From 1e9dcecdceb88cc54016bcee7c1d7732ac222f50 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Wed, 26 Jun 2019 14:58:01 -0700 Subject: [PATCH 01/23] Added pre-release info --- .../microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index 3b639a0b80..d98aa0d51c 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -21,6 +21,8 @@ ms.topic: article **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) +[!includePrerelease information] + ## Before you begin Ensure that your machines: - Are onboarded to Microsoft Defender Advanced Threat Protection From 23097049e63950a022acf509deb37967a8fcf2fb Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Wed, 26 Jun 2019 15:01:18 -0700 Subject: [PATCH 02/23] Removed en-us in the link references --- .../tvm-dashboard-insights.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index 6c634edeed..56875c745d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -21,7 +21,7 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) ->Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) +>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-portaloverview-abovefoldlink) [!include[Prerelease information](prerelease.md)] @@ -53,21 +53,21 @@ Area | Description (1) Menu | Select menu to expand the navigation pane and see the names of the Threat & Vulnerability Management capabilities. (2) Threat & Vulnerability Management navigation pane | Use the navigation pane to move across the **Threat and Vulnerability Management Dashboard**, **Security recommendations**, **Remediation**, **Software inventory**, and **Weaknesses**. **Dashboards** | Get a high-level view of the organization exposure score, MDATP configuration score, top remediation activities, top security recommendations, top vulnerable software, and top exposed machines data. -**Security recommendations** | See the list of security recommendations, their related components, insights, number or exposed devices, impact, and request for remediation. You can click each item on the list and it will open a flyout pane where you will see vulnerability details, open the software page, and see the remediation options. You can also open a ticket in Intune if your machines are joined through Azure Active Directory and you have enabled your Intune connections in Microsoft Defender ATP. See [Security recommendations](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation) for more information. -**Remediation** | See the remediation activity, related component, remediation type, status, due date, and option to export the remediation and process data to CSV. See [Remediation](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation) for more information. -**Software inventory** | See the list of applications, versions, weaknesses, whether there’s an exploit found on the application, prevalence in the organization, how many were installed, how many exposed devices are there, and the numerical value of the impact. You can select each item in the list and opt to open the software page which shows the associated vulnerabilities, misconfigurations, affected machine, version distribution details, and missing KBs or security updates. See [Software inventory](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory) for more information. -**Weaknesses** | See the list of common vulnerabilities and exposures, the severity, its common vulnerability scoring system (CVSS) V3 score, related software, age, when it was published, related threat alerts, and how many exposed machines are there. You can select each item in the list and it opens a fly-in page with the vulnerability description and other details. See [Weaknesses](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses) for more information. +**Security recommendations** | See the list of security recommendations, their related components, insights, number or exposed devices, impact, and request for remediation. You can click each item on the list and it will open a flyout pane where you will see vulnerability details, open the software page, and see the remediation options. You can also open a ticket in Intune if your machines are joined through Azure Active Directory and you have enabled your Intune connections in Microsoft Defender ATP. See [Security recommendations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation) for more information. +**Remediation** | See the remediation activity, related component, remediation type, status, due date, and option to export the remediation and process data to CSV. See [Remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation) for more information. +**Software inventory** | See the list of applications, versions, weaknesses, whether there’s an exploit found on the application, prevalence in the organization, how many were installed, how many exposed devices are there, and the numerical value of the impact. You can select each item in the list and opt to open the software page which shows the associated vulnerabilities, misconfigurations, affected machine, version distribution details, and missing KBs or security updates. See [Software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory) for more information. +**Weaknesses** | See the list of common vulnerabilities and exposures, the severity, its common vulnerability scoring system (CVSS) V3 score, related software, age, when it was published, related threat alerts, and how many exposed machines are there. You can select each item in the list and it opens a fly-in page with the vulnerability description and other details. See [Weaknesses](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses) for more information. (3) Threat & Vulnerability Management dashboard | Access the **Exposure score**, **Configuration score**, **Exposure distribution**, **Top security recommendations**, **Top vulnerable software**, **Top remediation activities**, and **Top exposed machines**. **Selected machine groups (#/#)** | Filter the Threat & Vulnerability Management data that you want to see in the dashboard and widgets by machine groups. What you select in the filter will be applied throughout the Threat & Vulnerability management pages only. **Organization Exposure score** | See the current state of your organization’s device exposure to threats and vulnerabilities. Several factors affect your organization’s exposure score: weaknesses discovered in your devices, likelihood of your devices to be breached, value of the devices to your organization, and relevant alerts discovered with your devices. The goal is to lower down your organization’s exposure score to be more secure. To reduce the score, you need to remediate the related security configuration issues listed in the security recommendations. -**MDATP Configuration score** | See the security posture of your organization’s operating system, applications, network, accounts and security controls. The goal is to increase your configuration score by remediating the related security configuration issues. You can click the bars and it will take you to the **Security recommendation** page for details. See [Configuration score](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/configuration-score) for more information. +**MDATP Configuration score** | See the security posture of your organization’s operating system, applications, network, accounts and security controls. The goal is to increase your configuration score by remediating the related security configuration issues. You can click the bars and it will take you to the **Security recommendation** page for details. See [Configuration score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score) for more information. **Machine exposure distribution** | See how many machines are exposed based on their exposure level. You can click the sections in the doughnut chart and it will take you to the **Machines list** page where you'll see the affected machine names, exposure level side by side with risk level, among other details such as domain, OS platform, its health state, when it was last seen, and its tags. **Top security recommendations** | See the collated security recommendations which are sorted and prioritized based on your organization’s risk exposure and the urgency that it requires. Useful icons also quickly calls your attention on possible active alerts ![possible active alert](images/tvm_alert_icon.png), associated public exploits ![threat insight](images/tvm_bug_icon.png), and recommendation insights ![recommendation insight](images/tvm_insight_icon.png). You can drill down on the security recommendation to see the potential risks, list of exposed machines, and read the insights. Thus, providing you with an informed decision to either proceed with a remediation request. Click **Show more** to see the rest of the security recommendations in the list. **Top vulnerable software** | Get real-time visibility into the organizational software inventory, with stack-ranked list of vulnerable software installed on your network’s devices and how they impact on your organizational exposure score. Click each item for details or **Show more** to see the rest of the vulnerable application list in the **Software inventory** page. **Top remediation activities** | Track the remediation activities generated from the security recommendations. You can click each item on the list to see the details in the **Remediation** page or click **Show more** to see the rest of the remediation activities. **Top exposed machines** | See the exposed machine names and their exposure level. You can click each machine name from the list and it will take you to the machine page where you can view the alerts, risks, incidents, security recommendations, installed software, discovered vulnerabilities associated with the exposed machines. You can also do other EDR-related tasks in it, such as: manage tags, initiate automated investigations, initiate a live response session, collect an investigation package, run antivirus scan, restrict app execution, and isolate machine. You can also click **Show more** to see the rest of the exposed machines list. -See [Microsoft Defender ATP icons](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection#windows-defender-atp-icons) for more information on the icons used throughout the portal. +See [Microsoft Defender ATP icons](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection#windows-defender-atp-icons) for more information on the icons used throughout the portal. ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) From d9b018c1086f047bbb4c661853809f47072368ae Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Wed, 26 Jun 2019 15:22:25 -0700 Subject: [PATCH 03/23] Removed en-us from link --- .../microsoft-defender-atp/configuration-score.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md index 87fc6dcbbf..6a43319dd1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md @@ -24,7 +24,7 @@ ms.date: 04/11/2019 [!include[Prerelease information](prerelease.md)] >[!NOTE] -> Secure score is now part of Threat & Vulnerability Management as Configuration score. We’ll keep the secure score page available for a few weeks. View the [Secure score](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score) page. +> Secure score is now part of Threat & Vulnerability Management as Configuration score. We’ll keep the secure score page available for a few weeks. View the [Secure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score) page. The Microsoft Defender Advanced Threat Protection Configuration score gives you visibility and control over your organization's security posture based on security best practices. From 1c496165accd75c8e33cabbf9f4511061bb49dce Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Wed, 26 Jun 2019 15:23:28 -0700 Subject: [PATCH 04/23] Remove en-us --- .../threat-protection/microsoft-defender-atp/tvm-remediation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index 3617f68bd7..4bf26c380f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -41,7 +41,7 @@ You'll see your remediation options when you select one of the security recommen 3. Select a remediation due date. 4. Add notes to give your IT administrator a context of your remediation request. For example, you can indicate urgency of the remediation request to avoid potential exposure to a recent exploit activity, or if the request is a part of compliance. -If you want to check how the ticket shows up in Intune, see [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/en-us/intune/atp-manage-vulnerabilities) for details. +If you want to check how the ticket shows up in Intune, see [Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP](https://docs.microsoft.com/intune/atp-manage-vulnerabilities) for details. ## How it works From 8df6caa5012fe3c498cb7835d93b3c93985621b8 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Wed, 26 Jun 2019 15:24:50 -0700 Subject: [PATCH 05/23] Update tvm-remediation.md --- .../threat-protection/microsoft-defender-atp/tvm-remediation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index 4bf26c380f..a7b04b248b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -56,9 +56,9 @@ The dashboard will show that status of your top remediation activities. Click an ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) - [Security recommendation](tvm-security-recommendation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) +- [Scenarios](threat-and-vuln-mgt-scenarios.md) From a87382709c50ecaa29f39f2555d6819d848c5b2f Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Wed, 26 Jun 2019 15:41:13 -0700 Subject: [PATCH 06/23] Update tvm-weaknesses.md --- .../threat-protection/microsoft-defender-atp/tvm-weaknesses.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index dec5d3e76e..31412df10a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -54,7 +54,7 @@ You can also see the related alert and threat insights in the **Threat** column. ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) - [Security recommendation](tvm-security-recommendation.md) - [Remediation](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) +- [Scenarios](threat-and-vuln-mgt-scenarios.md) From f6b119d1ba795060a41dcb7d33159f43dc920463 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Wed, 26 Jun 2019 15:45:25 -0700 Subject: [PATCH 07/23] Update tvm-software-inventory.md --- .../microsoft-defender-atp/tvm-software-inventory.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md index fed509c866..90de2ea105 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory.md @@ -38,7 +38,7 @@ Since it is real-time, in a matter of minutes, you will see vulnerability inform ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) - [Security recommendation](tvm-security-recommendation.md) - [Remediation](tvm-remediation.md) - [Weaknesses](tvm-weaknesses.md) +- [Scenarios](threat-and-vuln-mgt-scenarios.md) From 3cd698b4895c3746484e64a7bf2074af73b6484b Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Wed, 26 Jun 2019 15:46:14 -0700 Subject: [PATCH 08/23] Update tvm-dashboard-insights.md --- .../microsoft-defender-atp/tvm-dashboard-insights.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index 56875c745d..727717c02d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -72,8 +72,8 @@ See [Microsoft Defender ATP icons](https://docs.microsoft.com/windows/security/t ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) - [Configuration score](configuration-score.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) - [Security recommendations](tvm-security-recommendation.md) - [Remediation](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) +- [Scenarios](threat-and-vuln-mgt-scenarios.md) From 31d8d6e0f3c24c9f83b249f5f4e94d9835462496 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Wed, 26 Jun 2019 15:47:07 -0700 Subject: [PATCH 09/23] Update next-gen-threat-and-vuln-mgt.md --- .../microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md index 4e503d2f19..943ceaf25d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md +++ b/windows/security/threat-protection/microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md @@ -62,8 +62,8 @@ Microsoft Defender ATP’s Threat & Vulnerability Management allows security adm ## Related topics - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) - [Configuration score](configuration-score.md) -- [Scenarios](threat-and-vuln-mgt-scenarios.md) - [Security recommendations](tvm-security-recommendation.md) - [Remediation](tvm-remediation.md) - [Software inventory](tvm-software-inventory.md) - [Weaknesses](tvm-weaknesses.md) +- [Scenarios](threat-and-vuln-mgt-scenarios.md) From e39cc8f79a0f9710076a0cbcaace03d3bb6a3543 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 08:41:58 -0700 Subject: [PATCH 10/23] Added exception back in --- .../threat-and-vuln-mgt-scenarios.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index d98aa0d51c..df7b502201 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -124,6 +124,28 @@ See [Use Intune to remediate vulnerabilities identified by Microsoft Defender AT >[!NOTE] >If your request involves remediating more than 10,000 machines, we will only send 10,000 machines for remediation to Intune. +## File for exception +With Threat & Vulnerability Management, you can create exceptions for recommendations, as an alternative to requesting for remediation. + +There are many reasons why organizations might want to create exceptions for a recommendation. For example, if there's a business justification that prevents the company from applying the recommendation, the existence of a compensating or alternative control that provides the same level of protection that the recommendation would, a false positive, among other reasons. + +Exceptions can be created for both *Security update* and *Configuration change* recommendations. + +When an exception is created for a recommendation, the recommendation is no longer active. The recommendation state changes to **Exception**, and it no longer shows up in the security recommendations list. + + +1. Navigate to the **Security recommendations** page under the **Threat & Vulnerability Management** section menu. + +2. Click the top-most recommendation. A fly-in panel will open with the recommendation details. + +3. Click **Exception options**. + +4. Select your justification for filing an exception instead of remediating the security recommendation in question. Fill out the justification context, then set the exception duration. + +5. Click Submit. A confirmation message at the top of the page will indicate that the exception has been created + +6. View all your exceptions (current + past) by navigating to the **Remediation** page under the **Threat & Vulnerability Management** menu and clicking on the **Exceptions** tab. + ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) From 36253f901f475ece0ceef8190d151e08283c1f2b Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 08:51:16 -0700 Subject: [PATCH 11/23] Added exceptions back in --- .../microsoft-defender-atp/tvm-dashboard-insights.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index 727717c02d..83f6395813 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -34,6 +34,7 @@ You can use the Threat & Vulnerability Management capability in [Microsoft Defen - View exposure and configuration scores side-by-side with top security recommendations, software vulnerability, remediation activities, and exposed machines - Correlate EDR insights with endpoint vulnerabilities and process them - Select remediation options, triage and track the remediation tasks +- Select exception options and track exceptions ## Threat & Vulnerability Management in Microsoft Defender Security Center When you open the portal, you’ll see the main areas of the capability: @@ -53,8 +54,8 @@ Area | Description (1) Menu | Select menu to expand the navigation pane and see the names of the Threat & Vulnerability Management capabilities. (2) Threat & Vulnerability Management navigation pane | Use the navigation pane to move across the **Threat and Vulnerability Management Dashboard**, **Security recommendations**, **Remediation**, **Software inventory**, and **Weaknesses**. **Dashboards** | Get a high-level view of the organization exposure score, MDATP configuration score, top remediation activities, top security recommendations, top vulnerable software, and top exposed machines data. -**Security recommendations** | See the list of security recommendations, their related components, insights, number or exposed devices, impact, and request for remediation. You can click each item on the list and it will open a flyout pane where you will see vulnerability details, open the software page, and see the remediation options. You can also open a ticket in Intune if your machines are joined through Azure Active Directory and you have enabled your Intune connections in Microsoft Defender ATP. See [Security recommendations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation) for more information. -**Remediation** | See the remediation activity, related component, remediation type, status, due date, and option to export the remediation and process data to CSV. See [Remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation) for more information. +**Security recommendations** | See the list of security recommendations, their related components, insights, number or exposed devices, impact, and request for remediation. You can click each item on the list and it will open a flyout pane where you will see vulnerability details, open the software page, see the remediation, and exception options. You can also open a ticket in Intune if your machines are joined through Azure Active Directory and you have enabled your Intune connections in Microsoft Defender ATP. See [Security recommendations](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-security-recommendation) for more information. +**Remediation** | See the remediation activity, related component, remediation type, status, due date, option to export the remediation and process data to CSV, and active exceptions. See [Remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation) for more information. **Software inventory** | See the list of applications, versions, weaknesses, whether there’s an exploit found on the application, prevalence in the organization, how many were installed, how many exposed devices are there, and the numerical value of the impact. You can select each item in the list and opt to open the software page which shows the associated vulnerabilities, misconfigurations, affected machine, version distribution details, and missing KBs or security updates. See [Software inventory](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-software-inventory) for more information. **Weaknesses** | See the list of common vulnerabilities and exposures, the severity, its common vulnerability scoring system (CVSS) V3 score, related software, age, when it was published, related threat alerts, and how many exposed machines are there. You can select each item in the list and it opens a fly-in page with the vulnerability description and other details. See [Weaknesses](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses) for more information. (3) Threat & Vulnerability Management dashboard | Access the **Exposure score**, **Configuration score**, **Exposure distribution**, **Top security recommendations**, **Top vulnerable software**, **Top remediation activities**, and **Top exposed machines**. @@ -64,7 +65,7 @@ Area | Description **Machine exposure distribution** | See how many machines are exposed based on their exposure level. You can click the sections in the doughnut chart and it will take you to the **Machines list** page where you'll see the affected machine names, exposure level side by side with risk level, among other details such as domain, OS platform, its health state, when it was last seen, and its tags. **Top security recommendations** | See the collated security recommendations which are sorted and prioritized based on your organization’s risk exposure and the urgency that it requires. Useful icons also quickly calls your attention on possible active alerts ![possible active alert](images/tvm_alert_icon.png), associated public exploits ![threat insight](images/tvm_bug_icon.png), and recommendation insights ![recommendation insight](images/tvm_insight_icon.png). You can drill down on the security recommendation to see the potential risks, list of exposed machines, and read the insights. Thus, providing you with an informed decision to either proceed with a remediation request. Click **Show more** to see the rest of the security recommendations in the list. **Top vulnerable software** | Get real-time visibility into the organizational software inventory, with stack-ranked list of vulnerable software installed on your network’s devices and how they impact on your organizational exposure score. Click each item for details or **Show more** to see the rest of the vulnerable application list in the **Software inventory** page. -**Top remediation activities** | Track the remediation activities generated from the security recommendations. You can click each item on the list to see the details in the **Remediation** page or click **Show more** to see the rest of the remediation activities. +**Top remediation activities** | Track the remediation activities generated from the security recommendations. You can click each item on the list to see the details in the **Remediation** page or click **Show more** to see the rest of the remediation activities, and active exceptions. **Top exposed machines** | See the exposed machine names and their exposure level. You can click each machine name from the list and it will take you to the machine page where you can view the alerts, risks, incidents, security recommendations, installed software, discovered vulnerabilities associated with the exposed machines. You can also do other EDR-related tasks in it, such as: manage tags, initiate automated investigations, initiate a live response session, collect an investigation package, run antivirus scan, restrict app execution, and isolate machine. You can also click **Show more** to see the rest of the exposed machines list. See [Microsoft Defender ATP icons](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/portal-overview-windows-defender-advanced-threat-protection#windows-defender-atp-icons) for more information on the icons used throughout the portal. From 48c222cfb8d5b38adf2dde085b10b4664ed2d003 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 08:51:50 -0700 Subject: [PATCH 12/23] Update tvm-dashboard-insights.md --- .../microsoft-defender-atp/tvm-dashboard-insights.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index 83f6395813..09f93ef186 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -34,7 +34,7 @@ You can use the Threat & Vulnerability Management capability in [Microsoft Defen - View exposure and configuration scores side-by-side with top security recommendations, software vulnerability, remediation activities, and exposed machines - Correlate EDR insights with endpoint vulnerabilities and process them - Select remediation options, triage and track the remediation tasks -- Select exception options and track exceptions +- Select exception options and track active exceptions ## Threat & Vulnerability Management in Microsoft Defender Security Center When you open the portal, you’ll see the main areas of the capability: From 37309b8b9a976ecb8036a29ab194b38595762024 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 08:58:38 -0700 Subject: [PATCH 13/23] Added exceptions --- .../microsoft-defender-atp/tvm-remediation.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index a7b04b248b..635b6d8c2a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -47,12 +47,14 @@ If you want to check how the ticket shows up in Intune, see [Use Intune to remed When you submit a remediation request from Threat & Vulnerability Management, it kicks-off a remediation activity. -It creates a security task which will be tracked in Threat & Vulnerability Management **Remediation page**, and it also creates a remediation ticket in Microsoft Intune. +It creates a security task which will be tracked in Threat & Vulnerability Management **Remediation** page, and it also creates a remediation ticket in Microsoft Intune. You also have the option to export all remediation activity data to CSV for records, reporting purposes, or if you want to notify your IT administration counterpart that a remediation ticket has been submitted. The dashboard will show that status of your top remediation activities. Click any of the entries and it will take you to the **Remediation** page. You can mark the remediation activity as completed after the IT administration team remediates the task. +However, if the security recommendation stemmed from a false positive findings, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The exceptions you've filed will also show up in the **Remediation** page, in the **Exceptions** tab. + ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) - [Threat & Vulnerability Management dashboard overview](tvm-dashboard-insights.md) From 47a46103df52e428e35dc932c4c57091fa2f6390 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 08:59:02 -0700 Subject: [PATCH 14/23] Update tvm-remediation.md --- .../threat-protection/microsoft-defender-atp/tvm-remediation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index 635b6d8c2a..5ca66f732b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -53,7 +53,7 @@ You also have the option to export all remediation activity data to CSV for reco The dashboard will show that status of your top remediation activities. Click any of the entries and it will take you to the **Remediation** page. You can mark the remediation activity as completed after the IT administration team remediates the task. -However, if the security recommendation stemmed from a false positive findings, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The exceptions you've filed will also show up in the **Remediation** page, in the **Exceptions** tab. +However, if the security recommendation stemmed from a false positive finding, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The exceptions you've filed will also show up in the **Remediation** page, in the **Exceptions** tab. ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) From 207792e01a93c4dd65f9b2ea087097d5e53fade2 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 08:59:23 -0700 Subject: [PATCH 15/23] Update tvm-remediation.md --- .../threat-protection/microsoft-defender-atp/tvm-remediation.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md index 5ca66f732b..e79abc0bd3 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-remediation.md @@ -53,7 +53,7 @@ You also have the option to export all remediation activity data to CSV for reco The dashboard will show that status of your top remediation activities. Click any of the entries and it will take you to the **Remediation** page. You can mark the remediation activity as completed after the IT administration team remediates the task. -However, if the security recommendation stemmed from a false positive finding, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The exceptions you've filed will also show up in the **Remediation** page, in the **Exceptions** tab. +However, if the security recommendation stemmed from a false positive report, or if there are existing business justification that blocks the remediation, such as compensating control, productivity needs, compliance, or if there's already a planned remediation grace period, you can file an exception and indicate the reason. The exceptions you've filed will also show up in the **Remediation** page, in the **Exceptions** tab. ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md) From c2737d4e51984faa046d2050c82d873a9623a5b1 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 10:23:08 -0700 Subject: [PATCH 16/23] Added note --- .../microsoft-defender-atp/tvm-weaknesses.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index 31412df10a..ebf5d434b1 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -32,7 +32,11 @@ You can see the list of vulnerabilities in two ways: *Global search* 1. Click the global search drop-down menu. -2. Select **Vulnerability** and key-in the Common Vulnerabilities and Exposures (CVE) ID that you are looking for. The **Weaknesses** page opens with the list of the vulnerabilities and details. +2. Select **Vulnerability** and key-in the Common Vulnerabilities and Exposures (CVE) ID that you are looking for, then click the search icon. The **Weaknesses** page opens with the CVE information that you are looking for. +3. Select the CVE and a fly-in page opens up with more information - the vulnerability description, exploits available, severity level, CVSS v3 rating, publishing and update dates. + +>[!NOTE] +>To see the rest of the vulnerabilities in the **Weaknesses** page, type CVE, then click search. *Weaknesses page in the menu* 1. Go to the Threat & Vulnerability Management navigation menu and select **Weaknesses** to open up the list of vulnerabilities found in your organization. From 6dc8808b42509b7a4f2a639f710238c1eb7a50a6 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 10:59:22 -0700 Subject: [PATCH 17/23] Updated with widget info --- .../microsoft-defender-atp/tvm-weaknesses.md | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index ebf5d434b1..2023cb789b 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -28,10 +28,11 @@ Threat & Vulnerability Management leverages the same signals in Microsoft Defend The **Weaknesses** page lists down the vulnerabilities found in the infected software running in your organization, their severity, Common Vulnerability Scoring System (CVSS) rating, its prevalence in your organization, corresponding breach, and threat insights. ## Navigate through your organization's weaknesses page -You can see the list of vulnerabilities in two ways: +You can see the list of vulnerabilities in three ways: -*Global search* +*Vulnerabilities in global search* 1. Click the global search drop-down menu. +![tvm-vuln-globalsearch](images/tvm-vuln-globalsearch.png) 2. Select **Vulnerability** and key-in the Common Vulnerabilities and Exposures (CVE) ID that you are looking for, then click the search icon. The **Weaknesses** page opens with the CVE information that you are looking for. 3. Select the CVE and a fly-in page opens up with more information - the vulnerability description, exploits available, severity level, CVSS v3 rating, publishing and update dates. @@ -40,7 +41,14 @@ You can see the list of vulnerabilities in two ways: *Weaknesses page in the menu* 1. Go to the Threat & Vulnerability Management navigation menu and select **Weaknesses** to open up the list of vulnerabilities found in your organization. -2. Select the vulnerability that you want to investigate to open up a fly-in page with the vulnerability details, such as: CVE description, CVE ID, exploits available, severity, publish, and update dates. +2. Select the vulnerability that you want to investigate to open up a fly-in page with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. + +*Top vulnerable software widget in the dashboard* +1. Go to the Threat & Vulnerability Management dashboard and scroll down to the **Top vulnerable software** widget. You will see the number of vulnerabilities found in each software. +![tvm-top-vulnerable-software](images/tvm-top-vulnerable-software.png) +2. Click the software that you want to investigate and it takes you to the software page. You will the weaknesses found in your machine per severity level, in which machines are they installed, version distribution, and the corresponding security recommendation. +3. Select the **Discovered vulnerabilities** tab. +4. Select the vulnerability that you want to investigate to open up a fly-in page with the vulnerability details, such as: CVE description, CVE ID, exploits available, CVSS V3 rating, severity, publish, and update dates. ## How it works When new vulnerabilities are released, you would want know how many of your assets are exposed. You can see the list of vulnerabilities and the details in the **Weaknesses** page. From cfa87fdfcd90fb0778ded5212df6dec3f8e8a6e4 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 12:51:07 -0700 Subject: [PATCH 18/23] Screenshots --- .../images/tvm-top-vulnerable-software.png | Bin 0 -> 16538 bytes .../images/tvm-vuln-globalsearch.png | Bin 0 -> 3490 bytes .../images/tvm-weaknesses-menu.png | Bin 0 -> 12359 bytes 3 files changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/tvm-top-vulnerable-software.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/tvm-vuln-globalsearch.png create mode 100644 windows/security/threat-protection/microsoft-defender-atp/images/tvm-weaknesses-menu.png diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-top-vulnerable-software.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-top-vulnerable-software.png new file mode 100644 index 0000000000000000000000000000000000000000..3ef800afac30de46d1588e2f806ebf3c9a698335 GIT binary patch literal 16538 zcmdVBcT|(zzu=2qLBLlj0s<<%D@8hp2pD<~J)$BdbO=bt0w`6wbdZ`*A{|1Bih%SQ zO6VN|p@$YiCh`5vJNKMBv(7oQ?#x>E4|rhrXFq#?_vc&oCtYndYD#8G3JMBpz_X|N z6ciV1DJag#UcF38G5vD()>wvx3MM{z3XZ3WJ4iwNPCTxbB&y1;PTqj+uGfR!qSyUE>88QaeI%K zj@G22?i97(t71sWSINmhYjGW zMyLLLttd&#OHKpf?pNrLgzCwPQ;fdFW4a$OZ+amtp%lug@-4Vjck-%to>ESd(7Cr? z?yBGWuyOC&t2E9Pe7j~G;Ms4AYaW`JG3%W+?#qH((qf`35?M=evb4zn6FOyOwUxW41thg3LV(KK+dX@VTj0|Lo!6DBsotF_q>QLO!jV((fVoX zckg z_)jwwxBfNgYd3ny+21c-C9N$Ais$D)h>@QU&i!N}Kfh4ST_->PAJxGqZJ`>IS1GsQ zx5|WDomXB&2qt|BN4`?xhBfSd8R=t%-W7=uw9>IlE?y@OM6+b7B}M3Q)tT7NV8{6k zRj8M6y%sI^9fPBHIA7wD`EU!0i(HO-d1PAldg^vw=6)5ys`1c?;AY$Ge9{q*@c8Ux z`i3)k)lxZH^k7j#56(NcWXk*+l-jUvLzv%@^lZ^EHIp9CzeN5n1%sP&j=yz4gBps} zguwe}9^__TEF<%h>uzkl=;eJ0&%4&Nxc+V5e|ZLXHZ5kh2&*7fqlkB(`XUC-Jb;6; zWq%SJE!mphiSK46qTSHwZ=IixK2?|qnl*ChWR*7dJo4(8FU;{+NHiPn3_KJDer~-F z_hBy{wk~%9S*0Gj*)IfoKQdLiCB$HwD(LC?WapMpg$V<=eT~%@Q*+nHRB)FPp(Q{Z zulmyIqBvmS{hYeO1f3hGRF|fMd0V4k~`TcM*9j1Bve$ojeU2G-$M80bH(u?{4?jEJdVMD<>H?-}XcKQx0Tt2?6f=rc-~7*qB=jiZs#< z4A0Cw{h(08qXd54xOqoT1t~z#A@m(!(PsyD)~3|NHw(dO+WqBzpOO|8OF3*pBS#&3 z!c&6$05j3P+CkIJmJ_2Qx<};~PWy^xHz_tEn0C+ZdH_mrNEX z?WGu{?07qDC(J0#OMhq1zHMc3GAa*H!odEdnfJ+0yl z;Fhn_Yg~v?n{jzXAathAB(Dnbb;H?d7cXGY5; z7kSMkVCohAd*R`2R1}zLOEdOf&x5nLpw!W?UX=k7%GxU7cqXTgU$2-1U zou9u(0%@c-fR#~BTw3d8Wo6F0wN4Eu0W58W5svVo1n-JFkI*mWSb3G-_AwD1pqp_q zkzw*_SuM(K0(zo!xNx_kkiA3fL_9U1Eg;REr50LNL)csdd+!_T)FYiLZB`3VZF+bg7hl*$jBFzhrVr)V9`Ao?g)AiOTv}B^ zRIQbo^^DCNq?R8hSEXm1jxq%Bt<8;l7sa&f2G&mJUW@Z$mq)!KTzS#f(c~r+b-ZH& zU|)Z%+J#5%@aQ;%!>SZ~kR@^28=C#jQ+c+pr8ig9TkVFwoix?0BktvLEv-*p0;mu5 zdc*Qg86~E3-9kIl*!w;w@xpGNFK`h+A`LtPc|UO2q-nC{^u z8or}*I1rx6$ET>Grc(_TdvbIN2^%`QFPSf%Hd`1l;8nnGWX5Lz#6{NQl^Te@eP8Gt66JnrQ%WWBN zMp&0dEQGR%^YT6$8Ug4xclJuk1LN=L?9!)Gk!EVv>{xqxWy4~#HtsTS5l}#2zd?&u zGj^AFlyhK?wPY@ogJw;Rb)H}gj7RtZFF~lYN?SuXCV22 zK3z+1wMJ19=`t+;#h4MxTY0B3H2izp!cA#G@YkBR3#@Ce@DryjW&Gd3&#dT+@I2$o z{(@7uDplGhHDU%cv`%um|HP69cgCT8XGQ&QITcmMnNEHCX6a)l)Wzq;N>){+`bldLQEBh> zFNeV%f?+D8C`95A3`De;3ZM&V6_Y%N>;jPabDomZ{N@0>A@hyFl7eXmC@0t^zr@NK zalBc$U(4Zx#y!o3c`4+38;B6AJ$fHUW&Fj3ohtL5nfV&YJH)<;g`Upn z42{_fRNvzRuo!C(jo~FbJ!T_(H>U%&jQjkT*|aR{l>p}R)z1f?%Ae(X4uxMr3{SEJ z#&3?cWFGr^j~An{$KTj8M(T79S=zzjd6BlutBgD5Ra|F`2&WVF)b7nUHt!^Cb`~)3 zsgu@KfY}YC3IG5=fAfuY_H!QPs@)h6(~a9NoGBSh%Hwo;gYl9-8BNNXEiip4;k0y_ z%gF?4|1t;$G0IGB+EuC^dvIG$C4zlR1bY^us$-UYBm_`bM`xovoDINS8NRlm+(I8m zNeyv19p?rfIyWy$n<~RcZIE6)mqPtParXsKPeCq6A6l^Nhb=2;X zhC4fbu3xoE1cOuTib!C|r-SLd=BD#p*ij84frpFBX@G@Rt|U2qP0QzRiBgwTM)+_y z)cQ86FfxyE>yhe3Uv%_LW!7K#RoS*5KN)I>6G{uE(#nyUaXFdFkO}4-6 z-l*3QXd@-q2-}0VY{)%2QK{a3n<=`;WcL(V*Df{YI8y@<=Drqy4BWl7ahxSI(~F41jDqYypWza^mZuSuu-4 zuY)Anh`WEbTK}|J+Kpc?h$?Z0pR)>so8OK;V6;M$Xo`9Nx3kd6a6fqR7c*%MKIU;P zt9wR*+1>4JLmgz>wEIlQH6`-u%&xrmH(mb&s+#i4e~?s$rS0#WPk;Sa5%v$7|3koa z5}?l+8Q5^L-a?VBvAuKP;C8GsCnzXb(h@-?)8I0Ug_~YP*V@Qca*_WKp&5Hf1&^FN z(|j9>H6AnG+W$cVOs1g7pcMLdjE#^u|Cr~gx0oj#qVN3U_MD}E&)WZXp#No5|36ZF zQsxz$&&6SL!Veo1iAw*aMnAQznu0#vr#j))U?%j-^tkwuI_~edGt>A~K=C)i&IbwY zb5QB`>X8@K1lK>SbJr>x;0)0jG7y4#cF&RcmH~S7YWiN~auDarye!yfznS=G3u6ht27h zR8a|Y_Mp#PYnOTm&r1q4dq(C$jjQNNKjEJ$^_2{EUj^{FU{V@ot6nUdmVSyD4aAq> zwE{-02`!YVsiiRrpEvzqC%#tAlPY0x290dmo~LkS`uXl>HHV0SeqNqtem)?#T|I12 zR6^|M!PaqX(@P1@<_M~guKbde(hp5>3;mxGBq|}CcB#FA-?S<~7sSg(PZ6{8>mi|# z!`_j}JbPbE>zukr-RreUWnsrrTc7fSm9hRrm%71BD}mPN{+!y{waDQTROyljA2iWp zW?!a%CtapY(HB!?jH#+EP~hZhYy#Gd5^0uDTSGY!uZK3vqm>=a;6KW{Y+H5{Bv~2; z(Lq_cM-kIOr3x#g&)!XmulMjRqD55D-1cB7J^qwKUP!6>j@lw^fLQ;fY{Wm)uWhJ zul(-FDkAMSVAy`i2=}AV>YPvO;-Cs|$avnIC*&MOa`!F9Y&YgEm~ z!bfKH55PW1*UsrTtUh)bBfYgvSG*j14XfmDZ0N*is#_FZmGIKDkOfs(zAr&7&lQV{ z-A62~ha9hSN_&DeeGCLxL(M(;{T3v=T^h08c)ZJUy1g&Ab$qni6@fMKx^D{CEf`G5 zkBL(q>np|vG;?#A?d3WV*;jKQ2hKqU?e9kH1IM_rzcUL8Z?eKm9pP`6ONP)_JG?e$ z4Au8@DJL4AUZYtrBrOAigHSfs=x3~tS=vz%mY7>tjo3?pn1P8w5BQd>RG!Lu#Z=QK zmLqlaN5q>Loa~V`t_VPTu6f-f$0foj8ZX3apZ0{^tdKrq+v!8}z{6Ybc=g3V7KJI~ ztvha(3rS@UF!o6;kO~{AS{<`T4{R&>UmIu`S>tGpB0kwgOXQn=)oT@)bKvU?p_=+0)cGn5U zH|>%l1D$zvJ&_-sZ{r>DFZ#T?CHMxyd+<+f3l)m1qnngdqtcw^n(1t5snmT8JVx_) zeVY^ZmA))slnH9LG*!1^c^ z&ChozI4bk;jGIuvy&G=u`A|}~b%IfWb{Q>xViw-LP(^rbDwC|SM@-%`>v|bkuT14t z*EfPPq<7pgtLGk@ld?@rPRu6=yk6%B3%J6XoWK+Iau~#3W7fDlcF6P>9d{J#YoaKZ zzLK@RRg15dIZphbB(GAY!n?#-$8inkIO#%w*hY+o3N;glF?gppx^*|Ft-khH?+?E7 zkl{^7MU0$=(M%B4nh=ERtSoR2z7)#AtJE=U!dy>&y@+l}kHAbpfb3pZ}pYqTUC1u-zs? z!x0*zi~L~0n(X91kETI^iU6gp{*&ouGZyYjb+GMghrOXn3CRfOC_8h! z&egcxf)Od2)!wceA_MHMlfnFQcbids4WK1V7Wacr-m|2aZM>{8doElzFO;@#B>ID4 z2>ME>?TQT)q+3MDwwD=3BZdC@LD_>Y$V)J0yFyW?x!+%o4tfPuIPY^I?>TqP@{&O`fmF;C~_p^x&Cz5#D z|LxclW&X9N-3Iv?R47%7nyed-%6k8DMPfV<8*#}0bGqRb_72}e=bGg*H|!Ptl~bum zLtT?31&6to>9zGs4IfjAs}6EVW6AT#gkC0}f_cy76Qy)~@mgVrDoHf?C{TlqgU6uN zM4lY!4W?MOTzgiwO`2BKst;1^_03YF1q_wu{Hj~#Wcs=FTf&Mvz=?6gV-m-mnHpui z{F+J!RNV<22QJ|Iq3g@9N55ioafjxF1+oZ`?%|d{Z#H=D*1O4^>_XP&p6gi!g&R|H zubZWGeB5Yeo%gVaiSfy` zgUzrgM4D3 zsO6iZR0GQG{ButD4|mJ!&BhlqOEXqArK6>XOnLx!3OEEDU*_KDw8!w69q)68G)YFXC?`4ZLhevwv({HLGeedur~7>?r37+K?+)QcDwzi#$=J+})$=m+TK& zBAI{;r-vt40%=d4hfxXCGe^a%Nks3JN3lxFqTEa?$Ai{I8d+Vw$$FKjZY5$BOtm&W zUb9DtdS#BZEk9}^npWa-B(V4G8-Cx(Tz+5$J)5uShzeju2un1~!At#sL*pSx@YIq_ zJN|kvH0#&<9sS3CvOtSGlFi%a%^O%@7O2IYWI6V{X(7H~HXAUKc%wHsdeBS?Onmr< zeS^D3epE`3Ofa(zeB^Uu33ESKI3(#mvN`|fK(_W^dJY;tQ*|hOjzW9e{U{?SVnFXr z*12HMso*W|-+>eI=@7#lieQZ{kALz=)NRf|ruzShrTahE>;KYF{$HvdoK{RWw@^G+ zU_uf~qXo^EF{0@G_zF>Aa=-K6ws~Q9-yv>l(;CflwUhH0eZ=)YJqL4lHlL_7YG)d5 zFLsm(=WG1Ym-fUQY)WG%CmXu%161?FBZ^TCF*EeovgQ3+{_Dq??~Dot)kThR3GT=q zz3+!7-k1mua4&LyRIy}$ICYkW&V0@_BKIL)^i~ z9Zc&m{Ci2g4Agh#7v?VY8Z3I#)_(Z+Ur~y*oV>XiUB92DFS%O9;ZA>Rq!)IL7b;Kn zfvRNjZX1fU+^=gY3SY@9x+mRa&D>X6$(t)&^QEBhOqVfYSXtdzbAg3L{Y64w8D6sCxJ2g4Q9h}Lim@esSnKp-a zm9Xw5SZt(Wk)w$8*pp+Jgs;bvGPCh6(sv1n997H+K#Vl0YX}&_f3uj;ypBsiXmk|% zODxv-;o?)`>E{xQtB@`uy(M10H|w~you*5g6_4Kjd3!=v&X-SOdF_h8-HO|-;(mh1 zdqRWzK&P(cd`$4QHb!m{_8cBjMu(Ok)Zq>$H5R6EUpHdltl#vueyP+f=)J7ke-2Bs z>Jb*bx&N~x3^My%vt@>MT2bTEmb0!!0;diC&fE5cde>Z@#%kBT*mQYV6&oF|>aU=4f$cO= zyD7bBI*gc;c0#w-bzBRT+Ek+6j_v(5Q)0 zS^?AW?y=aX-^$wJ@}pTZF;djJ?eTJ5Kt*dnr2V46*qQHj0mWh)_Q3pfgSemYGwJLF zdUm-Y^xg`}Z}Ay0d2p$UXn6AQmV~8wRYQnz`jmP8+O3{_JzMx%j=IpF^55N@^o8O zxL`$mK%>M4fBez!O24Sy|0UM?8fxwdX6fNNnog6Uct}1)%Q}WfYez zCkM}aQTKCAD~;|nm%SblDGa@^>A{eDZ79DqOH#wOBMV&o+U`k!vd(--!PJ%bM`RMyK_u!_;;7`W1~7Q=w9q^_xe(jQIj^0Z|gw!&;&oO0PFI;m# z$7Ml(T}d6aHy^Q@x*}E~n)mxm>xu1fX*qNH*;c68*ZD`Q-%kpDRG|o5X8`lUA&1M^ z9_nZQ5tl_8kvkFfU+~qBi>u39@YA_ms`hU?F}}RK{c8Lo{o`Ww{KZLvNiryudYsXc z3VnqccxjpO>#TxRMOC!{U{H$M;*^#(Q(TSsWiK!M1Q*xI1+~DSbX0VD2Nahz2j_wW zN4~qU9$nP>nVOj`Icn4KayKLO&hoFzrhcA_EFx2H_TC)J`hET>k3KoR20hebmf7GB zZ;pmU8p^%eWrI*f;pQs@?&vqg%;8R;wDL z$P9-&e<_qq)-(d~)Bt9Z3mp4+r$i^~?d3}fy)b>B*w;VYr}HCTr?z?Y*?1{GuLx1} z8)fq>PJL(y)iY&zCTaC`onJK z)R!=%-fmA@P>CAFz6Y+);NG{Pr%kTVXboLuFcyG5Ji0zQlc#zO0gYB1$dA`>zMBUU>xMH^lL<=%`m z-vi+|mfyfwfF}h7yD2#q;5CH|lq7BUe=ThBOFNskBs+j>)y-Dte zT@;f=c8ILEK`%g__g|4|^2%r<+%3A*J86gNpv^?}C2uB7WQeRz*%(NChxU6u4jT+d zfsZ_+++GmADyLOD4=K=Jnt|cj>eM8!SU62(OpGG&8L)^5OH0)Y1%2KbG$)enBh@>f z`r@m_x!Xqa-CRo^RWV%Mc#HWIYhL!?4q43O_f>rt;%eG;B}%>5ei#b%JnMgdI8&$x zpsN1Su^GtNAyukLJ%UYsI4iOK3PE?gt)zDinFa9og;0E)wEEOhY}-D#{Y2~gNuT8YUcM~- zBSkA@&=I$^?AvC@46w5ZQ)n(M@z=Aa66{G=L4XXqv=%ZQ_nv#9ufKvNSvXP85{nUi zexCKgayR$u`Rn%UD>e3eiZfq-lrM<5xv@j*a3op0ZKP7xytUhAZo|3yBlgfTFcK<-`pMwXHk;Mngkzuk;^FSF!~#@4m!lUr|%wZi@5OdjP)f1?(EZ_~1)D z*U$CWtF$_O3yRLed_URIFQ8-UMFxy!*2+y%qfDtgx`1q|_3B;JkV9G{EHBIBHpPhIs1wkjP~Bv~gENio_)- z5RCAiJJ=tO0Kbvuep08t)XryiBS@64o?(!RL$z{pZv?p6F8RV`0eSlv(fRvn7soVW zSTsiV4tdrNPTYKZo`$Fa0EJ6q?+3if*qR$tcqbfi7lTRR5;0zRef<^)kA|nTF0_g1 zBKlFF;PWR(yoK9U?!rf%U0N_`W43yW+PNHsxN2QSnEWEkVz<@%;q{Jd7(Mg5xls~P zsb;t@+j+1I^p-cEY_}4Y->9>Xj?+n%6D1_dienJQkGjygBFLo6noOI+Pw%$ox5kAh z9=O#E-bp&lxKU94m$nYqc~1cASR(on1Ygq59#1-G_FDsX-R0pn)Q2h9_CHXiHYurAqO48Xj;XizNqbS8c**7r8B| zuybIic|tf888o(F&e>!4X8KlvhE8KfHvYv1-pSa*L(h#Ce1d7;e=`3j?2}s3`lnK{ z{oNl)%C>}!Pgl%j;Uo$nxU~nM3x6UP>yQy#LCq@R{)xg-6o}87Tnb1tv$}!PTBEf* z!N34irJT9X@iZm%MzJoO-;!4rjzK%`t}>M<$jhO6c!5frKBm5*&_aVL<}kZOjixH% z=39Q?*Kkgpy>;o=#&~|vejcTEBYYsEMB`55=Y+0d^o4385=tI031tU(lohAglh~(L1&yn1SaWeTbAXTqQSm1Dy zq+xB`HWIphYO*c_(%K)z`D#|GmU)?s?6>7UR5UO8aX7(Em2##IOKSUNwZOB2nf|y zR0|uJro2c}rN{uOzGG_)f+&l8EY7+^32e7K`|%dm(QDupopo~YAPF86?9T-Vbr1+o z0Ghy<;det05RvD!MqcuFSQUN#283*E%cn|}jMt2`$Q;1vDjt|~wU_8CUe*A#R}r_F zaLj=X2DjdlBe0<55aeA&opS*fEKO)AX4RLpnwsVgvuVF{o@ZS^H}_!-P16hK_vm2{ z5gjjL4S_rnX|?|Ni_ql5C7O(x{GjU-x!Z?76Mgy~;XVavakx;&hvi{5L_A%0pAznyT_Pzr7WwztBw*M?&1DO>SPTZUI5!8)42<$<_iAQ(agOBf z8ql(8Ql>+j$LR@xqZXH^r#e`)YhR^b7CtkqXQSmm7-C64yhy4c9DyN+MaJ0dtThBs z(P(4UJzsuQ!ubjHcYm@@`2Cbb1A(Y144DHw4p=l}M!ra%Hy4epws zt}Miq7z2~f{mbDcyeRuTxL6|?;5ioX$8ko{%kl4AZ2#$4u>X>Z`~MCl`@dN|cp}l+ z#L^OVATyHsXmo9EePUV0xVX9pGC4IhVR415dv}NbFANd0;q8BBXthx^5O2`4$@F&|omN5sE>SpL4m#TrZ)vHX{Dd5R zw`@DyX~t1s@13j?7pYFq2rTwyM+!_>+JwO5o0gzvs9{LFxi=K{Rh@0xs)pdLKaw7_ z1`jgHB{mQ=5{>Ss{BeP_t{BfP>+#f=vx;s%`PWWfU)7=F1 zlDGz)FQJoe$jxRhlgXpihK1n*Ey}1U2!zR!h8)=U#V~_EV$aaO`H6(8q^Y33_txW( zi=GAm?dVRyGfaSV1NiD2{nq0r^o+OlEihnmOF z{7So+pjq$}qNgP)8GSTC91uWK4&d0&)ECkL+W*p>=OnA{baV1SlH+ua9lD(k`Ky4< zgYn*c*sU~F@k|ikqej-O>oUX8o;3RE=YQ1aGO6_X28fGChS<2YQ(1ffcS8>(oQeu< zVf+32Tc@&Hcj$(fWk~K>Vbi`Cf6WvsNlZrFGa%y-glUPtyVt7SD#=?}7dBX5 zDa~K|rpV7Jv6r4vqvCh2n#ge#y)ZvjB8V49LmQ_9Qp`{cu*%FKENwX(b&NY29bfJ& zY%q+?%6)+|GRfAtqSyfzS&W`pZK}I5j_znH9!=4~9j9LCJXK|8L>(Ob$9n8l+nH;v zS7>1er#?6~=|R#Wk=D$or3ii>`AgBhxHw{Uw}ii=2bie#`R9|9-xKhCOcQK-W80yE>E;)$!oEX&>Xd#g30DwQ}e^lF(eg z4mn))|DhRos*HJ`qGe-KpJ%nZw$?qurQRbYOwC;8mP~1SE{as36I>G4xH#v-Mc+cN z?SjsmWhaoR-xEMyzs#KA1q`oN)+R;<@hG?Iu?<9?j&7ABk#Th+#Ujy2gFzz$^&&HvDRh8$8amWRo>g&&+;oIj&o? zMF;kMH*Jy371QDE;Qr+n%PZ_atV^TkLeIj|)`k-0q22llPu{eo{pz=3UWUkIXQ zm$HJ&I!{l*fs=##o)8c3WMWkEDk7XlnY7~{$HgVDf9eiFe-qRK-nh`Y5`IlJ(aT1uUakxRtqB*k#`gP5clWcR%-jzr!|UMp0ja2!KwSAKEU{+y~8 zIA#UQm+2H6R}T8Fu=UsB*3$%Kt9>df6ptRuHy<{E zt!Rf<8vck0uJz+~v8vfAoA9`VC5(H2g|iiAU_vbk;f_Kv#c{SgShRQt({~Gm3MyD( ztk!bagq&aM(dy79nl`@T>oO__2I1CTE##FD{go9#2m|ZA1sp!i#T^mSkJu8hF~kiC zC8u7^vl{Ut*bFIT#H1I1dQX(%cWmoSoQx8C8xJ#KRza4TZ{JdP>9|an=(#lB12KLO zt0RxCzm=pMoiq1t%h&EU4vStEqV-m$H&))=OAOP?9&}d@ASk2yKylZN7L&WSH%Rc# zUrd5`!>l%U(^BW%-HIXv3@2wB%Ndb8In@iTc%olOY5NbjkI#*(k55az^qQR|bLvR# zgvaVfhs%Wae4g{=8Z+Lyrq$NW3g2~?85@`pSN%dKOGvC5W4tbk@bl%DdSqNE=`xZH zI@6C!s0?UmeE0s^Ys(wtF<0Ac3`BeK$rBW!%&~0QxIGov z4wdd>cJ?K@Oyk~5AfI}GL?WZ1{SoioVYLbd%#-Rc{|tmdbi-tm!;WJ;#O_X^wVZMBe)z}1vP0S z4>O%DYkN^PKQ58Z1twMV8Cd`UUyD|lp4}L)@jGCtZbDlW0$o&7&r|eE*L5jM=}L_I zboTBTWPP9B#nFC-b9U%Dsl@J5Y8Wlh=k;494>Z~&bUD1~=+ZBX+Y3FPMk^=QTbyUH zyIT@p{qwV&?2PB#;_itF#XR{NY6+Ut{?E852ct2P$_&KWu$Y32`38GF~2M{6TD8h7?4s6t~TLpxu2yl z%`YUE`wsCKx3gy`34j=J@$<{^6nkf%I_yDyJb6%AuP2u2KaNuIy!NAZs=$SKYKx2f zsQcWrs<`WI1erU60g!m$){T&Zq*wn!3S{^imaw#9nG^2(mXcc7$jv&lmu|H4#lu&g zdkOHMq9=YMFsWMb$(Yv>^k_6P}KHO*ng7fdH6t4GX&RyUH)N*no zYHrj`(uY+#PfeVibf#p^5?b&ed-8=5ihg^G(>D1fxK{cQu@Z1Mf$^9iOZMPNl_K$aM?VdM`|es67@Y_zmIuNh4CsC_?; zG$S3oqReMyhHe9iwc^9+XU6r$fDzHeBvUTaL_F3WRiz9q0J>SQBR!FU+mGLgrcW0= z<=fHNck~Ze7p_i~0756u)C97$`!kD$=~jKq5K9{~Gi)U45<#BS^gw=|_p7egmh|p> zH2M%GQdO`0`_RP!SKc3->EujH@;8S3S?NdqAr9n~p0_#umh#$aK^(~iV|t3hyL;IR z8SF?yZJ&GF>$~ugu)&!ZX5-UC&0&8cF5%$>kl<*#4iZ9e#=P=s$g|NGN!>xtt zDcVk>I@lX+owD)SHC+Dd?kpBNTs|_XaRxSM#FG~dyI?3;wuv0)jFr%)OxvW$lbawE>qSwEuCu} zQ>s5X+chB?07|Wp4|5nhO3F=1fOqH4bb9>0PPmJKQC&g^l0y_{?{e(up!wHC;g$ns z{~+G^fLGAs!H~E;SQ#Wf8I(arJeFk+@PJQ-2s9xL^zk&qev$b$lr7)S&^mF^>L33B zS7LI8fn`2+jQ&zS=3(ITFa_n&j{|V;U(Y%X=a;+2H#Jx_M2z8cLlOn3J-KJzgi$yb z!0#r}7h-eX@-}IM2VW-nIb_s_3JW8=#6};gQyChMD&M=Opzrgxmm#TZen~*2_8$v< zT(z-t;62LC1+EAKKeocR5kQBTJa__qV$RpVmvqL$9fkkc=f8>?CRCcd3`E8DZ8x+c zw!TFt91ID)T!mfr6eqhXNyx@-u>3PB)z6)3t~=y^V&;x0Eq>{h=@4*Xcyz{~!ZW$S zJdt03)1{Cb;Q=JpXB8csy0V@wOAuDG;+KF#-Hq#sn-(QROF0dWp=DT5yL{8umz!8= z&!sA`G~_Ln3n`8jWK$@jiTPG(euCxpw=A_P{-0P(1OMmkcRc4D()RI0gb zA6ZZV|isZ4)loXDh z^|oi20$vaf?w%Y=N*D3m2iwo~ET}xXAj3wMqkmJ=^R+t$%fT?R@heIy({n9}$^|TO zDN8^?C*{)DhQ2^6V%mR;{50Qn1w$;t{)e@)r0dX0zJL(cS2Vi)SMryu7a#kP5jz{) zHI~b|rtfuIsu7+)-9GL$(WSn1mx!bZ-wtP@t#=pDs z>D})VsB6^@vB*x(2AQ*puJd!E=#?`1cC{CC!=MB&pv)+xb0VTIqFB4)J6+gJ>L zuy7dpE}$kXtz+s*#mFSQHuF>vvQkicnHbin=3#n68yE1ML$;(1eveZ%!n zKEJ1~lz`r;OXdEvzy<5+RK|Rt3;DMuM8%87Ky5*xp4~ZQ+?bUuy71F9nn8pwp@2H} z;dJxrFTU0lb>^`%H8N8L_hu8?(=&=j6nxg&7g&?18@2b^Y7yiMeiWWQ*ctan{mL&5 z3y@o}+@SlPv8Q`_ga=ax_zydCC;q8HEiZX$Z0!0oQ$vv~Y>IB`w-!o$tx=D)k`~9* z57BR+&9X}a=Icb`p#TQ_x&b{pW<6gANIeXpX?I7^0MH&!l0+tP#xtVwal%3sqy3&N z6A!sTZENI#^-Dm$J4W5}b+XdIPIwt6aq(1D<{J%C;SQCQUzIT5f0>%>wbh|_dTm0v z#&w}U2RP0SqR)QlS5fsQChzT8>Mau}a;tpHw(nAt@EQ*8u|dV}DULKPwiIY5c)I2X z)-4vz)6MIuDJeH4m*iRnrbMF;M{jgT`>liVk3cc-0a{}Ekp7?b*#ER$GhcCACZO5j zW2F5cZStMOe4ocmclyUFB%0yVlqCZL76AT%-USIW@t*Q(zNbWq=^nQ4rxMaXweXZ0 zoB$q5aFw0Ejuvmx$h8iJk<0j+Y5gVF$&UApoIYzICrRISn$7ZWy)C^%AXSY~ z`zJNI6@pMA-|#y1TN2(;P?&jBlT<%=$6wOEd38_Xf>_pl!Ox!Ol+u?TcSi@vJ4UqO z9R_M{VkbGc_Hn3{-BHM2(&4g6xzd-MnMHHt9lX9qGt{~bnGZSD{<+=|+%<5nQX+G3 zp1br_&1T>&Uq9LM^3sX<^@%&}uqC^lN9_#dHwbTBqi!}A_20%!RhH z{CrW9Rmh1$z5-_`AOt3lt{*{@QmVIOTCvgLU^48_@Jqv4K}a1Wp!`1Rj+04^o!QVh zBMOUTrSOi*qA2@oo6piPGV8Xl}lf0%31}d&16@LUNM4xB9swICIZp-kr)_ z+Nbukmj2U4Jt_P}-_kNePEHOr)CafrY1jT+YPnL9&-s6IJNkcLEja_pdPly0a6?(I z-|OH^?Gnumtp2@oYqzLg%XlLLqR!bpCW~6}yCk5YV7@_)rlbByQagh$|01!~;|ueo zkz~J(k?QI$_9Eq-h5)?-R+7o)W+}bbsz$6Q;6`>M`WU>>K|qYOZArB@D@mkm7mJEH wOneo68R_=1GVm`~Uy| literal 0 HcmV?d00001 diff --git a/windows/security/threat-protection/microsoft-defender-atp/images/tvm-vuln-globalsearch.png b/windows/security/threat-protection/microsoft-defender-atp/images/tvm-vuln-globalsearch.png new file mode 100644 index 0000000000000000000000000000000000000000..76af989b3fe631ead825d597cc58dc764e228339 GIT binary patch literal 3490 zcmZXXc{E$w--m;Xnj2iDW^Sme#yqr!RzpP%w}#RhYN#SYkkpt^RYZ*)P_tIcrD_UQ zW1^^8iyC4|n^e^pYK%tm#(m#+t>0R|v(`ELtY?4DKHt6nIQu!tf7@IY;62R?000D_ z77#lCfSrqV4?b~xea^ui&T4pqEp8$K0Kx9#lPybCP?80?QBZ3$ZVH#=N%8YyO`je9 zMP|;Z%lA-zh)_U9^^gS%@uOG>;)C=K^$$k*BZ2@TJo1Vx&U?(SAc7-9{eAsVfGVM( z3oI)5FAeqaJdVnt`~!UeI{QLAtR9}@9(%-HRJdoT55O&$c^v2acW{5CH{6pI4Fxn2 z8Zub;#4&dA3=Q%R@&ynieP?W!!QI`yT>Qyg^^rch$CcDWQAYv^M7M8zqc5>F`oMuX6yU(dV*51*B z56D5QD)H-qyzk~@yZA|QRDS&~Y(vde(+_Ao>C@7-jP`b9Yz!JN!jUScprF7$l)DUo zKp@}0z39HgYU$6!v8j#}{2b@2)R<-A&_F) zswJI>?W+n~#o78J0>2fG<30TRuw{cew83FU?Fw(pv)a%e5ldcHHFx7)y&jz2JhG<$ zmh3(F?aPewEgtq}C}uo#%<=K^uw@8tFMY~5W5KF5vewJnn>OXf{OHXmOKD!xOLR=~ z@v4p3B4gP_fWXJOKuO8Ly+ZJ>pNiiEHq}Hp)Z|(79CBAJLItmm;}abxH8noZbF-$4 za~d1-L2uFKYX?>gxLAN({+~-jdSz=Y${LV6Ff(7xiT2NI+ER*qN0C+rji>*PVPS@% zj(nw>s>VrHNzdn6I~$oT-D%IQq!O5>=4ABOYg|zbLZd34jA#DB@FK^tX?EM5V9=dY zIkbI!eqWNMlcCt&;Lv&XibCV$o){Gc9eQlhV?$gOpkyd|X# zKh~;4Hu`45k=_mFV$-RbdHR?&HP^(6eyK;+(5@!vP=SHfy7{EI*Aj%1?Sv?I95Cbm zRLfiv^$ot>U1oHCubrs=!hssy=sJ%RD5qXxTz4(|^|AA1W?<2pp?cUl@!pzCzzRWf zpIqhIt8)9?Cx@?6Iezc=dOdHubWUtJW~i=KGVYIgBqxvrjA3D+|MZ+?a8<%3zg1D^ z%%(47_w7uIk*id<@!?Y=GX&>W+fCC;G|$S(Bz|*9*(~!Yd86ZX73xC7&0spVnHNp5qDxaw!SrJBtyE*S~fw`-U*V`+`el<{yRp8nx6j3 zZK<;VE#tAta&SlJGgo{5>Z8)+A>sg!&VCpMQ1%dnxgya#JXJe%m7_{gahx1Xk%0Zm z`1J&@1t!0SnLm9!ith>lKivqZSpzIyb>CMOtkzR4Ic#~t_Bi)TYj_?Znp42>wqu#?;&Q+4;f3}ZT*_eoAzi9GA1!;&K$IF5yx-R2 zXITEw?PhrM7()4z=e7(|4@ox-_^K0GQ3^Ih9jw%ys>L7;kED6@rF0FYm-OfV7#UML zsASi3N}u3XI=9FE4&j~__<<%Dl2=1=P461F!T1`2ZiZKwOla@L71@8NHdK12_Xg7= z9WJEdFLCFu-BIK!LhSb7vNi9R82=c?`+iLsj<&(I0IU8!!8aIx8y6$F2>(9+u}gm{ zLsc)ZurR#4<1A-MTzG~)an$RP3Jxnx`;#GFz@6021fTw7^^eN&@@3W7?+<{&?jGLN z6-*t5J1=j%5GlHFy?6=;io^~A|Yp3$KojOpr{OUc!u z5mr`#9qFuvo3Eapq$WE2o(?s&5lpwp2EyO;zf7j|!t`T0q-|l0X?M<8Ul)o|tk20L z-2FOe; zPkaQ5VU}y-yqod$Kp$#ks-qNvEz7`;J)ZUtsP1jM+Iuce8 zHp)=0??WbK-hPfoW`g0mVrD82`-;5PgAC-!f}`UjR1A*KT%<4vYg_9wH9up?{X>vw z?fcX}0-+t!$($)^BE<)KzO2yDbFwN$msWV2a+~P9ZMb(|akjYA!*=&GNsIPybL~!+ z6vRN~y-?gB&jRr1h0`N;@ad*rk4pQc_Qr$-Beqi?%P5Lt?@#>}`euTugBxhkxVndO zB4^w1*tFb~%WAYydWauih$ZP=DKL2?soJfRSi9yjX!l?Ye9$ZcoHwR?T}qyQK9iyB-a z-;F_0u~IaNkx1!nVGU*2r}<)yZ6u0nsGk}VOdn-!B*ouLrxG=k8Uox)WsSbf z6I_N@BXr2G6BQ~AyBw^SXXNsMN0NdmRVisoHq}=57poR;IX`~Xw?i9vZ`JiX++xJ7 zt9>L~pV^x*oefe)_+>KNw+*(}n?>oA(=Tb*(mvT__|9i46a)tUX&Y-xz;28z$-w(1 z7%>-H^^2k0c9$D=TcQ1YTWfKE1&PGg_(bNts9y&X@dP7oVh;_Nx+CCP7-Ux;mYMb0 zW)|MzxZS~zoW&HTbJwG53kqu-?QlBjr(mt@Bk%XPZSduYGm86t=9a7vO`ZIQVN{xl zkL-^^#tn_MMnrRY=aY#%rn_Z^L%oUvc|1bls{wEIkz@tWm^)(qn!FdH1okHK<4de{ zbft=pnzYqXJGKvXa6HjyJ?P9P$7D77(Y;ysR}tGtea*32lOw4FlZeMl_@=~%XH4>f zPgm|&lPtyBeb$vX*6G$ zUmH;Mb&|QCWW0ZHk6rIbv^Jn=*kQ^cYUjqx1*vBT8h z8Pb2)C0-QhKrHGGYWWRrI=q0$uNge&b=BAv)Te2R!rzBgT$6pu9`6s0Vr zJy;c@RG#nlPvJ8(=3Ms43BK-EIotmt``S}f_tbQgZaRiS0ibb`41oj+$%*2==JMu9 zC#zUs?)EoB{h^AZkZFv;4yNrCFgevgC1S>SQm3~EEUyyN&yfb=Qi`cI*`99{(#9eZ zPd0g3{%yN>XZxw1%?L_dK|xE&+3sXTpjk8hlkBaH)`AYVkUYpcQF#RglKH45ufkR^ zL?fRj)1tlj`UFe;?uQw_rw4;LOST zS6A1+Y5vmU7cVx?9;;uj{XR~wd6!u33OjIfUR2YQO;1hTgia|}xz;^sMmCyUX9>0E z@vEYuCGm{KPZB%)o8OXTL&MeEz<_!*;qlF=TW59it$7|m%tp5*{SVfAas{tI?%YVR zwUF~CQqZ);lfIQvXlj bf5+}BjdP|!Gjv$LA^@nF4W!!C)QMJ#dT2nx@ts(bc7HD5oxHy??Dh21^Bs+j|WCl z_DaOS9|A9RQ(p)o?#29IW$_WygTd>58agW1SMlh{_+hWMa6A4EshIdF`ujP1`ao~0 zM%2O3O+PRMcks3Iaq;qV@$`Tw2w2&`I3Z?S+0!f7$HmFn52_>?kp`p0e@A^BY%#a8 z__??{Kw@Vk1mFq*=E{9fN54Q@9|y?N>ksDk8-G9C#n;Zw7ToFsHFY+mfnj{i@B>>P z4;K$7sFQvp9*kZ8_j!LGI|u0GPxSVGZ&UVkcX#mcgHA`XF)P5s+-B(F=jH&F?S1Bg zAQngiu4owaY`4JOjpD)Avp=i^3FWTwK8xsx1WR1^N@}ja?}^3@rOvIyqlBoiVpi0w zP!__Or-r*iyqvtmNtu+;nGNSjlfC(ZS;n-g87|MmY`CR?s)_*fAg4#gnz6yII)7G6 zhh>Jh9#jv0ii?+H)9cI#fJ%`=aS-NP^)X>Bh_!PbK)qz#Ql4F z_hZ!1#{!wdFZcBXj81SA?Qdyua{fBqRkpTfrlY4n91$7gpLD=S4w7bn8Qt32>LQW9 zjJiQ1xHJ}dB{DobTobVS^;H|YA}JdFu4nl?Qp@0QZ=uzD^CRQs{+}x$rDD>6{ckCY zmm3l@HMZCG=9{BuXJ=o%=f^zo@t*P35n5<9u;UkF#A$uea&_cyzMnsT9_%(P3a)by zAWb;44Yeb#j*C`*pDhjyFh^=<<11ErfkANBZBfyNCpj$mFy-go|8G4?U;EaYHw&Xn zU4r(SH}$Qp$EM$EK6pSQs&ijZKtKSBdh`hE%hZ&huT~1#esM(w`ioR!W8){$(S!5O zPN?G#-1%u-Vj|&vhaBYN$K>E2@Vn>EgKDeE1yArX9rCCA*~d(koh1m)coOEg1&_@+ z8bJ#P3j4L&B>33B7!FnWYqfij|aKAxt+iEJJKFKdemnn&PIFd z*3w?g_fs%;pC*L~QHu{DRGnXJD27Fz>_b^=0`rq?T~+m*b%g%`io+FkdU ze~)F;)tzt_>Al)dB*~DP``e?5-a7n*$}?$xui`=VQRoxfF=R9G(^8%}mT#?L&+b|u zHV=+{{{9m|JNYMra9ro1i_7xVDTs%^dxl0ol?A~|0mnPHZ%1(zg^@!CXB~eE_MNsd zVUfQ&O!Ko8T%7?k`4)a=86?Z}&&i4H{ZZ~Kn&*}UF)~64CmX?+YsxL0j*VgQlZ9tkH1YVhYeu!0$Cq4}K zXp-Sf^*>xuiMZUEtp}6z{Oq0H(jvXrUB6xH#47(fYlDyz=Dw<}TPXWx-ZS>Sy7YVh zZR)ck)3&a4pRKTm<3f?!Z=1Zfrvw&~!olx7<9|+1f21zF_r6x$aTW4;_s5SP$e!h> zfz?N)E|UH~D4Up?+~?wkhKAm6qN{XUEEo<=lT%Yywq6(E)f|w2brUa8Xg~WF`ab9o zrm3lUe!R22EmE1*7&=j^(-Q79R=BD@9)NGsy;ZS_;SabS*RmC5)lG zPktD^U+`!b=ondDU2WOj@Ay-gG=s<}%FJ_W{cQ3iw+*bsq$A=k^t`5qG&VL?v*Vbi z;~Y0&Zyr@x$ke_c&m3Vg^6CLjczAf+9(Jg3F6m1ce_vmpFk3nagJe`ymEhH%C*L15 zH#O0KXi7^gvt_88MGUQy5yq~xc<_qqD1)srhURvJQKYD5dK3|!K7%*8yeYb0TFWhb zalV>%@e?GR=x=%I!KB`8NsOvw+<9JB=;Go+`i24(zE0Nt*Sd#QIwF`X#L`$Ph|=|a z|6aCdB1)IC#aK7%#?$e#SRX(1Y)|LMGq5AU1}vy}@i2NPK<@WH6D@^ReRrg#6D?Z< zmNCaNShoU;4y#pr{=GLFr@D!`dBraWkQ#dH9P1i=?w9ndFA#oyq8n{rznWRJ1(AUd zeyv+@XL3p=aIbUOt8+JC6#zqv9p)^~dq|LoPlK|lc^(oPN``_Xu&Yq~M6C;jHAILJ zRF(#Z!Z6Md*o3EnetspJri z_*XW->vYGoAirniq0Yq31ti$(-xx=2?kYq@eBqjN`eJ+v8!ioXb>%Az-k|+vNr#U^ z%@|~FTsgBBX8C8kjmIoYd3ISPfts`JoV`z!$|hYXDy*o zp;Bb{uT$H__VAz;6jx2e?~t&wg+O74ski3WTNgh1=Cz%Ebxmq!SG4E9cJ10NIyy7M z>1HF-28W}yOg-4Gn=3+*7h2tQ^b#Ju%zw@Y`m7$a+<6RQHnV$b#KW%ebpF|&%T4+7 zP5D20H4Gf;Fk=`(Zw_I>Rgp<89K4?O;9!`q`sE8=WDUa+)H69;Vh6yA6!Iscz{%kJ zA8?F~LJ`cUj|VjindAips}dkMlo5|{KsCO%C&a^}7!h%0=aC}zrmRdo*D9)plbw^3 zAXce`2 z%fT2xfnV=iMeu4KzJLcTBFsf~CcrCTGy-v<;6{jRroDj8)Fplpj*2=sMs`~i2f#sEv)ZNbQ>W(V3<*&WgeQXo;k>2*J zlOS1kcD|eBne6%;#1YG}GzYUzMSV{gX=%qzX&D(Ag)h_q9jW%Ux5p{gSI_BzH{hE{ zao&6N>ect{?bYm$gM;`U3oU)DTpP(D%<&bPn&ijG5Lp*a^_mc>FjNjKtT=%gdkCQaYZZf6buz222f2 z(Q7swXllo%IlD?$;T&GA`AqH^o{cJpU?UX?T{lor^Ow9N$)|WW%pA5?!YTMDz%t%c zRIFNdg5-ZTy$0hi>{`L)wMAV|GEeY+Y#*wa4dY}T@W)3gdgv0?NJh==iffOZ{WGDr zJx?mtXAQ%gnFYgJb?X!;_|i#;-ACKxw6yJew58G4NtpC$ByH7G9}YtmH5ToX`BN;U z_`PBaeK|5&Ql7mow@gSgyN+7xOf*$gaKX_pQbqRJ^alGx#oD-(XXECRs8_yt`4UI2 zXv|O0$S2fT&_3^_f~O~j>=ilQ?|XCq^?94*(^8JR@xza$a`1g<{2;~xLNA|GTi@3 zh}BzMgMR-!F{yVXs;jF@&&qlwBQ7srZ9XISB68j5`1m+CKR^FkRAnVUxiqqdR3k~l z!$YvHzTO`RBkZ1^w@5Al+bF>-`Lz7QewrwVPmG98)fh0#Ky%HUrley?HFqx5Fp-f`7}SD?M5sMzv?|i zHx385cq5TP9>v8@=!#=%YMNV6us)qvRFw86jU{1(ivtaB(9a!A7_221PK6PooU;Z? z*v$C=aThP`i!r@X65CDP?8Id?4}Yh*cE?Q~1j1I}F*SvOelJw139b1{8N-;s@>WkW z{FO+j*xppx8i?9^lcm-B(;8^^t|HPtVpd_ZBd)(Xp{@i)YQvQcR&4xUnqY>XTgdAE&s8YmGjhY230S zycw;z8rt~XA-U9I*O9uZfkJLpcO`j%1(S{z63m6wMS`o)2>ZJL#rO}KDT1V& zni-TqH7N)%OduPj-d4*E`IVFqwj`dA;@C1$Ge%Jv^l8Djae_qYvQ0Va($gKlhp>YH z#bzWVAi6(h*|8t?mx6nVsHsHAgn#sr(KHXlzoo#j4S)Pjdo3J7SWsrwihW3iA2AFt0$xVQfdp4AxD;CN2+k1GV-q3(4vf_73=TcLQcc*76 zRIIRpn*7zR`pbhJlCX=z z0p`PlWo6m0^K^605$WO?ji1g^;dpY35$nQ5p7Lh8MZqHiA%43*8!v{ts^%eA1o;-2!@k__M1BFLE5pA`HlAQemSp4rrbzf6J&t2#QpUDrPQO0`y zMz8kh;?o#n2UZOVxu$rE%ojgJm6RYL1xbefd{2h8li6MI8Mgq*0^JB*rw0=94<;H6 znF%tw*u_pthu>ycQVU1GgfKDs^5sbtjaq;woRw7(tG{2h)@6bdQs~;i#>}Xtocw8N zacMt^%`$GPD%)i)H-6|adi?88E^rkPf*%MfZSI+1z*51)qi}0Ux4(!INNq zslJd5TjO4|HZ)A`AR_i*ZT7n$tU5c}u2Qa)eN5QdPeEbC0N<<4XpLU=C&)~fU3rs2 zkEO7=7k1G{Q#0!pHs@H+H}>J%;@I1qjMhN^_3q^w-5^n&o_h0lkO?WyVMwJ#F`8;3 zTb~=J^|ygJvWq2fI#&`^TeSWAH_G#A4FgZO7=Kk#m(hjRQV{b$wUH@PD7DM&)_sV- zZBR#t>-@?~@}|wQO0}o60tgX!{>QiAIl~X*&Z3S*3m(eF=)Uc2Z|P^bx0utsn?Yz| zL)gN?0Y2qEyP5Zp#MT{iblfM^LRF2E++qi-Mjzg6>3{KQUCF>eSX#QOYg<6&{sh4u zZ$ne#)^MSl$JNk!!pr&HhfQ;&D7dh&9MeR7FMb>n6C}-d9+S-qsz4R6^gl#oQ`gq1 z^EzUe9p{xW|nv)Rk$xH^gQ+J$>nO^{}*mUoB;Etf}u? zCfK5FX2$)YD)1(y9n*}lB(>YOdMg|pE}!nYyIb(ZtcKE_l58Gogc>U zR8&IE=^tK3>``0p@2i2Wa^Ic3QaQV4dGLvZnaA}x@rFVM;(^bNaV!Zh)xVCi;v@Al z-ZjV3BxRtLr4R(&beQt=Uo*x&IiGD)4IFMW`REQgrCICLg~kmkQMDBEc}!&sFs=#1q_j!_v*9_FEq(f ziMhw@g;DA6Nn^w`hVK9f`j(BxuI*-dO|Q?W$1V;)f>R?2HQqfuSawvHuw6dS&CZQu zdlyu)>|m>p3ZCrTysq#pOPyyq@i8$hm1_48u#YGJ6PvOUrf9oJ#1jyh=RU7lt*qo-;w40lGxU~Upa_tIVUO#y zbG^!NR08~=Mk53}J3lviYDk(D-!;Pr66fN&-rU?=+8fiSIAX^BPvdPxleCxo6yuW_ zZz(xNJJ}@E-f1Vtz^Qs2FqlC^E%p&k+}mHTz4jX{l&MP3gILid{-yjsBIH!fYS$H# z(-RKUgDi&u_NBeNPg*8-n%Vb=HI>n}%V<`Ul@%nStE6sX;MakkwiKxz_nM$RlBE*0 z#ZXh;faQqOIdTwkv29CE4YH|$LdiPze!pS!LiAd>Q0#h(eJw1T3DjKa)|Q-BTD~}~ zoa*PF)-|`oR;i+2g0lq2F0X83uhTWY7Ar{e z^r`Oi|CH3u&mH=`KiGMM$y96sPPtB1c8!eOq)7wcx}YC4DFt9jQ_-MVuR_J}88KJ) z@@*P&sKuI_Q~aiZ-^ePZ2>u>VeGQx%b}|)9$XXe-b64`B>Dm%%-+{ z7z9CGHu}??hbI3Pa~$Z4gy{3KGLztr6)|WjBvKyw{thhvFre-i4x}@2uufzBynlal zZpD|nT1H%act3AJNJh`CB8(YKq{V6Fcz1J}W?v=Zqi4JK?Tu#65Mr=^Hl3CFlMtfP1zWRqX)N(=q)szn_A#BCuF z^SERrF#ugqp8$d!$vZoGGs^iG2JV2sT}0%Memt|@-=9Xk3Q9SBC%(fYgsCnI?|#V9 z)2H>U9xhGR-B}R#64+cK2-x(13MbjyKNxOGtJj);h|aAr}^aY}T8Dx2^j zIoO$?)?c8}5&kzU1)pU7HV$+{gv}ptm6m0q0#7Df^p z>Oa7cifilBy3k^`(+-rv*SR^rU(sDG9db~_v&OftU#m3<^s~;00X!!ojt~Ad^KN3< z(CQ4V+n}a-X%19fy9#>>oBbRQBL_g9FB#`uG>ZD zKWApR3m58QJ?npkJbSseaf>LwsGwky$U?-&*B;$F$ZP73?7lhxhs0~^h^pa5nxng7 zR{_(}Tt=hO6V0K?I{D&x9-h2w>+5~M&lOA}%pZ*#+Yj>yvItOCDc1N>Xjr5S!Ye9P zppded2GTbne>+oU!4g@-c6OOStszU}Bxc455Te~qhfQ)KdmReK|4pb>}yOG zPEE<@wM(dq(#1|Je<>K4XP|DisfwF6Pn_oE)o$XN+`KI;mkM^BpnaGA?X6#$u`gTW zR-2{n-@h-MG(3vhT&YxT`*yD&((1bptB?>$mp*CH;st|>O5bqR*RHNKzle@$bHeH- zN^n8<^?e!=b?R~L!duL0z>GSjX|h|}vz+jcQNjRdsVp@AEayP6B4IIqP{Q-}Vfd$Elm07R>`HnwC9B5uEr(@uB5Rj8dm1 zb?V0XWdOLBKdDp%B7gj>Mt=Jt@69T>Jf{Ox2h;x z>goa%2~-{n7gkztuz5hi_--LOH3wt1+e`cLY=8_dJ3F78J>ldxEw%~+hfp`Lu+-%e zmx+m~8w2*aJK}E&>rFg)#}or9M0G;>jR_!oDF)*Eo>jR|$G<1pUMR~e2#J?J^5}+| zf?d{jF7^Cr&Gh(l)%fpXXy}56mZo;Xq{_W)g6BnZai(OdLn*y?c(Dvpcud`mQAWT_ zZeb!qrfZmKN2wuUB)UmloJUPkUqbDOW}^6YCYa2tAzK~oR;hArXVeCR_|K)WrDz39 znL)rFTr&*iC}w?Zls8j+nud+9zoKPH$kMv!kveW6zET^sS#f1FnWOyyKsp|f80Ge3 zhgM;1%Pi;^7Gq+bSMJG9uWn^Y)TaR{_SlEm#Ng%#VUj5pYcUWSwPi7%ll|H+F<7jl z9hrYD$-)YT9}6RtFj&lK2U-o$40+ZWmZVtE6|;LVjMZ1@OT zR`6Z_e~ZaPN&CBj-pj`MvB*S@yWQp|I60+j&X_FK5A_VY)v4!5H!Q)se zlX%eZthuaRJ=_;UsYbB+8CNo#!yv$&3|={jN`Fjn@=h01BIS#YLBLv=eUw~kwM(RL zjbNj4$}_;S$R22~IJ}@atN2J}z>%Gr^E1PzgFNO0P{_y5i8qXm;aSIG-~67V_-T+V zcPNyF4NN)QrsTX&<+7d+vOkqq6N{{!CkB`DV?0v1*;hoLm-8sDHcP6)N}dLYT7`m+ zm$o*pjf1dlW)|8wkuWRwHrded@MlzlY??4e^Lt5t$S`^g^e_O=wY4?woca0r+;Bv2 zfSkE~lA6PMy2{Zxk6$yU9JPO&og}Jm65R>`=)Zits~32jaFcxx-^5fO&Po=m060o1 zZb4De08rkyB_v)aXV%yO9saOZU(m80+14i8&Uh2g;OyfZXdJ0&C#St=DgSIZ`?1Qy z(zJe)Y>ErSk&>JZR6&?V{~Zm=c+)q4ePd`sN7M-s5qchmyq)$2s@&PQZA*HVRL03o zBajKi{4Fh2iy8k1Nk%0IaHc8U1efN(?cBV)cu;am%8I?O2=pAV;N(ERESFSlYb1|vZ<-OO{Jgg9QC~08ES^mg{SAt7I;sGsN##_=XmB)j3 zY^SZ>Vn8(1dhuG#!O>T@0FTDCO&LG$guhb)qT`|KpXYOqwW&cT;P|u9r5xB1$M@8@ z2ehW-(9_eageymXq$;l}H*9ehcs&Mut^;2#E@hyCbbcI&#!;!jul6Kr;spzX@;U z9uOiiJI4W_VPX&bOq_m^?*U zgVMTqW(XU21(-xbHa>S^fB`Si@-gTHCtA^Re;m}_xRV6xI8AlK?Ece`n=H%$0{x~-i~P~5qz+K% z(92%E=cM2u9D^TIZPKYKOPLPf09Q7;P9qjt{7qT|1i)AY1rjdQa!&MdexAY6(ebv3 zNVHANk~;*E;9=ec*xGUd=F6y_j!vz=ww|6HxFy2TF|Jji5*-v0^7MvH8`E_p3zJZ( z$XnVzf#eWNd$cMwg>dKa>FDSvtBg#3nzHR-<|MTUD?T5Bo73mOaNg-j5}eA~_7|q7-saB>5lqOx^B(HSp=gxh&LC;X9iw`^2;N~oGfSI%V=o?SA_SjV2tT6XyLg6Z! z&?rl&U3uwc(dt~5s#4=l!qNn67dqH^fh|XlXOmLbpM=eFNf{m` z>x&}5`4yp78O@kqSm?O8+KZpK!%2pdkq1_1c$a(SyOF73GT!^qk&#{#PRMUyRxMIn zKN;DA(aNO)6yD}praIJ*pFMkai$-n7EISkhH?W1VwQ7Uwf~5$~!`nalgy|M|i};8W z?0ByKbw+Kaaj|*^HObOMrqvk4_((b);CilCA)3|V5u6~b>;+@J&g{IQhkeV(hn&;* zOz)uZx-w#wNb|IYvr+uKh%l9%b(BPW&G-!EBqUy^i4Uts$zV@8o6kGhzk<@_PPN!M zcNk{PP}7_Mzmi@GP>=yk>)CK1%jk>w%}1EP&&dwM$++Ox)P_Fv*{q#Hhq#JV^cmY6 ziXich;|OdP)!T+uX&Duio&_r$K#_ljao!XuDdDZ=)tbUrG)ZbmBuhJd& z`8nbvp`uodjs<81STA~kaz!{DnEH2MM^eo6j|#41Tz2IyUr7e7ucZST;KtHYim*^O zH%d?>bqeNyjo9D63e2d@xk;let7n=@;O?3S{T$lN@F6G6T5yul2Y*{U&tNy(d6~?+x%SF`9C8M;5FX zV`ojWzMI&b!$?~w%1d&j=zh5JHCP5W1MziWT0vfldpkci{85_?&*Xa0*h}tq?ha=c zkraR8|NPwl^Z9pC4e0Z$eJ{?{zyqZo2Z|F;1JQ8ybXE2@;s9bZqiDYqXk}pl10X06 zwN>JMF1@21KnKYE_uEnc83w8f>g>L;>L=ZdpJc3KI_o(;6T|=_2R>v~Na%(AwlPM5 z=FIH|9G^lP0&jq1I1dIkD~K1yz1#9TI)$Ppwt8caH|Av zuVri!AEgm@ut9&FEJgLx?Bv@}QvfHo=;_yy*C5~yJbgDT*KsU$bW8*O?gl$Q?T^eW zT0E7-egr{Fz=oSQLQIoezXZ1G(aGbt=7+YP)qAg=O=@Z|;;=dgqg%%yj9CaA zhOsg5zS8p9HRx&S;pw-lf8OooY8x2T3KIA6-#nBH4FSfto%>OU7THa_p@QTd(3l-c zbrPZ5dUzUIn051)GO$QHU!fmhCVcp%KP3TPBJAKUp8rOAmN^n^RItqVzqi~a8HmBg z4*RR?fK24sCWu3}xK5w{mZnK+HhkmrYho^_vGQgo(nR>MZgywpzExHIlkR1&&nGl3 z7IB+WjJgq#B_;{(U$0gI0M*L>$NvEZ4+_Q2qPh)J#V-D;NAW}`VHnH<vKDp)#@gZX(GOf=Zskv(j0*LnMprmKlv)c)+I=2O4 z$C`>f!AwCam2XqR)ds{Usi?O5AGR4AWE?!WC%VvaxpD);(40lFp<4`>Kvc`9rq5_` z0K*i#*U>SvWe@hxQ#$#;575%L>9d2Qj|Du_TYj>H?^07zepn0w{|iQ!((i8x(u~$mZ!Ln+lG{{M%2W0((Ly zU{3;edhqQrpj61Y4#495c0Zu5nHJE+gO*+^CN{k5@+(+gFuBs!xb>UIb$zT{sg8ph zB}TKGk!DXUdlKyKzI{?<3-i_Z;;ttP17w_Elv0gxizZik#K@8*^H{3q=Oa*I+&BvPs8#lh@mjpP8RuL6QFK z8N=Gf#u0E!xkljjfKuq`3nmT&wb4eY$0`xe!XM)T`2SsocJs|iU8Cv0%Q#yxXh2aEaIMb zyVih_W`TavEdo3zm-J5iFAE~fG6Bs?z;8GmSA3)-`Sdt6OMqSk&ClDcwl^rqvy5O# zDA}^nvQ`s6e|2@>ZNIe7yN#968oM5Zl3c9eX9shWKI6hr9)KF%Auqq=XR50k`r=fZ z*5iTB+ThU8@>GHW<6lo27|60e#4^%r`~kLYR>ZB{p9hX~>{fMLU(Ui{qP{8Rk@v;5 zt{?=QG{#?DQ+qAPs*!2m;)TDDCw})&{jaK^3yj>#MLo-eGgy=ktCUDfSltyhNnxo> z0pVhxhi!0autO`}FXlP_QV-1c4QgNJ5MYz?G3{7$GL`!}D3XnVdD7(u`1T4#0v>{B ziA`z$nH3AKQXBDA$|g`W$$8laGGcbYn0iUZ%x0xa@ve*?^q(tZU4(6?61X{!BqWE} z)$Va<+@X&LKzXbVT>0aS+qpKkUa{C9y5V;J>DhhxLPE?b6Nv808)Vt%3E>SngLlXl^54AS@pzkV1X94oBcTT0D>ijga`C8}5*)JCF+ochd1`VVVShA@uf&n>_6k z)h2oRO@rr{1^Gw??FRPY=3uua{ z7NZ;IM_G)yH8w>IUXhbp<^*ZAeZj5B1D1;y(1Q!@;Bc>CJe_bWPnQunqbs*h-!LnR!)*~j-h0xGwF<8UWi0Q8ye?ro68@H|e;D^s6FchITC99|TR zVSJvZu`NFY;09x!p-dF3s}R&QmjYZ!EC}e62;KiQ0XG8z{Ez*0CcKs}n{!>K{+h_Q zQc?yCj8DyHcEuqDAR3|PAKnu6^e977N;x+$U9o0xLva3oKt?b7s~1W`ntWn8bI|VUWQ!<(B8}q%IYepkNTEI1i;*WXi6)z z_{9%79sHq#xv?=4s$o%oq!88g;xAwM*VAn;YP6oOcA*1pT&$X<4bYa_T-Q*qBmf{w zN*Mdz3n==|57qn2$1+8}TFV#iV{Er>Vngpb-ZKJecF}zI?%lyLYp+az`-eH+h%km_ zuUoqDnK|JARDg3Ot%U~xOSt*gP0(k1?Yqpt=~k(097jM|?`+@eimd>+MX?JVO*QB~ z9J)fC_vs~`25G`M>zyUIEbaSFv8v1EmVujiE))^behqxrJmN4!3&T$U>%xZI#AN`l z+O~KBSkkn)ZqfLMG8l-LztWQgV28p1On)S@1+4>BV8nx+)(@&XXv$qP@ruT@Gl1<80Osjry(B*1p3D48sClK5BO>BT7FV0bT?hEIr~0!~pDT3PRcd#wj*`;3)oUwmcp%Ll(2ZGMp`n zZL&XOp!j(A!8iJh+4THOMUYzzrs2mjoy=gGxIkh;Oavb>fnP6>A=(Z;Si*{mjpDkI zdIx+64W)>kZf-?ZS>=o)o^Sn3cv&Sm?T@#0;1wEs(kA&2DRhy-?Eq2RJ%K+BAPQs3 z{}-YhszvPVwH-1-ylDF@lPCP~J+`xQronD_;7#o7|Lf~A|NHynf3E-hs@ART TciaNrmxnY|bm3J>Hpu@2nnq-u literal 0 HcmV?d00001 From b11e821e503aa09419ac3c9e694a98cee5dc4d12 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 12:52:52 -0700 Subject: [PATCH 19/23] Update tvm-weaknesses.md --- .../threat-protection/microsoft-defender-atp/tvm-weaknesses.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md index 2023cb789b..f61552e03d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-weaknesses.md @@ -32,8 +32,8 @@ You can see the list of vulnerabilities in three ways: *Vulnerabilities in global search* 1. Click the global search drop-down menu. +2. Select **Vulnerability** and key-in the Common Vulnerabilities and Exposures (CVE) ID that you are looking for, then click the search icon. The **Weaknesses** page opens with the CVE information that you are looking for. ![tvm-vuln-globalsearch](images/tvm-vuln-globalsearch.png) -2. Select **Vulnerability** and key-in the Common Vulnerabilities and Exposures (CVE) ID that you are looking for, then click the search icon. The **Weaknesses** page opens with the CVE information that you are looking for. 3. Select the CVE and a fly-in page opens up with more information - the vulnerability description, exploits available, severity level, CVSS v3 rating, publishing and update dates. >[!NOTE] From 826270a82c3502b8cfd14b4812fbe9af1a03b0ec Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 13:17:08 -0700 Subject: [PATCH 20/23] Added references to sec rec and soft inv --- .../microsoft-defender-atp/investigate-machines.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md index 5cdc7994a1..c026aa3f0a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-machines.md @@ -142,13 +142,13 @@ You can also use the [Artifact timeline](investigate-alerts.md#artifact-timeline ### Security recommendations -**Security recommendations** are generated from Microsoft Defender ATP's [Threat & Vulnerability Management](tvm-dashboard-insights.md) capability. Selecting a recommendation will show a panel where you can view relevant details such as description of the recommendation and the potential risks associated with not enacting it. +**Security recommendations** are generated from Microsoft Defender ATP's [Threat & Vulnerability Management](tvm-dashboard-insights.md) capability. Selecting a recommendation will show a panel where you can view relevant details such as description of the recommendation and the potential risks associated with not enacting it. See [Security recommendation](tvm-security-recommendation.md) for details. ![Image of security recommendations tab](images/security-recommendations-machine.png) ### Software inventory -The **Software inventory** section lets you view software on the device, along with any weaknesses or threats. Selecting the name of the software will take you to the software details page where you can view security recommendations, discovered vulnerabilities, installed machines, and version distribution. +The **Software inventory** section lets you view software on the device, along with any weaknesses or threats. Selecting the name of the software will take you to the software details page where you can view security recommendations, discovered vulnerabilities, installed machines, and version distribution. See [Software inventory](tvm-software-inventory.md) for details ![Image of software inventory tab](images/software-inventory-machine.png) @@ -166,3 +166,5 @@ The **Discovered vulnerabilities** section shows the name, severity, and threat - [Investigate an IP address associated with a Microsoft Defender ATP alert](investigate-ip.md) - [Investigate a domain associated with a Microsoft Defender ATP alert](investigate-domain.md) - [Investigate a user account in Microsoft Defender ATP](investigate-user.md) +- [Security recommendation](tvm-security-recommendation.md) +- [Software inventory](tvm-software-inventory.md) From 56d8a90c9078415de2ea1062c006d186c1f373ba Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 13:46:52 -0700 Subject: [PATCH 21/23] Added link to investigating machines --- .../microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md index df7b502201..2b96925862 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md +++ b/windows/security/threat-protection/microsoft-defender-atp/threat-and-vuln-mgt-scenarios.md @@ -71,7 +71,7 @@ To lower down your threat and vulnerability exposure: 3. Click **Installed machines** and select the affected machine from the list to open the flyout page with the relevant machine details, exposure and risk levels, alert and incident activities. ![details in software page ](images/tvm_software_page_details.png) -4. Click **Open machine page** to connect to the machine and apply the selected recommendation. ![details in machine page](images/tvm_machine_page_details.png) +4. Click **Open machine page** to connect to the machine and apply the selected recommendation. See [Investigate machines in the Microsoft Defender ATP Machines list](investigate-machines.md) for details. ![details in machine page](images/tvm_machine_page_details.png) 5. Allow a few hours for the changes to propagate in the system. From 6e574ebb7431dfeb7caa9865f036a5d9d49104d7 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 13:50:35 -0700 Subject: [PATCH 22/23] Spelled out MDATP --- .../microsoft-defender-atp/tvm-dashboard-insights.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md index 09f93ef186..ad5cac9f06 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md +++ b/windows/security/threat-protection/microsoft-defender-atp/tvm-dashboard-insights.md @@ -61,7 +61,7 @@ Area | Description (3) Threat & Vulnerability Management dashboard | Access the **Exposure score**, **Configuration score**, **Exposure distribution**, **Top security recommendations**, **Top vulnerable software**, **Top remediation activities**, and **Top exposed machines**. **Selected machine groups (#/#)** | Filter the Threat & Vulnerability Management data that you want to see in the dashboard and widgets by machine groups. What you select in the filter will be applied throughout the Threat & Vulnerability management pages only. **Organization Exposure score** | See the current state of your organization’s device exposure to threats and vulnerabilities. Several factors affect your organization’s exposure score: weaknesses discovered in your devices, likelihood of your devices to be breached, value of the devices to your organization, and relevant alerts discovered with your devices. The goal is to lower down your organization’s exposure score to be more secure. To reduce the score, you need to remediate the related security configuration issues listed in the security recommendations. -**MDATP Configuration score** | See the security posture of your organization’s operating system, applications, network, accounts and security controls. The goal is to increase your configuration score by remediating the related security configuration issues. You can click the bars and it will take you to the **Security recommendation** page for details. See [Configuration score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score) for more information. +**Microsoft Defender ATP Configuration score** | See the security posture of your organization’s operating system, applications, network, accounts and security controls. The goal is to increase your configuration score by remediating the related security configuration issues. You can click the bars and it will take you to the **Security recommendation** page for details. See [Configuration score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configuration-score) for more information. **Machine exposure distribution** | See how many machines are exposed based on their exposure level. You can click the sections in the doughnut chart and it will take you to the **Machines list** page where you'll see the affected machine names, exposure level side by side with risk level, among other details such as domain, OS platform, its health state, when it was last seen, and its tags. **Top security recommendations** | See the collated security recommendations which are sorted and prioritized based on your organization’s risk exposure and the urgency that it requires. Useful icons also quickly calls your attention on possible active alerts ![possible active alert](images/tvm_alert_icon.png), associated public exploits ![threat insight](images/tvm_bug_icon.png), and recommendation insights ![recommendation insight](images/tvm_insight_icon.png). You can drill down on the security recommendation to see the potential risks, list of exposed machines, and read the insights. Thus, providing you with an informed decision to either proceed with a remediation request. Click **Show more** to see the rest of the security recommendations in the list. **Top vulnerable software** | Get real-time visibility into the organizational software inventory, with stack-ranked list of vulnerable software installed on your network’s devices and how they impact on your organizational exposure score. Click each item for details or **Show more** to see the rest of the vulnerable application list in the **Software inventory** page. From dfe2338d802296189db2d313a0b04c86c20573b8 Mon Sep 17 00:00:00 2001 From: Dulce Montemayor Date: Thu, 27 Jun 2019 14:03:35 -0700 Subject: [PATCH 23/23] Fixed acrolinx issues --- .../configuration-score.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md index 6a43319dd1..0cb4397945 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configuration-score.md @@ -21,12 +21,12 @@ ms.date: 04/11/2019 **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -[!include[Prerelease information](prerelease.md)] +[!Include[Prerelease information](prerelease.md)] >[!NOTE] -> Secure score is now part of Threat & Vulnerability Management as Configuration score. We’ll keep the secure score page available for a few weeks. View the [Secure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score) page. +> Secure score is now part of Threat & Vulnerability Management as Configuration score. The secure score page will be available for a few weeks. View the [Secure score](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/overview-secure-score) page. -The Microsoft Defender Advanced Threat Protection Configuration score gives you visibility and control over your organization's security posture based on security best practices. +The Microsoft Defender Advanced Threat Protection Configuration score gives you visibility and control over the security posture of your organization based on security best practices. Your configuration score widget shows the collective security configuration state of your machines across the following categories: - Application @@ -37,18 +37,18 @@ Your configuration score widget shows the collective security configuration stat ## How it works -What you'll see in the configuration score widget is the product of meticulous and ongoing vulnerability discovery process aggregated with configuration discovery assessments that continuously: +The data in the configuration score widget is the product of meticulous and ongoing vulnerability discovery process aggregated with configuration discovery assessments that continuously: - Compare collected configurations to the collected benchmarks to discover misconfigured assets - Map configurations to vulnerabilities that can be remediated or partially remediated (risk reduction) by remediating the misconfiguration - Collect and maintain best practice configuration benchmarks (vendors, security feeds, internal research teams) - Collect and monitor changes of security control configuration state from all assets -From the widget, you'd be able to see which security aspect require attention. You can click the configuration score categories and it will take you to the **Security recommendations** page to see more details and understand the context of the issue. From there, you can take action based on security benchmarks. +From the widget, you'd be able to see which security aspect requires attention. You can click the configuration score categories and it will take you to the **Security recommendations** page to see more details and understand the context of the issue. From there, you can act on them based on security benchmarks. ## Improve your configuration score -The goal is to improve your configuration score by remediating the issues in the security recommendations list. You can filter the view based on: -- **Related component** - **Accounts**, **Application**, **Network**, **OS**, or **Security controls** -- **Remediation type** - **Configuration change** or **Software update** +The goal is to remediate the issues in the security recommendations list to improve your configuration score. You can filter the view based on: +- **Related component** — **Accounts**, **Application**, **Network**, **OS**, or **Security controls** +- **Remediation type** — **Configuration change** or **Software update** ## Related topics - [Risk-based Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)