3a Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 15 Sep 2020 13:06:02 -0700 Subject: [PATCH 24/57] add limit --- .../microsoft-defender-atp/run-advanced-query-api.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md index 2625952949..a33a2c88fd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md @@ -28,6 +28,7 @@ ms.topic: article 2. The results will include a maximum of 100,000 rows. 3. The number of executions is limited per tenant: up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day. 4. The maximal execution time of a single request is 10 minutes. +5. 429 response will represent reaching quota limit either by number of requests or by CPU. The 429 response body will also indicate the time until the quota is renewed. ## Permissions One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md) From 656e1c23d93229e30f3645f5e2d6f897935f271c Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Tue, 15 Sep 2020 13:09:41 -0700 Subject: [PATCH 25/57] 10 min --- .../microsoft-defender-atp/run-advanced-query-api.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md index a33a2c88fd..f0f6228bbe 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md +++ b/windows/security/threat-protection/microsoft-defender-atp/run-advanced-query-api.md @@ -26,7 +26,7 @@ ms.topic: article ## Limitations 1. You can only run a query on data from the last 30 days. 2. The results will include a maximum of 100,000 rows. -3. The number of executions is limited per tenant: up to 15 calls per minute, 15 minutes of running time every hour and 4 hours of running time a day. +3. The number of executions is limited per tenant: up to 10 calls per minute, 10 minutes of running time every hour and 4 hours of running time a day. 4. The maximal execution time of a single request is 10 minutes. 5. 429 response will represent reaching quota limit either by number of requests or by CPU. The 429 response body will also indicate the time until the quota is renewed. From 4e6dc0647bf81760e1d845aba855ae2e5ab2cb24 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 13:30:39 -0700 Subject: [PATCH 26/57] Update manage-auto-investigation.md --- .../manage-auto-investigation.md | 30 +++++++++++-------- 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index c18c7cb3ae..ee6dc39e0d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -24,25 +24,31 @@ ms.date: 09/15/2020 When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. -For example, suppose that your organization's devices are included in a device group that is set for **Semi - require approval for any remediation**. In this case, your security operations team must review and approve all remediation actions. +For example, suppose that your organization's devices are included in a device group that is set for **Semi - require approval for any remediation**. In this case, your security operations team must review and approve all remediation actions. (See [Review pending actions](#review-pending-actions).) -Now suppose that you've changed your organization's device groups so that they are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious. +Now suppose that you've changed your organization's device groups so that they are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious. (See [Review completed actions](#review-completed-actions).) -When an automated investigation determines an artifact is malicious, the following remediation actions are taken or recommended: -- Quarantine a file -- Remove a registry key -- Kill a process -- Stop a service -- Remove a registry key -- Disable a driver -- Remove a scheduled task +### Automated investigation results and remediation actions -Artifacts that are determined to be *Suspicious* result in pending actions that require approval. As a best practice, make sure to [approve (or reject) pending actions](#review-pending-actions) as soon as possible so that you automated investigations complete in a timely manner. +The following table summarizes remediation actions following an automated investigation with several examples. -No actions are taken when a verdict of *No threats found* is reached for a piece of evidence. +|Device group setting | Automated investigation results | What to do | +|:---|:---|:---| +|**Full - remediate threats automatically** (this is the recommended setting) |A verdict of *Malicious* is reached for a piece of evidence.

Depending on the artifact, one of the following remediation actions are taken automatically:
- Quarantine a file
- Remove a registry key
- Kill a process
- Stop a service
- Remove a registry key
- Disable a driver
- Remove a scheduled task |[Review completed actions](#review-completed-actions). | +|**Full - remediate threats automatically** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. | [Approve (or reject) pending actions](#review-pending-actions). | +|**Semi - require approval for any remediation** |A verdict of either *Malicious* or *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. |[Approve (or reject) pending actions](#review-pending-actions). | +|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is not in an operating system directory, remediation actions are taken automatically. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions).| +|**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| +|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable and is in a temporary folder, remediation actions are taken automatically. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | +|**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | +|Any of the following:
- **Full - remediate threats automatically**
- **Semi - require approval for any remediation**
- **Semi - require approval for core folders remediation**
- **Semi - require approval for non-temp folders remediation** |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions). +> [!TIP] +> To learn more about remediation actions following an automated investigation, see [How threats are remediated](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations#how-threats-are-remediated). + + ## Review pending actions 1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. You'll see the [Security operations dashboard](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/security-operations-dashboard). From c5162f723441a7d4a70efebd0f25f24e7d0b8654 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 13:32:18 -0700 Subject: [PATCH 27/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 7 ------- 1 file changed, 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index ee6dc39e0d..487483bc1b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -80,10 +80,3 @@ In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and - [Get an overview of live response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/live-response) -## Related articles - -- [How threats are remediated in automated investigation & remediation (Microsoft Defender Advanced Threat Protection)](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations#how-threats-are-remediated) - -- [Automated investigation and response in Office 365 Advanced Threat Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-air) - -- [Self-healing in Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-autoir) \ No newline at end of file From 2400ac320cc19fa81fd54e511f469603a5a4bff0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 13:35:37 -0700 Subject: [PATCH 28/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 487483bc1b..2cf7d4c157 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -41,7 +41,7 @@ The following table summarizes remediation actions following an automated invest |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| |**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable and is in a temporary folder, remediation actions are taken automatically. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | -|Any of the following:
- **Full - remediate threats automatically**
- **Semi - require approval for any remediation**
- **Semi - require approval for core folders remediation**
- **Semi - require approval for non-temp folders remediation** |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | +|Full or semi automation |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions). From bbc4577e68064278462151d173d2c5cec9bb50e6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 13:39:26 -0700 Subject: [PATCH 29/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 2cf7d4c157..9c1f7a4a15 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -22,15 +22,15 @@ ms.date: 09/15/2020 ## Remediation actions -When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. +When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. Here are two examples: -For example, suppose that your organization's devices are included in a device group that is set for **Semi - require approval for any remediation**. In this case, your security operations team must review and approve all remediation actions. (See [Review pending actions](#review-pending-actions).) +- Example 1: Contoso's devices are included in a device group that is set for **Semi - require approval for any remediation**. In this case, Contoso's security operations team must review and approve all remediation actions. (See [Review pending actions](#review-pending-actions).) -Now suppose that you've changed your organization's device groups so that they are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious. (See [Review completed actions](#review-completed-actions).) +- Example 2: Fabrikam's device groups are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious. (See [Review completed actions](#review-completed-actions).) ### Automated investigation results and remediation actions -The following table summarizes remediation actions following an automated investigation with several examples. +The following table summarizes remediation actions following an automated investigation, and how device group settings affect whether actions are taken automatically or upon approval. |Device group setting | Automated investigation results | What to do | |:---|:---|:---| From 32e68562c541701899b2ebd314e6a9a5e9d026ac Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 13:49:57 -0700 Subject: [PATCH 30/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 9c1f7a4a15..dd00d1c8bd 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -41,7 +41,7 @@ The following table summarizes remediation actions following an automated invest |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| |**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable and is in a temporary folder, remediation actions are taken automatically. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | -|Full or semi automation |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | +|Any of the Full or Semi automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions). From 4e9c1ff56237743fc5e4b571f1cd1d37e922db6f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 13:51:42 -0700 Subject: [PATCH 31/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index dd00d1c8bd..ca76752f2b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -37,7 +37,7 @@ The following table summarizes remediation actions following an automated invest |**Full - remediate threats automatically** (this is the recommended setting) |A verdict of *Malicious* is reached for a piece of evidence.

Depending on the artifact, one of the following remediation actions are taken automatically:
- Quarantine a file
- Remove a registry key
- Kill a process
- Stop a service
- Remove a registry key
- Disable a driver
- Remove a scheduled task |[Review completed actions](#review-completed-actions). | |**Full - remediate threats automatically** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. | [Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for any remediation** |A verdict of either *Malicious* or *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. |[Approve (or reject) pending actions](#review-pending-actions). | -|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is not in an operating system directory, remediation actions are taken automatically. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions).| +|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is not in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| |**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable and is in a temporary folder, remediation actions are taken automatically. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | From fc24c73b42a041c80148886e6ffed1c2e6ce62ef Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 13:55:42 -0700 Subject: [PATCH 32/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index ca76752f2b..4c638eb8a0 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -37,7 +37,7 @@ The following table summarizes remediation actions following an automated invest |**Full - remediate threats automatically** (this is the recommended setting) |A verdict of *Malicious* is reached for a piece of evidence.

Depending on the artifact, one of the following remediation actions are taken automatically:
- Quarantine a file
- Remove a registry key
- Kill a process
- Stop a service
- Remove a registry key
- Disable a driver
- Remove a scheduled task |[Review completed actions](#review-completed-actions). | |**Full - remediate threats automatically** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. | [Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for any remediation** |A verdict of either *Malicious* or *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. |[Approve (or reject) pending actions](#review-pending-actions). | -|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is not in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | +|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is **not** in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| |**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable and is in a temporary folder, remediation actions are taken automatically. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | From e9a3f4d701277de3c1b249fc8311c8556e9b6899 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 13:56:39 -0700 Subject: [PATCH 33/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 4c638eb8a0..ade960182c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -39,7 +39,7 @@ The following table summarizes remediation actions following an automated invest |**Semi - require approval for any remediation** |A verdict of either *Malicious* or *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. |[Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is **not** in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| -|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable and is in a temporary folder, remediation actions are taken automatically. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | +|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable and is in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | |**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | |Any of the Full or Semi automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | From 932eddb092500716984bea894205bf95d10ab24c Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 13:57:17 -0700 Subject: [PATCH 34/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index ade960182c..85f5deb547 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -40,7 +40,7 @@ The following table summarizes remediation actions following an automated invest |**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is **not** in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| |**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable and is in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | -|**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center).

[Approve (or reject) pending actions](#review-pending-actions). | +|**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | |Any of the Full or Semi automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions). From e083cf68d8004659195e813523ca5d3f195b37d0 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 13:58:20 -0700 Subject: [PATCH 35/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 85f5deb547..30b904712a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -39,9 +39,9 @@ The following table summarizes remediation actions following an automated invest |**Semi - require approval for any remediation** |A verdict of either *Malicious* or *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. |[Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is **not** in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| -|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable and is in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | +|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable and **is** in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | |**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | -|Any of the Full or Semi automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | +|Any of the **Full** or **Semi** automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions). From 558839c67d4e40c9fd5717262841f7388ed2a9eb Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:00:51 -0700 Subject: [PATCH 36/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 30b904712a..c9b7b643f7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -37,9 +37,9 @@ The following table summarizes remediation actions following an automated invest |**Full - remediate threats automatically** (this is the recommended setting) |A verdict of *Malicious* is reached for a piece of evidence.

Depending on the artifact, one of the following remediation actions are taken automatically:
- Quarantine a file
- Remove a registry key
- Kill a process
- Stop a service
- Remove a registry key
- Disable a driver
- Remove a scheduled task |[Review completed actions](#review-completed-actions). | |**Full - remediate threats automatically** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. | [Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for any remediation** |A verdict of either *Malicious* or *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. |[Approve (or reject) pending actions](#review-pending-actions). | -|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is **not** in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | +|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable and is in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is **not** in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| -|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable and **is** in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | +|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable that **is** in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | |**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | |Any of the **Full** or **Semi** automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | From 874f9948b6f28a02aad092b13fb3eb684ff9d999 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:01:56 -0700 Subject: [PATCH 37/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index c9b7b643f7..1346b2eed7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -57,10 +57,9 @@ In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and 3. Review any items on the **Pending** tab. - - Select an investigation from any of the categories to open a panel where you can approve or reject remediation actions. - - Other details such as file or service details, investigation details, and alert details are displayed. - - From the panel, you can click on the **Open investigation page** link to see the investigation details. - - You can also select multiple investigations to approve or reject actions on multiple investigations. +4. Select an investigation from any of the categories to open a panel where you can approve or reject remediation actions. + + Other details such as file or service details, investigation details, and alert details are displayed. From the panel, you can click on the **Open investigation page** link to see the investigation details. You can also select multiple investigations to approve or reject actions on multiple investigations. ## Review completed actions From f3e39080044f891a7531e2f906a808c14a2996ee Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:04:18 -0700 Subject: [PATCH 38/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 1346b2eed7..9954bce34d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -37,10 +37,10 @@ The following table summarizes remediation actions following an automated invest |**Full - remediate threats automatically** (this is the recommended setting) |A verdict of *Malicious* is reached for a piece of evidence.

Depending on the artifact, one of the following remediation actions are taken automatically:
- Quarantine a file
- Remove a registry key
- Kill a process
- Stop a service
- Remove a registry key
- Disable a driver
- Remove a scheduled task |[Review completed actions](#review-completed-actions). | |**Full - remediate threats automatically** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. | [Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for any remediation** |A verdict of either *Malicious* or *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. |[Approve (or reject) pending actions](#review-pending-actions). | -|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable and is in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is **not** in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | +|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable and is in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is **not** in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| -|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable that **is** in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | -|**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | +|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable that **is** in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | +|**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | |Any of the **Full** or **Semi** automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions). From adffeaaf1f32a9513a6795bd5c04e88a07da02fe Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:06:27 -0700 Subject: [PATCH 39/57] Update manage-auto-investigation.md --- .../manage-auto-investigation.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 9954bce34d..5304516d5f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -28,13 +28,22 @@ When an automated investigation runs, a verdict is generated for each piece of e - Example 2: Fabrikam's device groups are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious. (See [Review completed actions](#review-completed-actions).) +Whether taken automatically or upon approval, remediation actions include the following: +- Quarantine a file +- Remove a registry key +- Kill a process +- Stop a service +- Remove a registry key +- Disable a driver +- Remove a scheduled task + ### Automated investigation results and remediation actions The following table summarizes remediation actions following an automated investigation, and how device group settings affect whether actions are taken automatically or upon approval. |Device group setting | Automated investigation results | What to do | |:---|:---|:---| -|**Full - remediate threats automatically** (this is the recommended setting) |A verdict of *Malicious* is reached for a piece of evidence.

Depending on the artifact, one of the following remediation actions are taken automatically:
- Quarantine a file
- Remove a registry key
- Kill a process
- Stop a service
- Remove a registry key
- Disable a driver
- Remove a scheduled task |[Review completed actions](#review-completed-actions). | +|**Full - remediate threats automatically** (this is the recommended setting) |A verdict of *Malicious* is reached for a piece of evidence.

Appropriate remediation actions are taken automatically. |[Review completed actions](#review-completed-actions). | |**Full - remediate threats automatically** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. | [Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for any remediation** |A verdict of either *Malicious* or *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. |[Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable and is in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is **not** in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | From b93b78e88f273d9654f478b9db7009ecf9558031 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Tue, 15 Sep 2020 14:08:51 -0700 Subject: [PATCH 40/57] Replaced some hyphens with em dashes --- .../microsoft-defender-atp/partner-applications.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md index dbf3e9b53b..374a74cd95 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md +++ b/windows/security/threat-protection/microsoft-defender-atp/partner-applications.md @@ -29,7 +29,7 @@ Microsoft Defender ATP supports third-party applications to help enhance the det The support for third-party solutions help to further streamline, integrate, and orchestrate defenses from other vendors with Microsoft Defender ATP; enabling security teams to effectively respond better to modern threats. -Microsoft Defender ATP seamlessly integrates with existing security solutions - providing out of the box integration with SIEM, ticketing and IT service management solutions, managed security service providers (MSSP), IoC indicators ingestions and matching, automated device investigation and remediation based on external alerts, and integration with Security orchestration and automation response (SOAR) systems. +Microsoft Defender ATP seamlessly integrates with existing security solutions — providing out of the box integration with SIEM, ticketing and IT service management solutions, managed security service providers (MSSP), IoC indicators ingestions and matching, automated device investigation and remediation based on external alerts, and integration with Security orchestration and automation response (SOAR) systems. ## Supported applications @@ -88,7 +88,7 @@ Logo |Partner name | Description :---|:---|:--- ![Image of Bitdefender logo](images/bitdefender-logo.png)| [Bitdefender](https://go.microsoft.com/fwlink/?linkid=860032)| Bitdefender GravityZone is a layered next generation endpoint protection platform offering comprehensive protection against the full spectrum of sophisticated cyber threats ![Image of Better Mobile logo](images/bettermobile-logo.png) | [Better Mobile](https://go.microsoft.com/fwlink/?linkid=2086214)| AI based MTD solution to stop mobile threats & phishing. Private internet browsing to protect user privacy -![Image of Corrata logo](images/corrata-logo.png)| [Corrata](https://go.microsoft.com/fwlink/?linkid=2081148) | Mobile solution - Protect your mobile devices with granular visibility and control from Corrata +![Image of Corrata logo](images/corrata-logo.png)| [Corrata](https://go.microsoft.com/fwlink/?linkid=2081148) | Mobile solution — Protect your mobile devices with granular visibility and control from Corrata ![Image of Lookout logo](images/lookout-logo.png)| [Lookout](https://go.microsoft.com/fwlink/?linkid=866935)| Get Lookout Mobile Threat Protection telemetry for Android and iOS mobile devices ![Image of Symantec Endpoint Protection Mobile logo](images/symantec-logo.png) | [Symantec Endpoint Protection Mobile](https://go.microsoft.com/fwlink/?linkid=2090992)| SEP Mobile helps businesses predict, detect and prevent security threats and vulnerabilities on mobile devices ![Image of Zimperium logo](images/zimperium-logo.png)| [Zimperium](https://go.microsoft.com/fwlink/?linkid=2118044)|Extend your Microsoft Defender ATP to iOS and Android with Machine Learning-based Mobile Threat Defense @@ -105,7 +105,7 @@ Logo |Partner name | Description ## SIEM integration -Microsoft Defender ATP supports SIEM integration through a variety of methods - specialized SIEM system interface with out of the box connectors, a generic alert API enabling custom implementations, and an action API enabling alert status management. For more information, see [Enable SIEM integration](enable-siem-integration.md). +Microsoft Defender ATP supports SIEM integration through a variety of methods — specialized SIEM system interface with out of the box connectors, a generic alert API enabling custom implementations, and an action API enabling alert status management. For more information, see [Enable SIEM integration](enable-siem-integration.md). ## Ticketing and IT service management Ticketing solution integration helps to implement manual and automatic response processes. Microsoft Defender ATP can help to create tickets automatically when an alert is generated and resolve the alerts when tickets are closed using the alerts API. @@ -118,7 +118,7 @@ Microsoft Defender ATP offers unique automated investigation and remediation cap Integrating the automated investigation and response capability with other solutions such as IDS and firewalls help to address alerts and minimize the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices. -External alerts can be pushed into Microsoft Defender ATP and is presented side-by-side with additional device-based alerts from Microsoft Defender ATP. This view provides a full context of the alert - with the real process and the full story of attack. +External alerts can be pushed into Microsoft Defender ATP and is presented side-by-side with additional device-based alerts from Microsoft Defender ATP. This view provides a full context of the alert — with the real process and the full story of attack. ## Indicators matching You can use threat-intelligence from providers and aggregators to maintain and use indicators of compromise (IOCs). From 4da3f1440c4a423058c7567cf616a7605d6204e4 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:13:51 -0700 Subject: [PATCH 41/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 5304516d5f..a6d412497f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -22,11 +22,13 @@ ms.date: 09/15/2020 ## Remediation actions -When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. Here are two examples: +When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. Here are a few examples: -- Example 1: Contoso's devices are included in a device group that is set for **Semi - require approval for any remediation**. In this case, Contoso's security operations team must review and approve all remediation actions. (See [Review pending actions](#review-pending-actions).) +- Example 1: Fabrikam's device groups are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious. (See [Review completed actions](#review-completed-actions).) -- Example 2: Fabrikam's device groups are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious. (See [Review completed actions](#review-completed-actions).) +- Example 2: Contoso's devices are included in a device group that is set for **Semi - require approval for any remediation**. In this case, Contoso's security operations team must review and approve all remediation actions. (See [Review pending actions](#review-pending-actions).) + +- Example 3: Tailspin Toys has their device groups set to **No automated response** (this is not recommended). In this case, automated investigations do not occur. As a result, no remediation actions are taken or pending, and no actions are logged in the [Action center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center#the-action-center) for their devices. Whether taken automatically or upon approval, remediation actions include the following: - Quarantine a file From 9f2753e4b6aecee95be389980854f74d4173f6dd Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:16:04 -0700 Subject: [PATCH 42/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index a6d412497f..e0b0e8a7e3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -51,7 +51,7 @@ The following table summarizes remediation actions following an automated invest |**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable and is in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is **not** in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| |**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable that **is** in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | -|**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | +|**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions). | |Any of the **Full** or **Semi** automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions). From 86ac068c96411bcd3ad8935df3529efbfc73abc6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:17:28 -0700 Subject: [PATCH 43/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index e0b0e8a7e3..3b1d959206 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -48,9 +48,9 @@ The following table summarizes remediation actions following an automated invest |**Full - remediate threats automatically** (this is the recommended setting) |A verdict of *Malicious* is reached for a piece of evidence.

Appropriate remediation actions are taken automatically. |[Review completed actions](#review-completed-actions). | |**Full - remediate threats automatically** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. | [Approve (or reject) pending actions](#review-pending-actions). | |**Semi - require approval for any remediation** |A verdict of either *Malicious* or *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. |[Approve (or reject) pending actions](#review-pending-actions). | -|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable and is in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is **not** in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | +|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable and is in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is *not* in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| -|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable that **is** in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | +|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable that *is* in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | |**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions). | |Any of the **Full** or **Semi** automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | From 3ac3ca726b0d4d6e2fd154e8218c3ab09ab44f95 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:19:50 -0700 Subject: [PATCH 44/57] fixes --- .../microsoft-defender-atp/automated-investigations.md | 2 +- .../microsoft-defender-atp/manage-auto-investigation.md | 2 -- 2 files changed, 1 insertion(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md index 23a09e73f8..d1f5cbfd59 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md @@ -106,7 +106,7 @@ You can configure the following levels of automation: - [See the interactive guide: Investigate and remediate threats with Microsoft Defender ATP](https://aka.ms/MDATP-IR-Interactive-Guide) -## Related articles +## See also - [Automated investigation and response in Office 365 Advanced Threat Protection](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-air) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 3b1d959206..6147a7bacc 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -88,5 +88,3 @@ In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and - [View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center) -- [Get an overview of live response](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/live-response) - From 7fde4edef7f73701aa2826764359323583031b23 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:20:55 -0700 Subject: [PATCH 45/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 6147a7bacc..24e354ee68 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -22,7 +22,9 @@ ms.date: 09/15/2020 ## Remediation actions -When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. Here are a few examples: +When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. + +### Examples showing how device groups affect remediation actions - Example 1: Fabrikam's device groups are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious. (See [Review completed actions](#review-completed-actions).) From 052d817f030c3a8e6d9ade4ff420988b5981c398 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:22:09 -0700 Subject: [PATCH 46/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 24e354ee68..6153ebe0fb 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -22,7 +22,11 @@ ms.date: 09/15/2020 ## Remediation actions -When an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. +When an [automated investigation](automated-investigations.md) runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. + +Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. + +Read this article to learn more about remediation actions and what to do when an automated investigation has completed. ### Examples showing how device groups affect remediation actions From b1a31b6e86301adaf28dfd74506bda8b1bb18d0f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:23:15 -0700 Subject: [PATCH 47/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 6153ebe0fb..b7e6725f75 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -47,7 +47,7 @@ Whether taken automatically or upon approval, remediation actions include the fo ### Automated investigation results and remediation actions -The following table summarizes remediation actions following an automated investigation, and how device group settings affect whether actions are taken automatically or upon approval. +The following table summarizes remediation actions following an automated investigation, how device group settings affect whether actions are taken automatically or upon approval, and what to do in each case. |Device group setting | Automated investigation results | What to do | |:---|:---|:---| From 01a125d39195313c607ac5d24fe119d9eaf8e9d6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:26:06 -0700 Subject: [PATCH 48/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index b7e6725f75..bfb0da0089 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -34,7 +34,7 @@ Read this article to learn more about remediation actions and what to do when an - Example 2: Contoso's devices are included in a device group that is set for **Semi - require approval for any remediation**. In this case, Contoso's security operations team must review and approve all remediation actions. (See [Review pending actions](#review-pending-actions).) -- Example 3: Tailspin Toys has their device groups set to **No automated response** (this is not recommended). In this case, automated investigations do not occur. As a result, no remediation actions are taken or pending, and no actions are logged in the [Action center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center#the-action-center) for their devices. +- Example 3: Tailspin Toys has their device groups set to **No automated response** (this is not recommended). In this case, automated investigations do not occur. As a result, no remediation actions are taken or pending, and no actions are logged in the [Action center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center#the-action-center) for their devices. (See [Manage device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups#manage-device-groups)) Whether taken automatically or upon approval, remediation actions include the following: - Quarantine a file From e72abf32ff17b0ca89b6c05bcc7f9de7c4f1befa Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 14:27:35 -0700 Subject: [PATCH 49/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index bfb0da0089..93be6e31f7 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -24,11 +24,7 @@ ms.date: 09/15/2020 When an [automated investigation](automated-investigations.md) runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. -Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. - -Read this article to learn more about remediation actions and what to do when an automated investigation has completed. - -### Examples showing how device groups affect remediation actions +Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. Here are a few examples: - Example 1: Fabrikam's device groups are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious. (See [Review completed actions](#review-completed-actions).) From 75f7218e49b363f9848de99b770aeb51f5afbfe6 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 15:02:19 -0700 Subject: [PATCH 50/57] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 23 ++++++++++++++----- 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index 9d3017e042..bea43bc071 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -18,7 +18,7 @@ ms.collection: - m365solution-mcafeemigrate ms.topic: article ms.custom: migrationguides -ms.date: 09/03/2020 +ms.date: 09/15/2020 ms.reviewer: jesquive, chventou, jonix, chriggs, owtho --- @@ -31,11 +31,12 @@ ms.reviewer: jesquive, chventou, jonix, chriggs, owtho **Welcome to the Setup phase of [migrating from McAfee Endpoint Security (McAfee) to Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](mcafee-to-microsoft-defender-migration.md#the-migration-process)**. This phase includes the following steps: 1. [Enable Microsoft Defender Antivirus and confirm it's in passive mode](#enable-microsoft-defender-antivirus-and-confirm-its-in-passive-mode). -2. [Add Microsoft Defender ATP to the exclusion list for McAfee](#add-microsoft-defender-atp-to-the-exclusion-list-for-mcafee). -3. [Add McAfee to the exclusion list for Microsoft Defender Antivirus](#add-mcafee-to-the-exclusion-list-for-microsoft-defender-antivirus). -4. [Add McAfee to the exclusion list for Microsoft Defender ATP](#add-mcafee-to-the-exclusion-list-for-microsoft-defender-atp). -5. [Set up your device groups, device collections, and organizational units](#set-up-your-device-groups-device-collections-and-organizational-units). -6. [Configure antimalware policies and real-time protection](#configure-antimalware-policies-and-real-time-protection). +2. [Get updates for Microsoft Defender Antivirus](#get-updates-for-microsoft-defender-antivirus). +3. [Add Microsoft Defender ATP to the exclusion list for McAfee](#add-microsoft-defender-atp-to-the-exclusion-list-for-mcafee). +4. [Add McAfee to the exclusion list for Microsoft Defender Antivirus](#add-mcafee-to-the-exclusion-list-for-microsoft-defender-antivirus). +5. [Add McAfee to the exclusion list for Microsoft Defender ATP](#add-mcafee-to-the-exclusion-list-for-microsoft-defender-atp). +6. [Set up your device groups, device collections, and organizational units](#set-up-your-device-groups-device-collections-and-organizational-units). +7. [Configure antimalware policies and real-time protection](#configure-antimalware-policies-and-real-time-protection). ## Enable Microsoft Defender Antivirus and confirm it's in passive mode @@ -135,6 +136,16 @@ Microsoft Defender Antivirus can run alongside McAfee if you set Microsoft Defen > [!NOTE] > You might see *Windows Defender Antivirus* instead of *Microsoft Defender Antivirus* in some versions of Windows. +## Get updates for Microsoft Defender Antivirus + +Keeping Microsoft Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques, even if Microsoft Defender Antivirus is running in [passive mode](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility). + +There are two types of updates related to keeping Microsoft Defender Antivirus up to date: +- Security intelligence updates +- Product updates + +To get your updates, follow the guidance in [Manage Microsoft Defender Antivirus updates and apply baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus). + ## Add Microsoft Defender ATP to the exclusion list for McAfee This step of the setup process involves adding Microsoft Defender ATP to the exclusion list for McAfee and any other security products your organization is using. From a9f2d72cd6905cb2124707447695fbdda810204f Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 15 Sep 2020 15:07:43 -0700 Subject: [PATCH 51/57] Update mcafee-to-microsoft-defender-setup.md --- .../mcafee-to-microsoft-defender-setup.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md index bea43bc071..e49e6193d3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md +++ b/windows/security/threat-protection/microsoft-defender-atp/mcafee-to-microsoft-defender-setup.md @@ -138,7 +138,7 @@ Microsoft Defender Antivirus can run alongside McAfee if you set Microsoft Defen ## Get updates for Microsoft Defender Antivirus -Keeping Microsoft Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques, even if Microsoft Defender Antivirus is running in [passive mode](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility). +Keeping Microsoft Defender Antivirus up to date is critical to assure your devices have the latest technology and features needed to protect against new malware and attack techniques, even if Microsoft Defender Antivirus is running in [passive mode](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility). There are two types of updates related to keeping Microsoft Defender Antivirus up to date: - Security intelligence updates From 0038b9f7be7930a0864c42cf77fc2fac4e040220 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 16 Sep 2020 09:36:05 -0700 Subject: [PATCH 52/57] Update manage-auto-investigation.md --- .../manage-auto-investigation.md | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 93be6e31f7..9c0685559d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -1,5 +1,5 @@ --- -title: Review and approve actions following automated investigations in the Microsoft Defender Security Center +title: Review and approve remediation actions following automated investigations in the Microsoft Defender Security Center description: Review and approve (or reject) remediation actions following an automated investigation. keywords: autoir, automated, investigation, detection, dashboard, source, threat types, id, tags, devices, duration, filter export search.product: eADQiWindows 10XVcnh @@ -18,21 +18,25 @@ ms.topic: conceptual ms.date: 09/15/2020 --- -# Review and approve actions following an automated investigation +# Review and approve remediation actions following an automated investigation ## Remediation actions -When an [automated investigation](automated-investigations.md) runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. +When an [automated investigation](automated-investigations.md) runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on +- the type of threat, +- the resulting verdict, and +- how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, +remediation actions can occur automatically or only upon approval by your organization’s security operations team. -Depending on the type of threat, the resulting verdict, and how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, remediation actions can occur automatically or only upon approval by your organization’s security operations team. Here are a few examples: +Here are a few examples: -- Example 1: Fabrikam's device groups are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious. (See [Review completed actions](#review-completed-actions).) +- Example 1: Fabrikam's device groups are set to **Full - remediate threats automatically** (this is the recommended setting). In this case, remediation actions are taken automatically for artifacts that are considered to be malicious following an automated investigation. (See [Review completed actions](#review-completed-actions).) -- Example 2: Contoso's devices are included in a device group that is set for **Semi - require approval for any remediation**. In this case, Contoso's security operations team must review and approve all remediation actions. (See [Review pending actions](#review-pending-actions).) +- Example 2: Contoso's devices are included in a device group that is set for **Semi - require approval for any remediation**. In this case, Contoso's security operations team must review and approve all remediation actions following an automated investigation. (See [Review pending actions](#review-pending-actions).) - Example 3: Tailspin Toys has their device groups set to **No automated response** (this is not recommended). In this case, automated investigations do not occur. As a result, no remediation actions are taken or pending, and no actions are logged in the [Action center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center#the-action-center) for their devices. (See [Manage device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups#manage-device-groups)) -Whether taken automatically or upon approval, remediation actions include the following: +Whether taken automatically or upon approval, remediation actions following an automated investigation include the following: - Quarantine a file - Remove a registry key - Kill a process @@ -55,6 +59,7 @@ The following table summarizes remediation actions following an automated invest |**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable that *is* in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | |**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions). | |Any of the **Full** or **Semi** automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | +|**No automated response** (this is not recommended)|No automated investigations run, so no verdicts are reached, and no remediation actions are taken or awaiting approval. |[Consider setting up or changing your device groups to use **Full** or **Semi** automation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) | In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions). From f122567282487301f2c4a4a151981c348160f9f5 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 16 Sep 2020 09:36:43 -0700 Subject: [PATCH 53/57] Update manage-auto-investigation.md --- .../microsoft-defender-atp/manage-auto-investigation.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index 9c0685559d..e7b2094044 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -22,10 +22,14 @@ ms.date: 09/15/2020 ## Remediation actions -When an [automated investigation](automated-investigations.md) runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. Depending on +When an [automated investigation](automated-investigations.md) runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*. + +Depending on + - the type of threat, - the resulting verdict, and - how your organization's [device groups](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) are configured, + remediation actions can occur automatically or only upon approval by your organization’s security operations team. Here are a few examples: From fe87a002e0d8bf9b947c931e08202fb3571919ad Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Wed, 16 Sep 2020 09:38:07 -0700 Subject: [PATCH 54/57] Update manage-auto-investigation.md --- .../manage-auto-investigation.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md index e7b2094044..2b613f1c5c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation.md @@ -55,14 +55,14 @@ The following table summarizes remediation actions following an automated invest |Device group setting | Automated investigation results | What to do | |:---|:---|:---| -|**Full - remediate threats automatically** (this is the recommended setting) |A verdict of *Malicious* is reached for a piece of evidence.

Appropriate remediation actions are taken automatically. |[Review completed actions](#review-completed-actions). | -|**Full - remediate threats automatically** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. | [Approve (or reject) pending actions](#review-pending-actions). | -|**Semi - require approval for any remediation** |A verdict of either *Malicious* or *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. |[Approve (or reject) pending actions](#review-pending-actions). | -|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable and is in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is *not* in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | +|**Full - remediate threats automatically** (this is the recommended setting) |A verdict of *Malicious* is reached for a piece of evidence.

Appropriate remediation actions are taken automatically. |[Review completed actions](#review-completed-actions) | +|**Full - remediate threats automatically** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. | [Approve (or reject) pending actions](#review-pending-actions) | +|**Semi - require approval for any remediation** |A verdict of either *Malicious* or *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval to proceed. |[Approve (or reject) pending actions](#review-pending-actions) | +|**Semi - require approval for core folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable and is in an operating system directory, such as the Windows folder or the Program files folder, then remediation actions are pending approval.

If the artifact is *not* in an operating system directory, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions)

2. [Review completed actions](#review-completed-actions) | |**Semi - require approval for core folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions).| -|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable that *is* in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions).

2. [Review completed actions](#review-completed-actions). | -|**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions). | -|Any of the **Full** or **Semi** automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center). | +|**Semi - require approval for non-temp folders remediation** |A verdict of *Malicious* is reached for a piece of evidence.

If the artifact is a file or executable that is not in a temporary folder, such as the user's downloads folder or temp folder, remediation actions are pending approval.

If the artifact is a file or executable that *is* in a temporary folder, remediation actions are taken automatically. |1. [Approve (or reject) pending actions](#review-pending-actions)

2. [Review completed actions](#review-completed-actions) | +|**Semi - require approval for non-temp folders remediation** |A verdict of *Suspicious* is reached for a piece of evidence.

Remediation actions are pending approval. |[Approve (or reject) pending actions](#review-pending-actions) | +|Any of the **Full** or **Semi** automation levels |A verdict of *No threats found* is reached for a piece of evidence.

No remediation actions are taken, and no actions are pending approval. |[View details and results of automated investigations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center) | |**No automated response** (this is not recommended)|No automated investigations run, so no verdicts are reached, and no remediation actions are taken or awaiting approval. |[Consider setting up or changing your device groups to use **Full** or **Semi** automation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/machine-groups) | In Microsoft Defender Advanced Threat Protection, all verdicts are [tracked and viewable in the Microsoft Defender Security Center](#review-completed-actions). From e2f4801e853925e4a68e7bf6ffe635fff8af932b Mon Sep 17 00:00:00 2001 From: mapalko Date: Wed, 16 Sep 2020 11:29:49 -0700 Subject: [PATCH 55/57] Updated Key-Trust RDP in FAQ and TOC --- .../identity-protection/hello-for-business/hello-faq.md | 2 +- windows/security/identity-protection/hello-for-business/toc.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-faq.md b/windows/security/identity-protection/hello-for-business/hello-faq.md index 390355cb33..e6d36e6967 100644 --- a/windows/security/identity-protection/hello-for-business/hello-faq.md +++ b/windows/security/identity-protection/hello-for-business/hello-faq.md @@ -28,7 +28,7 @@ Windows Hello for Business is the modern, two-factor credential for Windows 10. Microsoft is committed to its vision of a world without passwords. We recognize the *convenience* provided by convenience PIN, but it stills uses a password for authentication. Microsoft recommends customers using Windows 10 and convenience PINs should move to Windows Hello for Business. New Windows 10 deployments should deploy Windows Hello for Business and not convenience PINs. Microsoft will be deprecating convenience PINs in the future and will publish the date early to ensure customers have adequate lead time to deploy Windows Hello for Business. ## Can I use Windows Hello for Business key trust and RDP? -RDP currently does not support key based authentication and does not support self signed certificates. RDP with Windows Hello for Business is currently only supported with certificate based deployments. +RDP currently does not support using key based authentication and self signed certificates as supplied credentials. RDP with supplied credentials Windows Hello for Business is currently only supported with certificate based deployments. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). ## Can I deploy Windows Hello for Business using Microsoft Endpoint Configuration Manager? Windows Hello for Business deployments using Configuration Manager should use the hybrid deployment model that uses Active Directory Federation Services. Starting in Configuration Manager version 1910, certificate-based authentication with Windows Hello for Business settings isn't supported. Key-based authentication is still valid with Configuration Manager. For more information, see [Windows Hello for Business settings in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/windows-hello-for-business-settings). diff --git a/windows/security/identity-protection/hello-for-business/toc.md b/windows/security/identity-protection/hello-for-business/toc.md index 3fe33458fc..8ec19c126f 100644 --- a/windows/security/identity-protection/hello-for-business/toc.md +++ b/windows/security/identity-protection/hello-for-business/toc.md @@ -16,10 +16,10 @@ ## [How Windows Hello for Business works](hello-how-it-works.md) ### [Technical Deep Dive](hello-how-it-works.md#technical-deep-dive) -#### [Technology and Terminology](hello-how-it-works-technology.md) #### [Device Registration](hello-how-it-works-device-registration.md) #### [Provisioning](hello-how-it-works-provisioning.md) #### [Authentication](hello-how-it-works-authentication.md) +#### [Technology and Terminology](hello-how-it-works-technology.md) ## [Planning a Windows Hello for Business Deployment](hello-planning-guide.md) From f083c2e6b9a46a806ce845b5f1b1c63fc2ad73d4 Mon Sep 17 00:00:00 2001 From: mapalko Date: Wed, 16 Sep 2020 12:13:06 -0700 Subject: [PATCH 56/57] Add Passwordless Wizard to Planning Documentation --- .../hello-for-business/hello-planning-guide.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 3fff407e34..9b11a04076 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: conceptual -ms.date: 08/19/2018 +ms.date: 09/16/2020 ms.reviewer: --- # Planning a Windows Hello for Business Deployment @@ -25,6 +25,8 @@ Congratulations! You are taking the first step forward in helping move your orga This guide explains the role of each component within Windows Hello for Business and how certain deployment decisions affect other aspects of the infrastructure. Armed with your planning worksheet, you'll use that information to select the correct deployment guide for your needs. +If you have an Azure tenant, you can use our online, interactive Passwordless Wizard which walks through the same choices instead of using our manual guide below. The Passwordless Wizard is available in the [Microsoft 365 admin center](https://admin.microsoft.com/AdminPortal/Home#/modernonboarding/passwordlesssetup). + ## Using this guide There are many options from which you can choose when deploying Windows Hello for Business. Providing multiple options ensures nearly every organization can deploy Windows Hello for Business. Providing many options makes the deployment appear complex, however, most organization will realize they've already implemented most of the infrastructure on which the Windows Hello for Business deployment depends. It is important to understand that Windows Hello for Business is a distributed system and does take proper planning across multiple teams within an organization. From 08bebdcdd5b4ad1eaae5d3e125b741bc7f6eb4db Mon Sep 17 00:00:00 2001 From: mapalko Date: Wed, 16 Sep 2020 13:00:40 -0700 Subject: [PATCH 57/57] Fix additional references for Key trust RDP --- .../hello-for-business/hello-deployment-guide.md | 2 +- .../hello-for-business/hello-feature-remote-desktop.md | 6 +++--- .../hello-for-business/hello-overview.md | 3 +-- .../hello-for-business/hello-planning-guide.md | 2 +- 4 files changed, 6 insertions(+), 7 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index 13c1e99b51..f3f064b1d1 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -52,7 +52,7 @@ The trust model determines how you want users to authenticate to the on-premises * The certificate trust model also supports enterprises which are not ready to deploy Windows Server 2016 Domain Controllers. > [!NOTE] -> Remote Desktop Protocol (RDP) does not support authentication with Windows Hello for Business key trust deployments. RDP is only supported with certificate trust deployments at this time. See [Remote Desktop](hello-feature-remote-desktop.md) to learn more. +> RDP does not support authentication with Windows Hello for Business key trust deployments as a supplied credential. RDP is only supported with certificate trust deployments as a supplied credential at this time. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). Following are the various deployment guides and models included in this topic: - [Hybrid Azure AD Joined Key Trust Deployment](hello-hybrid-key-trust.md) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index e1cf05225a..0ebcd33ec5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -13,7 +13,7 @@ manager: dansimp ms.collection: M365-identity-device-management ms.topic: article localizationpriority: medium -ms.date: 09/09/2019 +ms.date: 09/16/2020 ms.reviewer: --- @@ -27,9 +27,9 @@ ms.reviewer: - Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices - Certificate trust deployments -Windows Hello for Business supports using a certificate deployed to a WHFB container to a remote desktop to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. +Windows Hello for Business supports using a certificate deployed to a Windows Hello for Business container as a supplied credential to establish a remote desktop connection to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). -Microsoft continues to investigate supporting this feature for key trust deployments in a future release. +Microsoft continues to investigate supporting using keys trust for supplied credentials in a future release. ## Remote Desktop with Biometrics diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 5d10205e13..80d8f81611 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -94,8 +94,7 @@ For details, see [How Windows Hello for Business works](hello-how-it-works.md). Windows Hello for Business can use either keys (hardware or software) or certificates in hardware or software. Enterprises that have a public key infrastructure (PKI) for issuing and managing end user certificates can continue to use PKI in combination with Windows Hello. Enterprises that do not use PKI or want to reduce the effort associated with managing user certificates can rely on key-based credentials for Windows Hello but still use certificates on their domain controllers as a root of trust. -Windows Hello for Business with a key does not support RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments. - +Windows Hello for Business with a key does not support supplied credentials for RDP. RDP does not support authentication with a key or a self signed certificate. RDP with Windows Hello for Business is supported with certificate based deployments as a supplied credential. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). ## Learn more diff --git a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md index 9b11a04076..1f28723cc9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-planning-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-planning-guide.md @@ -93,7 +93,7 @@ The key trust type does not require issuing authentication certificates to end u The certificate trust type issues authentication certificates to end users. Users authenticate using a certificate requested using a hardware-bound key created during the built-in provisioning experience. Unlike key trust, certificate trust does not require Windows Server 2016 domain controllers (but still requires [Windows Server 2016 or later Active Directory schema](https://docs.microsoft.com/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-prereqs#directories)). Users can use their certificate to authenticate to any Windows Server 2008 R2, or later, domain controller. > [!NOTE] -> RDP does not support authentication with Windows Hello for Business key trust deployments. RDP is only supported with certificate trust deployments at this time. +> RDP does not support authentication with Windows Hello for Business key trust deployments as a supplied credential. RDP is only supported with certificate trust deployments as a supplied credential at this time. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](https://docs.microsoft.com/windows/security/identity-protection/remote-credential-guard). #### Device registration