mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-15 14:57:23 +00:00
Merge branch 'atp-rs4' of https://cpubwin.visualstudio.com/_git/it-client into atp-rs4
This commit is contained in:
Joey Caparas
commit
f6535a2dae
@ -23,25 +23,25 @@
|
||||
#### [Preview features](windows-defender-atp\preview-windows-defender-advanced-threat-protection.md)
|
||||
#### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md)
|
||||
#### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md)
|
||||
### [Onboard endpoints and set up access](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure client endpoints](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure endpoints using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure endpoints using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure endpoints using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
###### [Configure endpoints using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune)
|
||||
##### [Configure endpoints using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure server endpoints](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure non-Windows endpoints](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
#### [Run a detection test on a newly onboarded endpoint](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
#### [Run simulated attacks](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md)
|
||||
### [Onboard machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
#### [Onboard Windows 10 machines](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard machines using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard machines using System Center Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard machines using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
###### [Onboard machines using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#onboard-windows-10-machines-using-microsoft-intune)
|
||||
##### [Onboard machines using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
##### [Onboard non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
#### [Onboard servers](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
#### [Onboard non-Windows machines](windows-defender-atp\configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
#### [Run a detection test on a newly onboarded machine](windows-defender-atp\run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
#### [Run simulated attacks on machines](windows-defender-atp\attack-simulations-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
#### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
### [Understand the Windows Defender ATP portal](windows-defender-atp\use-windows-defender-advanced-threat-protection.md)
|
||||
#### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md)
|
||||
#### [View the Security operations dashboard](windows-defender-atp\dashboard-windows-defender-advanced-threat-protection.md)
|
||||
#### [View the Secure score dashboard](windows-defender-atp\security-analytics-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
#### [View the Threat analytics dashboard](windows-defender-atp\threat-analytics-windows-defender-advanced-threat-protection.md)
|
||||
#### [View the Secure score dashboard and improve your secure score](windows-defender-atp\security-analytics-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
#### [View the Threat analytics dashboard and take recommended mitigation actions](windows-defender-atp\threat-analytics-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
###Investigate and remediate threats
|
||||
####Alerts queue
|
||||
@ -180,6 +180,7 @@
|
||||
##### [Misconfigured machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines)
|
||||
#### [Check service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md)
|
||||
### [Configure Windows Defender ATP Settings](windows-defender-atp\preferences-setup-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
####General
|
||||
##### [Update data retention settings](windows-defender-atp\general-settings-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure alert notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
@ -187,6 +188,7 @@
|
||||
##### [Enable and create Power BI reports using Windows Defender ATP data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
##### [Enable Secure score security controls](windows-defender-atp\enable-security-analytics-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure advanced features](windows-defender-atp\advanced-features-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
####Permissions
|
||||
##### [Manage portal access using RBAC](windows-defender-atp\rbac-windows-defender-advanced-threat-protection.md)
|
||||
##### [Create machine groups](windows-defender-atp\machine-groups-windows-defender-advanced-threat-protection.md)
|
||||
@ -199,15 +201,17 @@
|
||||
##### [Manage suppression rules](windows-defender-atp\manage-suppression-rules-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation exclusion lists](windows-defender-atp\manage-automation-exclusion-list-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation file uploads](windows-defender-atp\manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
##### [Manage automation folder exclusions](windows-defender-atp\manage-automation-file-uploads-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
####Machine management
|
||||
### [Onboarding machines](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
### [Offboarding machines](windows-defender-atp\offboard-machines-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
#### [Configure Windows Defender ATP time zone settings](windows-defender-atp\settings-windows-defender-advanced-threat-protection.md)
|
||||
### [Configure Windows Defender ATP time zone settings](windows-defender-atp\settings-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
### [Access the Windows Defender ATP Community Center](windows-defender-atp\community-windows-defender-advanced-threat-protection.md)
|
||||
### [Troubleshoot Windows Defender ATP](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
#### [Review events and errors on endpoints with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md)
|
||||
#### [Review events and errors on machines with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md)
|
||||
### [Windows Defender Antivirus compatibility with Windows Defender ATP](windows-defender-atp\defender-compatibility-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
## [Windows Defender Antivirus in Windows 10](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md)
|
||||
|
||||
@ -49,18 +49,18 @@ First, we define a time filter to review only records from the previous day. We
|
||||
Finally, we limit the results to 100 and click **Run query**.
|
||||
|
||||
### Operators
|
||||
The query language is very powerful and has the following usable operators:
|
||||
The query language is very powerful and has a lot of available operators, some of them are -
|
||||
|
||||
- **Limit** - Return up to the specified number of rows.
|
||||
- **Where** - Filter a table to the subset of rows that satisfy a predicate.
|
||||
- **Count** - Return the number of records in the input record set.
|
||||
- **Top** - Return the first N records sorted by the specified columns.
|
||||
- **Project** - Select the columns to include, rename or drop, and insert new computed columns.
|
||||
- **Summarize** - Produce a table that aggregates the content of the input table.
|
||||
- **Extend** - Create calculated columns and append them to the result set.
|
||||
- **Join** - Merge the rows of two tables to form a new table by matching values of the specified column(s) from each table.
|
||||
- **Makeset** - Return a dynamic (JSON) array of the set of distinct values that Expr takes in the group
|
||||
- **Find** - Find rows that match a predicate across a set of tables.
|
||||
- **limit** - Return up to the specified number of rows.
|
||||
- **where** - Filter a table to the subset of rows that satisfy a predicate.
|
||||
- **count** - Return the number of records in the input record set.
|
||||
- **top** - Return the first N records sorted by the specified columns.
|
||||
- **project** - Select the columns to include, rename or drop, and insert new computed columns.
|
||||
- **summarize** - Produce a table that aggregates the content of the input table.
|
||||
- **extend** - Create calculated columns and append them to the result set.
|
||||
- **join** - Merge the rows of two tables to form a new table by matching values of the specified column(s) from each table.
|
||||
- **makeset** - Return a dynamic (JSON) array of the set of distinct values that Expr takes in the group
|
||||
- **find** - Find rows that match a predicate across a set of tables.
|
||||
|
||||
To see a live example of these operators, run them as part of the **Get started** section.
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure Windows Defender ATP endpoints using Group Policy
|
||||
description: Use Group Policy to deploy the configuration package on endpoints so that they are onboarded to the service.
|
||||
keywords: configure endpoints using group policy, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, group policy
|
||||
title: Onboard Windows 10 machines using Group Policy to Windows Defender ATP
|
||||
description: Use Group Policy to deploy the configuration package on Windows 10 machines so that they are onboarded to the service.
|
||||
keywords: configure machines using group policy, machine management, configure Windows ATP machines, onboard Windows Defender Advanced Threat Protection machines, group policy
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -13,7 +13,7 @@ ms.localizationpriority: high
|
||||
ms.date: 04/16/2018
|
||||
---
|
||||
|
||||
# Configure endpoints using Group Policy
|
||||
# Onboard Windows 10 machines using Group Policy
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -33,7 +33,7 @@ ms.date: 04/16/2018
|
||||
> [!NOTE]
|
||||
> To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later.
|
||||
|
||||
## Onboard endpoints
|
||||
## Onboard machines using Group Policy
|
||||
1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
@ -114,8 +114,8 @@ Possible values are:
|
||||
|
||||
The default value in case the registry key doesn’t exist is Normal.
|
||||
|
||||
### Offboard endpoints
|
||||
For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
## Offboard machines using Group Policy
|
||||
For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
@ -124,7 +124,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Offboarding**.
|
||||
|
||||
b. Make you select Windows 10 as the operating system.
|
||||
b. Select Windows 10 as the operating system.
|
||||
|
||||
c. In the **Deployment method** field, select **Group policy**.
|
||||
|
||||
@ -163,9 +163,9 @@ With Group Policy there isn’t an option to monitor deployment of policies on t
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP machines](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure endpoints using Mobile Device Management tools
|
||||
description: Use Mobile Device Management tools to deploy the configuration package on endpoints so that they are onboarded to the service.
|
||||
keywords: configure endpoints using mdm, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, mdm
|
||||
title: Onboard Windows 10 machines using Mobile Device Management tools
|
||||
description: Use Mobile Device Management tools to deploy the configuration package on machines so that they are onboarded to the service.
|
||||
keywords: onboard machines using mdm, endpoint management, onboard Windows ATP machines, onboard Windows Defender Advanced Threat Protection machines, mdm
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -13,7 +13,7 @@ ms.localizationpriority: high
|
||||
ms.date: 04/16/2018
|
||||
---
|
||||
|
||||
# Configure endpoints using Mobile Device Management tools
|
||||
# Onboard Windows 10 machines using Mobile Device Management tools
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -27,7 +27,7 @@ ms.date: 04/16/2018
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink)
|
||||
|
||||
You can use mobile device management (MDM) solutions to configure endpoints. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage endpoints.
|
||||
You can use mobile device management (MDM) solutions to configure machines. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage machines.
|
||||
|
||||
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
|
||||
@ -36,17 +36,17 @@ If you're using Microsoft Intune, you must have the device MDM Enrolled. Otherwi
|
||||
|
||||
For more information on enabling MDM with Microsoft Intune, see [Setup Windows Device Management](https://docs.microsoft.com/intune-classic/deploy-use/set-up-windows-device-management-with-microsoft-intune).
|
||||
|
||||
## Configure endpoints using Microsoft Intune
|
||||
## Onboard machines using Microsoft Intune
|
||||
|
||||
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
|
||||
### Onboard and monitor endpoints using the classic Intune console
|
||||
### Onboard and monitor machines using the classic Intune console
|
||||
|
||||
1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
b. Make you select Windows 10 as the operating system.
|
||||
b. Select Windows 10 as the operating system.
|
||||
|
||||
b. In the **Deployment method** field, select **Mobile Device Management / Microsoft Intune**.
|
||||
|
||||
@ -121,9 +121,8 @@ Configuration for onboarded machines: diagnostic data reporting frequency | ./De
|
||||
|
||||
|
||||
|
||||
### Offboard and monitor endpoints
|
||||
|
||||
For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
## Offboard and monitor machines using Mobile Device Management tools
|
||||
For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
@ -132,7 +131,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Offboarding**.
|
||||
|
||||
b. Make you select Windows 10 as the operating system.
|
||||
b. Select Windows 10 as the operating system.
|
||||
|
||||
b. In the **Deployment method** field, select **Mobile Device Management / Microsoft Intune**.
|
||||
|
||||
@ -160,9 +159,9 @@ Health Status for offboarded machines: Onboarding State | ./Device/Vendor/MSFT/W
|
||||
> Offboarding causes the machine to stop sending sensor data to the portal but data from the machine, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
|
||||
## Related topics
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure non-Windows endpoints in Windows Defender ATP
|
||||
description: Configure non-Winodws endpoints so that they can send sensor data to the Windows Defender ATP service.
|
||||
keywords: configure endpoints non-Windows endpoints, macos, linux, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
|
||||
title: Onboard non-Windows machines to the Windows Defender ATP service
|
||||
description: Configure non-Winodws machines so that they can send sensor data to the Windows Defender ATP service.
|
||||
keywords: onboard non-Windows machines, macos, linux, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -12,7 +12,7 @@ localizationpriority: high
|
||||
ms.date: 04/16/2018
|
||||
---
|
||||
|
||||
# Configure non-Windows endpoints
|
||||
# Onboard non-Windows machines
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -28,8 +28,7 @@ Windows Defender ATP provides a centralized security operations experience for W
|
||||
|
||||
You'll need to know the exact Linux distros and macOS X versions that are compatible with Windows Defender ATP for the integration to work.
|
||||
|
||||
## Onboard non-Windows endpoints
|
||||
You'll need to take the following steps to onboard non-Windows endpoints:
|
||||
You'll need to take the following steps to onboard non-Windows machines:
|
||||
1. Turn on third-party integration
|
||||
2. Run a detection test
|
||||
|
||||
@ -37,7 +36,7 @@ You'll need to take the following steps to onboard non-Windows endpoints:
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Onboarding**. Make sure the third-party solution is listed.
|
||||
|
||||
2. Make you select Mac and Linux as the operating system.
|
||||
2. Select Mac and Linux as the operating system.
|
||||
|
||||
3. Turn on the third-party solution integration.
|
||||
|
||||
@ -54,7 +53,7 @@ Create an EICAR test file by saving the string displayed on the portal in an emp
|
||||
|
||||
The file should trigger a detection and a corresponding alert on Windows Defender ATP.
|
||||
|
||||
### Offboard non-Windows endpoints
|
||||
## Offboard non-Windows machines
|
||||
To effectively offboard the endpoints from the service, you'll need to disable the data push on the third-party portal first then switch the toggle to off in Windows Defender Security Center. The toggle in the portal only blocks the data inbound flow.
|
||||
|
||||
|
||||
@ -68,7 +67,7 @@ To effectively offboard the endpoints from the service, you'll need to disable t
|
||||
>If you decide to turn on the third-party integration again after disabling the integration, you'll need to regenerate the token and reapply it on endpoints.
|
||||
|
||||
## Related topics
|
||||
- [Configure Windows Defender ATP client endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure server endpoints](configure-server-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshooting Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure endpoints using System Center Configuration Manager
|
||||
title: Onboard Windows 10 machines using System Center Configuration Manager
|
||||
description: Use System Center Configuration Manager to deploy the configuration package on endpoints so that they are onboarded to the service.
|
||||
keywords: configure endpoints using sccm, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints, sccm
|
||||
keywords: onboard machines using sccm, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines, sccm
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -13,7 +13,7 @@ ms.localizationpriority: high
|
||||
ms.date: 04/16/2018
|
||||
---
|
||||
|
||||
# Configure endpoints using System Center Configuration Manager
|
||||
# Onboard Windows 10 machines using System Center Configuration Manager
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -29,14 +29,14 @@ ms.date: 04/16/2018
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointssccm-abovefoldlink)
|
||||
|
||||
<span id="sccm1606"/>
|
||||
## Configure endpoints using System Center Configuration Manager (current branch) version 1606
|
||||
## Onboard Windows 10 machines using System Center Configuration Manager (current branch) version 1606
|
||||
System Center Configuration Manager (SCCM) (current branch) version 1606, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see [Support for Windows Defender Advanced Threat Protection service](https://go.microsoft.com/fwlink/p/?linkid=823682).
|
||||
|
||||
>[!NOTE]
|
||||
> If you’re using SCCM client version 1606 with server version 1610 or above, you must upgrade the client version to match the server version.
|
||||
|
||||
<span id="sccm1602"/>
|
||||
## Configure endpoints using System Center Configuration Manager earlier versions
|
||||
## Onboard Windows 10 machines using System Center Configuration Manager earlier versions
|
||||
You can use existing System Center Configuration Manager functionality to create a policy to configure your endpoints. This is supported in the following System Center Configuration Manager versions:
|
||||
|
||||
- System Center 2012 Configuration Manager
|
||||
@ -44,12 +44,13 @@ You can use existing System Center Configuration Manager functionality to create
|
||||
- System Center Configuration Manager (current branch), version 1511
|
||||
- System Center Configuration Manager (current branch), version 1602
|
||||
|
||||
### Onboard endpoints
|
||||
### Onboard machines using System Center Configuration Manager
|
||||
|
||||
|
||||
1. Open the SCCM configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
b. Make you select Windows 10 as the operating system.
|
||||
b. Select Windows 10 as the operating system.
|
||||
|
||||
b. In the **Deployment method** field, select **System Center Configuration Manager 2012/2012 R2/1511/1602**.
|
||||
|
||||
@ -116,9 +117,9 @@ Possible values are:
|
||||
The default value in case the registry key doesn’t exist is Normal.
|
||||
|
||||
|
||||
### Offboard endpoints
|
||||
## Offboard machines using System Center Configuration Manager
|
||||
|
||||
For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
@ -127,11 +128,11 @@ For security reasons, the package used to offboard endpoints will expire 30 days
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Offboarding**.
|
||||
|
||||
b. Make you select Windows 10 as the operating system.
|
||||
b. Select Windows 10 as the operating system.
|
||||
|
||||
b. In the **Deployment method** field, select **System Center Configuration Manager 2012/2012 R2/1511/1602**.
|
||||
c. In the **Deployment method** field, select **System Center Configuration Manager 2012/2012 R2/1511/1602**.
|
||||
|
||||
c. Click **Download package**, and save the .zip file.
|
||||
d. Click **Download package**, and save the .zip file.
|
||||
|
||||
2. Extract the contents of the .zip file to a shared, read-only location that can be accessed by the network administrators who will deploy the package. You should have a file named *WindowsDefenderATPOffboardingScript_valid_until_YYYY-MM-DD.cmd*.
|
||||
|
||||
@ -178,9 +179,9 @@ Value: “1”
|
||||
For more information about System Center Configuration Manager Compliance see [Compliance Settings in Configuration Manager](https://technet.microsoft.com/library/gg681958.aspx).
|
||||
|
||||
## Related topics
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure Windows Defender ATP endpoints using a local script
|
||||
description: Use a local script to deploy the configuration package on endpoints so that they are onboarded to the service.
|
||||
keywords: configure endpoints using a local script, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
|
||||
title: Onboard Windows 10 machines using a local script
|
||||
description: Use a local script to deploy the configuration package on machines so that they are onboarded to the service.
|
||||
keywords: configure machines using a local script, machine management, configure Windows ATP machines, configure Windows Defender Advanced Threat Protection machines
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -13,7 +13,7 @@ ms.localizationpriority: high
|
||||
ms.date: 04/16/2018
|
||||
---
|
||||
|
||||
# Configure endpoints using a local script
|
||||
# Onboard Windows 10 machines using a local script
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -32,12 +32,12 @@ You can also manually onboard individual endpoints to Windows Defender ATP. You
|
||||
> [!NOTE]
|
||||
> The script has been optimized to be used on a limited number of machines (1-10 machines). To deploy to scale, use other deployment options. For more information on using other deployment options, see [Configure Windows Defender ATP endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
## Onboard endpoints
|
||||
## Onboard machines
|
||||
1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
b. Make you select Windows 10 as the operating system.
|
||||
b. Select Windows 10 as the operating system.
|
||||
|
||||
c. In the **Deployment method** field, select **Local Script**.
|
||||
|
||||
@ -85,8 +85,8 @@ Possible values are:
|
||||
The default value in case the registry key doesn’t exist is 1.
|
||||
|
||||
|
||||
## Offboard endpoints
|
||||
For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
## Offboard machines using a local script
|
||||
For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
|
||||
> [!NOTE]
|
||||
> Onboarding and offboarding policies must not be deployed on the same endpoint at the same time, otherwise this will cause unpredictable collisions.
|
||||
@ -95,7 +95,7 @@ For security reasons, the package used to offboard endpoints will expire 30 days
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Offboarding**.
|
||||
|
||||
b. Make you select Windows 10 as the operating system.
|
||||
b. Select Windows 10 as the operating system.
|
||||
|
||||
c. In the **Deployment method** field, select **Local Script**.
|
||||
|
||||
@ -133,9 +133,9 @@ Monitoring can also be done directly on the portal, or by using the different de
|
||||
|
||||
|
||||
## Related topics
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Configure non-persistent virtual desktop infrastructure (VDI) machines
|
||||
title: Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
description: Deploy the configuration package on virtual desktop infrastructure (VDI) machine so that they are onboarded to Windows Defender ATP the service.
|
||||
keywords: configure virtual desktop infrastructure (VDI) machine, vdi, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -13,7 +13,7 @@ ms.localizationpriority: high
|
||||
ms.date: 04/16/2018
|
||||
---
|
||||
|
||||
# Configure non-persistent virtual desktop infrastructure (VDI) machines
|
||||
# Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
|
||||
**Applies to:**
|
||||
- Virtual desktop infrastructure (VDI) machines
|
||||
@ -42,7 +42,7 @@ You can onboard VDI machines using a single entry or multiple entries for each m
|
||||
|
||||
a. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
b. Make you select Windows 10 as the operating system.
|
||||
b. Select Windows 10 as the operating system.
|
||||
|
||||
c. In the **Deployment method** field, select **VDI onboarding scripts for non-persistent endpoints**.
|
||||
|
||||
@ -82,10 +82,10 @@ You can onboard VDI machines using a single entry or multiple entries for each m
|
||||
8. Use the search function by entering the machine name and select **Machine** as search type.
|
||||
|
||||
## Related topics
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure Windows Defender ATP client endpoints
|
||||
description: Configure client endpoints so that they can send sensor data to the Windows Defender ATP sensor.
|
||||
keywords: configure client endpoints, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
|
||||
title: Onboard Windows 10 machines on Windows Defender ATP
|
||||
description: Onboard Windows 10 machines so that they can send sensor data to the Windows Defender ATP sensor
|
||||
keywords: Onboard Windows 10 machines, group policy, system center configuration manager, mobile device management, local script, gp, sccm, mdm, intune
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -13,7 +13,7 @@ ms.localizationpriority: high
|
||||
ms.date: 04/16/2018
|
||||
---
|
||||
|
||||
# Configure Windows Defender ATP client endpoints
|
||||
# Onboard Windows 10 machines
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -37,11 +37,11 @@ Windows Defender ATP supports the following deployment tools and methods:
|
||||
## In this section
|
||||
Topic | Description
|
||||
:---|:---
|
||||
[Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) | Use Group Policy to deploy the configuration package on endpoints.
|
||||
[Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) | You can use either use System Center Configuration Manager (current branch) version 1606 or System Center Configuration Manager(current branch) version 1602 or earlier to deploy the configuration package on endpoints.
|
||||
[Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) | Use Mobile Device Management tools or Microsoft Intune to deploy the configuration package on endpoints.
|
||||
[Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) | Learn how to use the local script to deploy the configuration package on endpoints.
|
||||
[Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) | Learn how to use the configuration package to configure VDI machines.
|
||||
[Onboard Windows 10 machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md) | Use Group Policy to deploy the configuration package on endpoints.
|
||||
[Onboard Windows 10 machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) | You can use either use System Center Configuration Manager (current branch) version 1606 or System Center Configuration Manager(current branch) version 1602 or earlier to deploy the configuration package on endpoints.
|
||||
[Onboard Windows 10 machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) | Use Mobile Device Management tools or Microsoft Intune to deploy the configuration package on endpoints.
|
||||
[Onboard Windows 10 machines using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) | Learn how to use the local script to deploy the configuration package on endpoints.
|
||||
[Onboard non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) | Learn how to use the configuration package to configure VDI machines.
|
||||
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpoints-belowfoldlink)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure Windows Defender ATP server endpoints
|
||||
description: Configure server endpoints so that they can send sensor data to the Windows Defender ATP sensor.
|
||||
keywords: configure server endpoints, server, server onboarding, endpoint management, configure Windows ATP server endpoints, configure Windows Defender Advanced Threat Protection server endpoints
|
||||
title: Onboard servers to the Windows Defender ATP service
|
||||
description: Onboard servers so that they can send sensor data to the Windows Defender ATP sensor.
|
||||
keywords: onboard server, server, server onboarding, machine management, configure Windows ATP servers, onboard Windows Defender Advanced Threat Protection servers
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -12,7 +12,7 @@ localizationpriority: high
|
||||
ms.date: 04/16/2018
|
||||
---
|
||||
|
||||
# Configure Windows Defender ATP server endpoints
|
||||
# Onboard servers
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -46,7 +46,7 @@ To onboard your servers to Windows Defender ATP, you’ll need to:
|
||||
|
||||
1. In the navigation pane, select **Settings** > **Onboarding**.
|
||||
|
||||
2. Make you select Windows server 2012, 2012R2 and 2016 as the operating system.
|
||||
2. Select Windows server 2012, 2012R2 and 2016 as the operating system.
|
||||
|
||||
3. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
|
||||
@ -105,7 +105,7 @@ You’ll be able to onboard in the same method available for Windows 10 client e
|
||||
|
||||
If the result is ‘The specified service does not exist as an installed service’, then you'll need to install Windows Defender AV. For more information, see [Windows Defender Antivirus in Windows 10](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10).
|
||||
|
||||
### Offboard server endpoints
|
||||
## Offboard servers
|
||||
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Windows Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Windows Defender ATP.
|
||||
For more information, see [To disable an agent](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).
|
||||
|
||||
@ -113,8 +113,8 @@ For more information, see [To disable an agent](https://docs.microsoft.com/en-us
|
||||
>Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
|
||||
## Related topics
|
||||
- [Configure Windows Defender ATP client endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-Windows endpoints](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
- [Onboard Windows 10 machines](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
- [Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshooting Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -26,7 +26,23 @@ ms.date: 04/16/2018
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Create machine groups and set automated remediation levels on them, configure the rules to apply on the group, and assign the group to an Azure AD group and role. After configuring the groups and assignments, rank the group so that the corresponding rule is applied.
|
||||
|
||||
In a typical enterprise scenario, security operation teams are assigned a set of machines groups. These machines are grouped together based on a set of attributes such as domain, name, or tag.
|
||||
|
||||
In Windows Defender ATP, you can create machine groups based on conditions and apply the following rules on them:
|
||||
- Remediation level for automated investigations
|
||||
- Azure Active Directory (Azure AD) user group access
|
||||
|
||||
|
||||
When you create a machine group, you'll need to set the automated remediation level for that group. You'll also need to configure the conditions for when a machine is considered to be part of that group. You can set the conditions based on name, domain, tag, or OS.
|
||||
|
||||
|
||||
After setting the automated remediation level and conditions, you'll need to assign a Azure AD user group who will have access to that group of machines. The assignment you set here determines what the group can see in the portal. For example, if you assign a user group to only see machines with a specific tag then their view of the Machines list will be limited based on the tags you set in the rule.
|
||||
|
||||
|
||||
Finally, you'll need to rank the machine groups so that the appropriate rul is applied on them.
|
||||
|
||||
|
||||
|
||||
### Add machine group
|
||||
|
||||
@ -54,7 +70,7 @@ Create machine groups and set automated remediation levels on them, configure th
|
||||
|
||||
4. Review the result of the preview of matched machines. If you are satisfied with the rules, click the **Access** tab.
|
||||
|
||||
5. Assign the user groups that can access the machine group you created. The assignment you set here determines what the group can see in the portal. For example, if you assign a user group to only see machines with a specific tag then their view of the Machines list will be limited based on the tags you set in the rule.
|
||||
5. Assign the user groups that can access the machine group you created.
|
||||
|
||||
6. Click **Close**.
|
||||
|
||||
@ -62,7 +78,7 @@ Create machine groups and set automated remediation levels on them, configure th
|
||||
|
||||
## Rank rules on machine groups
|
||||
|
||||
After creating groups, setting the remediation levels on them, and assigning user groups that can access the machine group, you’ll need to rank the rules that are applied on the groups.
|
||||
After creating groups based on conditions, setting the remediation levels on them, and assigning user groups that can access the machine group, you’ll need to rank the rules that are applied on the groups.
|
||||
|
||||
You can promote or demote the rank of a group so that the rules applied is of higher or lower level. The evaluation order is applied from higher rank to lower rank. The higher rank should apply to the most machines.
|
||||
|
||||
|
||||
@ -41,9 +41,7 @@ When you configure the exclusion list to identify specific attributes as malicio
|
||||
|
||||
- **Files** - Hash value
|
||||
- **Certificate** - PEM certificate file
|
||||
- **IP address** - IP address
|
||||
- **DNS** - **DNS**
|
||||
- **Email address** - Email address
|
||||
|
||||
|
||||
4. Click **Update rule**.
|
||||
|
||||
|
||||
@ -0,0 +1,76 @@
|
||||
---
|
||||
title: Manage automation folder exclusions
|
||||
description: Add automation folder exclusions to control the files that are excluded from an automated investigation.
|
||||
keywords: manage, automation, exclusion, whitelist, blacklist, block, clean, malicious
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 04/16/2018
|
||||
---
|
||||
|
||||
# Manage automation folder exclusions
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10 Enterprise
|
||||
- Windows 10 Education
|
||||
- Windows 10 Pro
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-automationexclusionfolder-abovefoldlink)
|
||||
|
||||
Automation folder exclusions allow you to specify folders that the automated investigation will skip.
|
||||
|
||||
You can control the following attributes about the folder that you'd like to be skipped:
|
||||
- Folders
|
||||
- Extensions of the files
|
||||
- File names
|
||||
|
||||
|
||||
**Folders**
|
||||
You can specify a folder and its subfolders. You can use wild cards so that all files under the directory is skipped by the automated investigation.
|
||||
|
||||
**Extensions**
|
||||
You can specify the extensions to exclude in a specific directory. The extensions are a way to prevent an attacker from using an excluded folder to hide an exploit. The extensions explicitly define which files to ignore.
|
||||
|
||||
**File names**
|
||||
You can specify the file names that you want to be excluded in a specific directory. The names are a way to prevent an attacker from using an excluded folder to hide an exploit. The names explicitly define which files to ignore.
|
||||
|
||||
|
||||
|
||||
## Add an automation folder exclusion
|
||||
1. In the navigation pane, select **Settings** > **Rules** > **Automation folder exclusions**.
|
||||
|
||||
2. Click **New folder exclusion**.
|
||||
|
||||
3. Enter the folder details:
|
||||
|
||||
- Folder
|
||||
- Extensions
|
||||
- File names
|
||||
- Description
|
||||
|
||||
|
||||
4. Click **Save**.
|
||||
|
||||
## Edit an automation folder exclusion
|
||||
1. In the navigation pane, select **Settings** > **Rules** > **Automation folder exclusions**.
|
||||
|
||||
2. Click **Edit** on the folder exclusion.
|
||||
|
||||
3. Update the details of the rule and click **Save**.
|
||||
|
||||
## Remove an automation folder exclusion
|
||||
1. In the navigation pane, select **Settings** > **Rules** > **Automation folder exclusions**.
|
||||
2. Click **Remove exclusion**.
|
||||
|
||||
|
||||
## Related topics
|
||||
@ -72,7 +72,7 @@ The Windows Defender ATP sensor can utilize up to 5MB daily of bandwidth to com
|
||||
|
||||
For more information on additional proxy configuration settings see, [Configure Windows Defender ATP endpoint proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md) .
|
||||
|
||||
Before you configure endpoints, the diagnostic data service must be enabled. The service is enabled by default in Windows 10.
|
||||
Before you onboard machines, the diagnostic data service must be enabled. The service is enabled by default in Windows 10.
|
||||
|
||||
<span id="telemetry-and-diagnostics-settings" />
|
||||
### Diagnostic data settings
|
||||
|
||||
@ -0,0 +1,46 @@
|
||||
---
|
||||
title: Offboard machines from the Windows Defender ATP service
|
||||
description: Onboard Windows 10 machines, servers, non-Windows machines from the Windows Defender ATP service
|
||||
keywords: offboarding, windows defender advanced threat protection offboarding, windows atp offboarding
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 04/16/2018
|
||||
---
|
||||
|
||||
# Offboard machines from the Windows Defender ATP service
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10 Enterprise
|
||||
- Windows 10 Education
|
||||
- Windows 10 Pro
|
||||
- Windows 10 Pro Education
|
||||
- macOS
|
||||
- Linux
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-offboardmachines-abovefoldlink)
|
||||
|
||||
Follow the corresponding instructions depending on your preferred deployment method.
|
||||
|
||||
## Offboard Windows 10 machines
|
||||
- [Offboard machines using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md#offboard-machines-using-group-policy)
|
||||
- [Offboard machines using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md#offboard-machines-using-system-center-configuration-manager)
|
||||
- [Offboard machines using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#offboard-and-monitor-machines-using-mobile-device-management-tools)
|
||||
|
||||
## Offboard Servers
|
||||
- [Offboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md#offboard-servers)
|
||||
|
||||
## Offboard non-Windows machines
|
||||
- [Offboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md#offboard-non-windows-machines)
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Onboard endpoints and set up the Windows Defender ATP user access
|
||||
description: Set up user access in Azure Active Directory and use Group Policy, SCCM, or do manual registry changes to onboard endpoints to the service.
|
||||
keywords: onboarding, windows defender advanced threat protection onboarding, windows atp onboarding, sccm, group policy, mdm, local script
|
||||
title: Onboard machines to the Windows Defender ATP service
|
||||
description: Onboard Windows 10 machines, servers, non-Windows machines and learn how to run a detection test.
|
||||
keywords: onboarding, windows defender advanced threat protection onboarding, windows atp onboarding, sccm, group policy, mdm, local script, detection test
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -13,7 +13,7 @@ ms.localizationpriority: high
|
||||
ms.date: 04/16/2018
|
||||
---
|
||||
|
||||
# Onboard and set up Windows Defender Advanced Threat Protection
|
||||
# Onboard machines to the Windows Defender ATP service
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -21,6 +21,10 @@ ms.date: 04/16/2018
|
||||
- Windows 10 Education
|
||||
- Windows 10 Pro
|
||||
- Windows 10 Pro Education
|
||||
- macOS
|
||||
- Linux
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
@ -47,7 +51,7 @@ You must configure the signature updates on the Windows Defender ATP endpoints w
|
||||
|
||||
When Windows Defender Antivirus is not the active antimalware in your organization and you use the Windows Defender ATP service, Windows Defender Antivirus goes on passive mode. If your organization has disabled Windows Defender Antivirus through group policy or other methods, machines that are onboarded to Windows Defender ATP must be excluded from this group policy.
|
||||
|
||||
If you are onboarding servers and Windows Defender Antivirus is not the active antimalware on your servers, you shouldn't uninstall Windows Defender Antivirus. You'll need to configure it to run on passive mode. For more information, see [Configure server endpoints](configure-server-endpoints-windows-defender-advanced-threat-protection.md).
|
||||
If you are onboarding servers and Windows Defender Antivirus is not the active antimalware on your servers, you shouldn't uninstall Windows Defender Antivirus. You'll need to configure it to run on passive mode. For more information, see [Onboard server endpoints](configure-server-endpoints-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
|
||||
For more information, see [Windows Defender Antivirus compatibility](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md).
|
||||
@ -56,10 +60,10 @@ For more information, see [Windows Defender Antivirus compatibility](../windows-
|
||||
## In this section
|
||||
Topic | Description
|
||||
:---|:---
|
||||
[Configure client endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn about the tools and methods you can use to configure endpoints in your enterprise.
|
||||
[Configure server endpoints](configure-server-endpoints-windows-defender-advanced-threat-protection.md) | Onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP
|
||||
[Configure non-Windows endpoints](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) | Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the Windows Defender ATP portal and better protect your organization's network. This experience leverages on a third-party security products' sensor data.
|
||||
[Run a detection test on a newly onboarded Windows Defender ATP endpoint](run-detection-test-windows-defender-advanced-threat-protection.md) | Run a script on a newly onboarded endpoint to verify that it is properly reporting to the Windows Defender ATP service.
|
||||
[Onboard machines](configure-endpoints-windows-defender-advanced-threat-protection.md) | You'll need to configure endpoints for it to report to the Windows Defender ATP service. Learn about the tools and methods you can use to configure endpoints in your enterprise.
|
||||
[Onboard servers](configure-server-endpoints-windows-defender-advanced-threat-protection.md) | Onboard Windows Server 2012 R2 and Windows Server 2016 to Windows Defender ATP
|
||||
[Onboard non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md) | Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the Windows Defender ATP portal and better protect your organization's network. This experience leverages on a third-party security products' sensor data.
|
||||
[Run a detection test on a newly onboarded Windows Defender ATP machine](run-detection-test-windows-defender-advanced-threat-protection.md) | Run a script on a newly onboarded endpoint to verify that it is properly reporting to the Windows Defender ATP service.
|
||||
[Configure proxy and Internet settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)| Enable communication with the Windows Defender ATP cloud service by configuring the proxy and Internet connectivity settings.
|
||||
[Troubleshoot onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md) | Learn about resolving issues that might arise during onboarding.
|
||||
|
||||
|
||||
@ -54,7 +54,7 @@ Windows Defender ATP supports the use of Power BI data connectors to enable you
|
||||
- [Use the Windows Defender ATP exposed APIs](exposed-apis-windows-defender-advanced-threat-protection.md)<br>
|
||||
Windows Defender ATP exposes much of the available data and actions using a set of programmatic APIs that are part of the Microsoft Intelligence Security Graph. Those APIs will enable you, to automate workflows and innovate based on Windows Defender ATP capabilities.
|
||||
|
||||
- [Configure non-Windows endpoints](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)<br>
|
||||
- [Configure non-Windows machines](configure-endpoints-non-windows-windows-defender-advanced-threat-protection.md)<br>
|
||||
Windows Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in the Windows Defender ATP portal and better protect your organization's network. This experience leverages on a third-party security products' sensor data.
|
||||
|
||||
- [Access the Windows Defender ATP Community Center](community-windows-defender-advanced-threat-protection.md)<br>
|
||||
|
||||
@ -39,7 +39,7 @@ Tier 1 | **Local security operations team / IT team** <br> This team usually tri
|
||||
Tier 2 | **Regional security operations team** <br> This team can see all the machines for their region and perform remediation actions.
|
||||
Tier 3 | **Global security operations team** <br> This team consists of security experts and are authorized to see and perform all actions from the portal.
|
||||
|
||||
Windows Defender ATP RBAC is designed to support your tier or role model of choice and allows you to have granular control over what roles can see, machines they can access, and actions they can take.
|
||||
Windows Defender ATP RBAC is designed to support your tier or role model of choice and gives you granular control over what roles can see, machines they can access, and actions they can take.
|
||||
|
||||
The implementation of role-based access control in Windows Defender ATP is based on Azure Active Directory (Azure AD) user groups.
|
||||
|
||||
|
||||
@ -53,7 +53,7 @@ If while accessing the Windows Defender ATP portal you get a **Your subscription
|
||||
You can choose to renew or extend the license at any point in time. When accessing the portal after the expiration date a **Your subscription has expired** message will be presented with an option to download the endpoint offboarding package, should you choose to not renew the license.
|
||||
|
||||
> [!NOTE]
|
||||
> For security reasons, the package used to offboard endpoints will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
> For security reasons, the package used to Offboard machines will expire 30 days after the date it was downloaded. Expired offboarding packages sent to an endpoint will be rejected. When downloading an offboarding package you will be notified of the packages expiry date and it will also be included in the package name.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -88,7 +88,7 @@ detect sophisticated cyber-attacks, providing:
|
||||
Topic | Description
|
||||
:---|:---
|
||||
Get started | Learn about the minimum requirements, validate licensing and complete setup, know about preview features, understand data storage and privacy, and how to assign user access to the portal.
|
||||
[Onboard endpoints and set up access](onboard-configure-windows-defender-advanced-threat-protection.md) | Learn about configuring client, server, and non-Windows endpoints. Learn how to run a detection test, configure proxy and Internet connectivity settings, and how to troubleshoot potential onboarding issues.
|
||||
[Onboard endpoints](onboard-configure-windows-defender-advanced-threat-protection.md) | Learn about configuring client, server, and non-Windows machines. Learn how to run a detection test, configure proxy and Internet connectivity settings, and how to troubleshoot potential onboarding issues.
|
||||
[Understand the Windows Defender ATP portal](use-windows-defender-advanced-threat-protection.md) | Understand the Security operations and Secure score dashboard, and how to navigate the portal.
|
||||
Investigate and remediate threats | Investigate alerts, machines, and take response actions to remediate threats.
|
||||
API and SIEM support | Use the supported APIs to pull and create custom alerts, or automate workflows. Use the supported SIEM tools to pull alerts from the Windows Defender ATP portal.
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user