mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 21:37:22 +00:00
Merged PR 3017: Add ATP preview topics
Add ATP preview topics
This commit is contained in:
Joey Caparas
commit
f80cb2694a
@ -6,17 +6,20 @@
|
||||
### [Data storage and privacy](windows-defender-atp\data-storage-privacy-windows-defender-advanced-threat-protection.md)
|
||||
### [Assign user access to the portal](windows-defender-atp\assign-portal-access-windows-defender-advanced-threat-protection.md)
|
||||
### [Onboard endpoints and set up access](windows-defender-atp\onboard-configure-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure endpoints](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure client endpoints](windows-defender-atp\configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure endpoints using Group Policy](windows-defender-atp\configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure endpoints using System Security Configuration Manager](windows-defender-atp\configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure endpoints using Mobile Device Management tools](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
###### [Configure endpoints using Microsoft Intune](windows-defender-atp\configure-endpoints-mdm-windows-defender-advanced-threat-protection.md#configure-endpoints-using-microsoft-intune)
|
||||
##### [Configure endpoints using a local script](windows-defender-atp\configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure proxy and Internet settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
##### [Configure non-persistent virtual desktop infrastructure (VDI) machines](windows-defender-atp\configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure server endpoints](windows-defender-atp\configure-server-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
#### [Configure proxy and Internet connectivity settings](windows-defender-atp\configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
#### [Troubleshoot onboarding issues](windows-defender-atp\troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
### [Portal overview](windows-defender-atp\portal-overview-windows-defender-advanced-threat-protection.md)
|
||||
### [Use the Windows Defender ATP portal](windows-defender-atp\use-windows-defender-advanced-threat-protection.md)
|
||||
#### [View the Dashboard](windows-defender-atp\dashboard-windows-defender-advanced-threat-protection.md)
|
||||
#### [View the Security operations dashboard](windows-defender-atp\dashboard-windows-defender-advanced-threat-protection.md)
|
||||
#### [View the Security analytics dashboard](windows-defender-atp\security-analytics-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
#### [View and organize the Alerts queue](windows-defender-atp\alerts-queue-windows-defender-advanced-threat-protection.md)
|
||||
#### [Investigate alerts](windows-defender-atp\investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
##### [Alert process tree](windows-defender-atp\investigate-alerts-windows-defender-advanced-threat-protection.md#alert-process-tree)
|
||||
@ -27,17 +30,22 @@
|
||||
#### [Investigate a domain](windows-defender-atp\investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
#### [View and organize the Machines list](windows-defender-atp\machines-view-overview-windows-defender-advanced-threat-protection.md)
|
||||
#### [Investigate machines](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
##### [Search for specific alerts](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-alerts)
|
||||
##### [Filter events from a specific date](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date)
|
||||
##### [Export machine timeline events](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events)
|
||||
##### [Navigate between pages](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages)
|
||||
##### [Alerts related to this machine](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#alerts-related-to-this-machine)
|
||||
##### [Machine timeline](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#machine-timeline)
|
||||
###### [Search for specific events](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#search-for-specific-events)
|
||||
###### [Filter events from a specific date](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#filter-events-from-a-specific-date)
|
||||
###### [Export machine timeline events](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events)
|
||||
###### [Navigate between pages](windows-defender-atp\investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages)
|
||||
#### [Investigate a user account](windows-defender-atp\investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
#### [Manage alerts](windows-defender-atp\manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
#### [Take response actions](windows-defender-atp\response-actions-windows-defender-advanced-threat-protection.md)
|
||||
##### [Take response actions on a machine](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md)
|
||||
###### [Manage machine group and tags](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#manage-machine-group-and-tags)
|
||||
###### [Collect investigation package](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package)
|
||||
###### [Run antivirus scan](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#run-windows-defender-antivirus-scan-on-machines)
|
||||
###### [Restrict app execution](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#restict-app-execution)
|
||||
###### [Isolate machines from the network](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network)
|
||||
###### [Undo machine isolation](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#undo-machine-isolation)
|
||||
###### [Collect investigation package](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#collect-investigation-package)
|
||||
###### [Check activity details in Action center](windows-defender-atp\respond-machine-alerts-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
|
||||
##### [Take response actions on a file](windows-defender-atp\respond-file-alerts-windows-defender-advanced-threat-protection.md)
|
||||
###### [Stop and quarantine files in your network](windows-defender-atp\respond-file-alerts-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network)
|
||||
@ -63,6 +71,7 @@
|
||||
#### [Python code examples](windows-defender-atp\python-example-code-windows-defender-advanced-threat-protection.md)
|
||||
#### [Experiment with custom threat intelligence alerts](windows-defender-atp\experiment-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
#### [Troubleshoot custom threat intelligence issues](windows-defender-atp\troubleshoot-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
### [Check sensor state](windows-defender-atp\check-sensor-status-windows-defender-advanced-threat-protection.md)
|
||||
#### [Fix unhealthy sensors](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
|
||||
##### [Inactive machines](windows-defender-atp\fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines)
|
||||
@ -74,12 +83,12 @@
|
||||
#### [Configure email notifications](windows-defender-atp\configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
#### [Enable SIEM integration](windows-defender-atp\enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
#### [Enable Threat intel API](windows-defender-atp\enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
#### [Create and build Power BI reports using Windows Defender ATP data](windows-defender-atp\powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
### [Windows Defender ATP settings](windows-defender-atp\settings-windows-defender-advanced-threat-protection.md)
|
||||
### [Windows Defender ATP service health](windows-defender-atp\service-status-windows-defender-advanced-threat-protection.md)
|
||||
### [Troubleshoot Windows Defender ATP](windows-defender-atp\troubleshoot-windows-defender-advanced-threat-protection.md)
|
||||
### [Review events and errors on endpoints with Event Viewer](windows-defender-atp\event-error-codes-windows-defender-advanced-threat-protection.md)
|
||||
### [Windows Defender Antivirus compatibility](windows-defender-atp\defender-compatibility-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
## [Windows Defender Antivirus in Windows 10](windows-defender-antivirus\windows-defender-antivirus-in-windows-10.md)
|
||||
### [Windows Defender AV in the Windows Defender Security Center app](windows-defender-antivirus\windows-defender-security-center-antivirus.md)
|
||||
|
||||
|
||||
@ -10,7 +10,9 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Turn on advanced features in Windows Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
@ -21,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Depending on the Microsoft security products that you use, some advanced features might be available for you to integrate Windows Defender ATP with.
|
||||
|
||||
Turn on the following advanced features to get better protected from potentially malicious files and gain better insight during security investigations:
|
||||
@ -32,7 +36,7 @@ If your organization satisfies these conditions, the feature is enabled by defau
|
||||
|
||||
## Show user details
|
||||
When you enable this feature, you'll be able to see user details stored in Azure Active Directory including a user's picture, name, title, and department information when investigating user account entities. You can find user account information in the following views:
|
||||
- Dashboard
|
||||
- Security operations dashboard
|
||||
- Alert queue
|
||||
- Machine details page
|
||||
|
||||
@ -57,3 +61,4 @@ When you enable this feature, you'll be able to incorporate data from Office 365
|
||||
- [Configure email notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
- [Create and build Power BI reports](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# View and organize the Windows Defender Advanced Threat Protection Alerts queue
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The **Alerts queue** shows a list of alerts that were flagged from endpoints in your network. Alerts are displayed in queues according to their current status. In each queue, you'll see details such as the severity of alerts and the number of machines the alerts were raised on.
|
||||
|
||||
Alerts are organized in queues by their workflow status or assignment:
|
||||
@ -30,6 +33,7 @@ Alerts are organized in queues by their workflow status or assignment:
|
||||
- **In progress**
|
||||
- **Resolved**
|
||||
- **Assigned to me**
|
||||
- **Suppression rules**
|
||||
|
||||
To see a list of alerts, click any of the queues under the **Alerts queue** option in the navigation pane.
|
||||
|
||||
@ -112,13 +116,14 @@ Select multiple alerts (Ctrl or Shift select) and manage or edit alerts together
|
||||
|
||||
|
||||
## Related topics
|
||||
- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md)
|
||||
- [View the Windows Defender Advanced Threat Protection Security operations dashboard](dashboard-windows-defender-advanced-threat-protection.md)
|
||||
- [View the Windows Defender Advanced Threat Protection Security analytics dashboard](security-analytics-dashboard-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a file associated with a Windows Defender ATP alert](investigate-files-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate an IP address associated with a Windows Defender ATP alert](investigate-ip-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a domain associated with a Windows Defender ATP alert](investigate-domain-windows-defender-advanced-threat-protection.md)
|
||||
- [View and organize the Windows Defender ATP Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Windows Defender ATP Machines view](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [View and organize the Windows Defender ATP Machines list](machines-view-overview-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate machines in the Windows Defender ATP Machines list](investigate-machines-windows-defender-advanced-threat-protection.md)
|
||||
- [Investigate a user account in Windows Defender ATP](investigate-user-windows-defender-advanced-threat-protection.md)
|
||||
- [Manage Windows Defender Advanced Threat Protection alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
|
||||
- [Take response actions in Windows Defender ATP](response-actions-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Windows Defender ATP alert API fields
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Understand what data fields are exposed as part of the alerts API and how they map to the Windows Defender ATP portal.
|
||||
|
||||
|
||||
@ -273,7 +276,7 @@ Field numbers match the numbers in the images below.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Assign user access to the Windows Defender ATP portal
|
||||
@ -23,6 +24,8 @@ ms.localizationpriority: high
|
||||
- Office 365
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender ATP users and access permissions are managed in Azure Active Directory (AAD). Use the following methods to assign security roles.
|
||||
|
||||
## Assign user access using Azure PowerShell
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Check the health state of the sensor in Windows Defender ATP
|
||||
description: Check the sensor health on machines to identify which ones are misconfigured, inactive, or are not reporting sensor data.
|
||||
keywords: sensor, sensor health, misconfigured, inactive, no sensor data, sensor data, impaired communication, communication
|
||||
keywords: sensor, sensor health, misconfigured, inactive, no sensor data, sensor data, impaired communications, communication
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Check sensor health state in Windows Defender ATP
|
||||
@ -22,6 +23,7 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The sensor health tile provides information on the individual endpoint’s ability to provide sensor data and communicate with the Windows Defender ATP service. It reports how many machines require attention and helps you identify problematic machines and take action to correct known issues.
|
||||
|
||||
@ -49,7 +51,7 @@ You can filter the health state list by the following status:
|
||||
- **Inactive** - Machines that have stopped reporting to the Windows Defender ATP service.
|
||||
- **Misconfigured** - These machines might partially be reporting sensor data to the Windows Defender ATP service but have configuration errors that need to be corrected. Misconfigured machines can have either one or a combination of the following issues:
|
||||
- **No sensor data** - Machines has stopped sending sensor data. Limited alerts can be triggered from the machine.
|
||||
- **Impaired communication** - Ability to communicate with machine is impaired. Sending files for deep analysis, blocking files, isolating machine from network and other actions that require communication with the machine may not work.
|
||||
- **Impaired communications** - Ability to communicate with machine is impaired. Sending files for deep analysis, blocking files, isolating machine from network and other actions that require communication with the machine may not work.
|
||||
|
||||
You can view the machine details when you click on a misconfigured or inactive machine. You’ll see more specific machine information when you click the information icon.
|
||||
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Configure HP ArcSight to pull Windows Defender ATP alerts
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You'll need to install and configure some files and tools to use HP ArcSight so that it can pull Windows Defender ATP alerts.
|
||||
|
||||
## Before you begin
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Configure email notifications in Windows Defender ATP
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can configure Windows Defender ATP to send email notifications to specified recipients for new alerts. This feature enables you to identify a group of individuals who will immediately be informed and can act on alerts based on their severity.
|
||||
|
||||
> [!NOTE]
|
||||
@ -74,3 +77,4 @@ This section lists various issues that you may encounter when using email notifi
|
||||
- [Turn on the preview experience in Windows Defender ATP](preview-settings-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
- [Create and build Power BI reports](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Configure endpoints using Group Policy
|
||||
@ -23,13 +24,16 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
> [!NOTE]
|
||||
> To use Group Policy (GP) updates to deploy the package, you must be on Windows Server 2008 R2 or later.
|
||||
|
||||
## Onboard endpoints
|
||||
1. Open the GP configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
a. Click **Endpoint management** on the **Navigation pane**.
|
||||
a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
|
||||
|
||||
b. Select **Group Policy**, click **Download package** and save the .zip file.
|
||||
|
||||
@ -49,6 +53,7 @@ ms.localizationpriority: high
|
||||
|
||||
9. Click **OK** and close any open GPMC windows.
|
||||
|
||||
|
||||
## Additional Windows Defender ATP configuration settings
|
||||
For each endpoint, you can state whether samples can be collected from the endpoint when a request is made through the Windows Defender ATP portal to submit a file for deep analysis.
|
||||
|
||||
@ -150,4 +155,5 @@ With Group Policy there isn’t an option to monitor deployment of policies on t
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Configure endpoints using Mobile Device Management tools
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can use mobile device management (MDM) solutions to configure endpoints. Windows Defender ATP supports MDMs by providing OMA-URIs to create policies to manage endpoints.
|
||||
|
||||
For more information on using Windows Defender ATP CSP see, [WindowsAdvancedThreatProtection CSP](https://msdn.microsoft.com/library/windows/hardware/mt723296(v=vs.85).aspx) and [WindowsAdvancedThreatProtection DDF file](https://msdn.microsoft.com/library/windows/hardware/mt723297(v=vs.85).aspx).
|
||||
@ -106,7 +109,7 @@ Configuration for onboarded machines: telemetry reporting frequency | ./Device/V
|
||||
|
||||
1. Open the Microsoft Intune configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
a. Select **Endpoint management** > **Client management** on the **Navigation pane**.
|
||||
a. Select **Endpoint management** > **Clients** on the **Navigation pane**.
|
||||
|
||||
b. Select **Mobile Device Management/Microsoft Intune** > **Download package** and save the .zip file.
|
||||
|
||||
@ -203,4 +206,5 @@ Health Status for offboarded machines: Onboarding State | ./Device/Vendor/MSFT/W
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Configure endpoints using System Center Configuration Manager
|
||||
@ -23,6 +24,8 @@ ms.localizationpriority: high
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
- System Center 2012 Configuration Manager or later versions
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
<span id="sccm1606"/>
|
||||
## Configure endpoints using System Center Configuration Manager (current branch) version 1606
|
||||
System Center Configuration Manager (SCCM) (current branch) version 1606, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see [Support for Windows Defender Advanced Threat Protection service](https://go.microsoft.com/fwlink/p/?linkid=823682).
|
||||
@ -169,4 +172,5 @@ For more information about System Center Configuration Manager Compliance see [C
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Configure endpoints using a local script
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can also manually onboard individual endpoints to Windows Defender ATP. You might want to do this first when testing the service before you commit to onboarding all endpoints in your network.
|
||||
|
||||
> [!NOTE]
|
||||
@ -121,4 +124,5 @@ Monitoring can also be done directly on the portal, or by using the different de
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
@ -0,0 +1,82 @@
|
||||
---
|
||||
title: Configure non-persistent virtual desktop infrastructure (VDI) machines
|
||||
description: Deploy the configuration package on virtual desktop infrastructure (VDI) machine so that they are onboarded to Windows Defender ATP the service.
|
||||
keywords: configure virtual desktop infrastructure (VDI) machine, vdi, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Configure non-persistent virtual desktop infrastructure (VDI) machines
|
||||
|
||||
**Applies to:**
|
||||
- Virtual desktop infrastructure (VDI) machines
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Onboard non-persistent virtual desktop infrastructure (VDI) machines
|
||||
|
||||
Windows Defender ATP supports non-persistent VDI session onboarding. There might be associated challenges when onboarding VDIs. The following are typical challenges for this scenario:
|
||||
|
||||
|
||||
- Instant early onboarding of a short living session
|
||||
- A session should be onboarded to Windows Defender ATP prior to the actual provisioning
|
||||
|
||||
- Machine name persistence
|
||||
- The machine names are typically reused for new sessions. One may ask to have them as a single machine entry while others may prefer to have multiple entries per machine name.
|
||||
|
||||
You can onboard VDI machines using a single entry or multiple entries for each machine. The following steps will guide you through onboarding VDI machines and will highlight steps for single and multiple entries.
|
||||
|
||||
1. Open the VDI configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the [Windows Defender ATP portal](https://securitycenter.windows.com/):
|
||||
|
||||
a. Click **Endpoint management** > **Clients** on the **Navigation pane**.
|
||||
|
||||
b. Select **VDI onboarding scripts for non-persistent endpoints** then click **Download package** and save the .zip file.
|
||||
|
||||
2. Copy the extracted files from the .zip into `golden/master` image under the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. You should have a folder called `WindowsDefenderATPOnboardingPackage` containing the file `WindowsDefenderATPOnboardingScript.cmd`.
|
||||
|
||||
>[!NOTE]
|
||||
>If you don't see the `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup` folder, it might be hidden. You'll need to choose to the **Show hidden files and folders** option from file explorer.
|
||||
|
||||
3. The following step is only applicable if you're implementing a single entry for each machine: <br>
|
||||
**For single entry for each machine**:<br>
|
||||
a. From the `WindowsDefenderATPOnboardingPackage`, copy the `Onboard-NonPersistentMachine.ps1` file to `golden/master` image to the path `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup`. <br>
|
||||
|
||||
>[!NOTE]
|
||||
>If you don't see the `C:\WINDOWS\System32\GroupPolicy\Machine\Scripts\Startup` folder, it might be hidden. You'll need to choose to the **Show hidden files and folders** option from file explorer.
|
||||
|
||||
4. Open a Local Group Policy Editor window and navigate to **Computer Configuration** > **Windows Settings** > **Scripts** > **Startup**.
|
||||
|
||||
5. Depending on the method you'd like to implement, follow the appropriate steps: <br>
|
||||
**For single entry for each machine**:<br>
|
||||
Select the **PowerShell Scripts** tab, then click **Add** (Windows Explorer will open directly in the path where you copied the onboarding script earlier). Navigate to onboarding PowerShell script `Onboard-NonPersistentMachine.ps1`. <br><br>
|
||||
**For multiple entries for each machine**:<br>
|
||||
Select the **Scripts** tab, then click **Add** (Windows Explorer will open directly in the path where you copied the onboarding script earlier). Navigate to the onboarding bash script `WindowsDefenderATPOnboardingScript.cmd`.
|
||||
|
||||
6. Test your solution:
|
||||
|
||||
a. Create a pool with one machine.
|
||||
b. Logon to machine.
|
||||
c. Logoff from machine.
|
||||
d. Logon to machine with another user.
|
||||
e. **For single entry for each machine**: Check only one entry in the Windows Defender ATP portal.<br>
|
||||
**For multiple entries for each machine**: Check multiple entries in the Windows Defender ATP portal.
|
||||
|
||||
7. Click **Machines list** on the Navigation pane.
|
||||
|
||||
8. Use the search function by entering the machine name and select **Machine** as search type.
|
||||
|
||||
## Related topics
|
||||
- [Configure endpoints using Group Policy](configure-endpoints-gp-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshoot Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure Windows Defender ATP endpoints
|
||||
description: Configure endpoints so that they can send sensor data to the Windows Defender ATP sensor.
|
||||
keywords: configure endpoints, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
|
||||
title: Configure Windows Defender ATP client endpoints
|
||||
description: Configure client endpoints so that they can send sensor data to the Windows Defender ATP sensor.
|
||||
keywords: configure client endpoints, endpoint management, configure Windows ATP endpoints, configure Windows Defender Advanced Threat Protection endpoints
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -10,9 +10,10 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Configure Windows Defender ATP endpoints
|
||||
# Configure Windows Defender ATP client endpoints
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Endpoints in your organization must be configured so that the Windows Defender ATP service can get sensor data from them. There are various methods and deployment tools that you can use to configure the endpoints in your organization.
|
||||
|
||||
Windows Defender ATP supports the following deployment tools and methods:
|
||||
@ -38,3 +41,4 @@ Topic | Description
|
||||
[Configure endpoints using System Center Configuration Manager](configure-endpoints-sccm-windows-defender-advanced-threat-protection.md) | You can use either use System Center Configuration Manager (current branch) version 1606 or System Center Configuration Manager(current branch) version 1602 or earlier to deploy the configuration package on endpoints.
|
||||
[Configure endpoints using Mobile Device Management tools](configure-endpoints-mdm-windows-defender-advanced-threat-protection.md) | Use Mobile Device Managment tools or Microsoft Intune to deploy the configuration package on endpoints.
|
||||
[Configure endpoints using a local script](configure-endpoints-script-windows-defender-advanced-threat-protection.md) | Learn how to use the local script to deploy the configuration package on endpoints.
|
||||
[Configure non-persistent virtual desktop infrastructure (VDI) machines](configure-endpoints-vdi-windows-defender-advanced-threat-protection.md) | Learn how to use the configuration package to configure VDI machines.
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -23,6 +24,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Windows Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
|
||||
The embedded Windows Defender ATP sensor runs in system context using the LocalSystem account. The sensor uses Microsoft Windows HTTP Services (WinHTTP) to enable communication with the Windows Defender ATP cloud service.
|
||||
|
||||
@ -0,0 +1,87 @@
|
||||
---
|
||||
title: Configure Windows Defender ATP server endpoints
|
||||
description: Configure server endpoints so that they can send sensor data to the Windows Defender ATP sensor.
|
||||
keywords: configure server endpoints, server, server onboarding, endpoint management, configure Windows ATP server endpoints, configure Windows Defender Advanced Threat Protection server endpoints
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: mjcaparas
|
||||
localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Configure Windows Defender ATP server endpoints
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Windows Defender ATP extends support to also include the Windows Server operating system, providing advanced attack detection and investigation capabilities, seamlessly through the Windows Defender Security Center console.
|
||||
|
||||
Windows Defender ATP supports the onboarding of the following servers:
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2016
|
||||
|
||||
## Onboard server endpoints
|
||||
|
||||
To onboard your servers to Windows Defender ATP, you’ll need to:
|
||||
|
||||
- Turn on server monitoring from the Windows Defender Security Center portal.
|
||||
- If you're already leveraging System Center Operations Manager (SCOM) or Operations Management Suite (OMS), simply attach the Microsoft Monitoring Agent (MMA) to report to your Windows Defender ATP workspace through [Multi Homing support](https://blogs.technet.microsoft.com/msoms/2016/05/26/oms-log-analytics-agent-multi-homing-support/). Otherwise, install and configure MMA to report sensor data to Windows Defender ATP as instructed below.
|
||||
|
||||
|
||||
### Turn on Server monitoring from the Windows Defender Security Center portal
|
||||
|
||||
1. In the navigation pane, select **Endpoint management** > **Server management**.
|
||||
|
||||
2. Click **Turn on server monitoring** and confirm that you'd like to proceed with the environment set up. When the set up completes, the **Workspace ID** and **Workspace key** fields are populated with unique values. You'll need to use these values to configure the MMA agent.
|
||||
|
||||
|
||||
|
||||
|
||||
### Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP
|
||||
|
||||
1. Download the agent setup file: [Windows 64-bit agent](https://go.microsoft.com/fwlink/?LinkId=828603).
|
||||
|
||||
2. Using the Workspace ID and Workspace key provided in the previous procedure, choose any of the following installation methods to install the agent on the server:
|
||||
- [Manually install the agent using setup](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-setup) <br>
|
||||
On the **Agent Setup Options** page, choose **Connect the agent to Azure Log Analytics (OMS)**.
|
||||
- [Install the agent using the command line](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-windows-agents#install-the-agent-using-the-command-line) and [configure the agent using a script](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-windows-agents#add-a-workspace-using-a-script).
|
||||
|
||||
3. You'll need to configure proxy settings for the Microsoft Monitoring Agent. For more information, see [Configure proxy settings](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-windows-agents#configure-proxy-settings).
|
||||
|
||||
Once completed, you should see onboarded servers in the portal within an hour.
|
||||
|
||||
### Configure server endpoint proxy and Internet connectivity settings
|
||||
- Each Windows server must be able to connect to the Internet using HTTPS. This connection can be direct, using a proxy, or through the [OMS Gateway](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-oms-gateway).
|
||||
- If a proxy or firewall is blocking all traffic by default and allowing only specific domains through or HTTPS scanning (SSL inspection) is enabled, make sure that the following URLs are white-listed to permit communication with Windows Defender ATP service:
|
||||
|
||||
| Agent Resource | Ports |
|
||||
|------------------------------------|-------------|
|
||||
| *.oms.opinsights.azure.com | 443 |
|
||||
| *.blob.core.windows.net | 443 |
|
||||
| *.azure-automation.net | 443 |
|
||||
| *.ods.opinsights.azure.com | 443 |
|
||||
| winatp-gw-cus.microsoft.com | 443 |
|
||||
| winatp-gw-eus.microsoft.com | 443 |
|
||||
| winatp-gw-neu.microsoft.com | 443 |
|
||||
| winatp-gw-weu.microsoft.com | 443 |
|
||||
|
||||
|
||||
### Offboard server endpoints
|
||||
To offboard the server, you can uninstall the MMA agent from the server or detach it from reporting to your Windows Defender ATP workspace. After offboarding the agent, the server will no longer send sensor data to Windows Defender ATP.
|
||||
For more information, see [To disable an agent](https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-windows-agents#to-disable-an-agent).
|
||||
|
||||
>[!NOTE]
|
||||
>Offboarding causes the server to stop sending sensor data to the portal but data from the server, including reference to any alerts it has had will be retained for up to 6 months.
|
||||
|
||||
## Related topics
|
||||
- [Configure Windows Defender ATP client endpoints](configure-endpoints-windows-defender-advanced-threat-protection.md)
|
||||
- [Configure proxy and Internet connectivity settings](configure-proxy-internet-windows-defender-advanced-threat-protection.md)
|
||||
- [Troubleshooting Windows Defender Advanced Threat Protection onboarding issues](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md)
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Pull alerts to your SIEM tools
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
## Pull alerts using supported security information and events management (SIEM) tools
|
||||
Windows Defender ATP supports (SIEM) tools to pull alerts. Windows Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull alerts from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
|
||||
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Configure Splunk to pull Windows Defender ATP alerts
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You'll need to configure Splunk so that it can pull Windows Defender ATP alerts.
|
||||
|
||||
## Before you begin
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Create custom alerts using the threat intelligence (TI) application program interface (API)
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can define custom alert definitions and indicators of compromise (IOC) using the threat intelligence API. Creating custom threat intelligence alerts allows you to generate specific alerts that are applicable to your organization.
|
||||
|
||||
## Before you begin
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: View the Windows Defender Advanced Threat Protection Dashboard
|
||||
title: View the Windows Defender Advanced Threat Protection Security operations dashboard
|
||||
description: Use the Dashboard to identify machines at risk, keep track of the status of the service, and see statistics and information about machines and alerts.
|
||||
keywords: dashboard, alerts, new, in progress, resolved, risk, machines at risk, infections, reporting, statistics, charts, graphs, health, active malware detections, threat category, categories, password stealer, ransomware, exploit, threat, low severity, active malware
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -10,9 +10,10 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# View the Windows Defender Advanced Threat Protection Dashboard
|
||||
# View the Windows Defender Advanced Threat Protection Security operations dashboard
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -22,7 +23,9 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
The **Dashboard** displays a snapshot of:
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The **Security operations dashboard** displays a snapshot of:
|
||||
|
||||
- The latest active alerts on your network
|
||||
- Daily machines reporting
|
||||
@ -34,7 +37,7 @@ The **Dashboard** displays a snapshot of:
|
||||
|
||||
You can explore and investigate alerts and machines to quickly determine if, where, and when suspicious activities occurred in your network to help you understand the context they appeared in.
|
||||
|
||||
From the **Dashboard** you will see aggregated events to facilitate the identification of significant events or behaviors on a machine. You can also drill down into granular events and low-level indicators.
|
||||
From the **Security operations dashboard** you will see aggregated events to facilitate the identification of significant events or behaviors on a machine. You can also drill down into granular events and low-level indicators.
|
||||
|
||||
It also has clickable tiles that give visual cues on the overall health state of your organization. Each tile opens a detailed view of the corresponding overview.
|
||||
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Windows Defender ATP data storage and privacy
|
||||
@ -22,6 +23,7 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
This section covers some of the most frequently asked questions regarding privacy and data handling for Windows Defender ATP.
|
||||
> [!NOTE]
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Windows Defender compatibility
|
||||
@ -23,6 +24,8 @@ ms.localizationpriority: high
|
||||
- Windows Defender
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
The Windows Defender Advanced Threat Protection agent depends on Windows Defender Antivirus for some capabilities such as file scanning.
|
||||
|
||||
If an onboarded endpoint is protected by a third-party antimalware client, Windows Defender Antivirus on that endpoint will enter into passive mode.
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Enable the custom threat intelligence API in Windows Defender ATP
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Before you can create custom threat intelligence (TI) using REST API, you'll need to set up the custom threat intelligence application through the Windows Defender ATP portal.
|
||||
|
||||
1. In the navigation pane, select **Preference Setup** > **Threat intel API**.
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Enable SIEM integration in Windows Defender ATP
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Enable security information and event management (SIEM) integration so you can pull alerts from the Windows Defender ATP portal using your SIEM solution or by connecting directly to the alerts REST API.
|
||||
|
||||
1. In the navigation pane, select **Preferences setup** > **SIEM integration**.
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
|
||||
@ -24,6 +25,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/library/aa745633(v=bts.10).aspx) on individual endpoints.
|
||||
|
||||
For example, if endpoints are not appearing in the **Machines list** list, you might need to look for event IDs on the endpoints. You can then use this table to determine further troubleshooting steps.
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Experiment with custom threat intelligence (TI) alerts
|
||||
@ -22,6 +23,7 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
With the Windows Defender ATP threat intelligence API, you can create custom threat intelligence alerts that can help you keep track of possible attack activities in your organization.
|
||||
|
||||
|
||||
@ -0,0 +1,72 @@
|
||||
---
|
||||
title: Find machine information by interal IP API
|
||||
description: Use this API to create calls related to finding a machine entry around a specific timestamp by FQDN or interal IP.
|
||||
keywords: apis, graph api, supported apis, find machine, machine information, IP
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/01.2017
|
||||
---
|
||||
|
||||
# Find machine information by interal IP
|
||||
Find a machine entity around a specific timestamp by FQDN or internal IP.
|
||||
|
||||
## Permissions
|
||||
User needs read permissions.
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /testwdatppreview/machines/find(timestamp={time},key={IP/FQDN})
|
||||
```
|
||||
|
||||
## Request headers
|
||||
|
||||
Header | Value
|
||||
:---|:---
|
||||
Authorization | Bearer {token}. **Required**.
|
||||
Content type | application/json
|
||||
|
||||
|
||||
## Request body
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and machine exists - 200 OK.
|
||||
If no machine found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
Request
|
||||
|
||||
Here is an example of the request.
|
||||
|
||||
```
|
||||
GET https://graph.microsoft.com/testwdatppreview/machines/find(timestamp={time},key={IP/FQDN})
|
||||
Content-type: application/json
|
||||
```
|
||||
|
||||
Response
|
||||
|
||||
Here is an example of the response.
|
||||
|
||||
|
||||
```
|
||||
HTTP/1.1 200 OK
|
||||
Content-type: application/json
|
||||
{
|
||||
"@odata.context": "https://graph.microsoft.com/testwdatppreview/$metadata#Machines",
|
||||
"value": [
|
||||
{
|
||||
"id": "04c99d46599f078f1c3da3783cf5b95f01ac61bb",
|
||||
"computerDnsName": "",
|
||||
"firstSeen": "2017-07-06T01:25:04.9480498Z",
|
||||
"osPlatform": "Windows10",
|
||||
…
|
||||
}
|
||||
```
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Fix unhealthy sensors in Windows Defender ATP
|
||||
description: Fix machine sensors that are reporting as misconfigured or inactive so that the service receives data from the machine.
|
||||
keywords: misconfigured, inactive, fix sensor, sensor health, no sensor data, sensor data, impaired communication, communication
|
||||
keywords: misconfigured, inactive, fix sensor, sensor health, no sensor data, sensor data, impaired communications, communication
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
|
||||
# Fix unhealthy sensors in Windows Defender ATP
|
||||
@ -22,6 +23,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
Machines that are categorized as misconfigured or inactive can be flagged due to varying causes. This section provides some explanations as to what might have caused a machine to be categorized as inactive or misconfigured.
|
||||
|
||||
## Inactive machines
|
||||
@ -41,13 +44,13 @@ Do you expect a machine to be in ‘Active’ status? [Open a support ticket tic
|
||||
|
||||
## Misconfigured machines
|
||||
Misconfigured machines can further be classified to:
|
||||
- Impaired communication
|
||||
- Impaired communications
|
||||
- No sensor data
|
||||
|
||||
### Impaired communication
|
||||
### Impaired communications
|
||||
This status indicates that there's limited communication between the machine and the service.
|
||||
|
||||
The following suggested actions can help fix issues related to a misconfigured machine with impaired communication:
|
||||
The following suggested actions can help fix issues related to a misconfigured machine with impaired communications:
|
||||
|
||||
- [Ensure the endpoint has Internet connection](troubleshoot-onboarding-windows-defender-advanced-threat-protection.md#ensure-the-endpoint-has-an-internet-connection)</br>
|
||||
The Window Defender ATP sensor requires Microsoft Windows HTTP (WinHTTP) to report sensor data and communicate with the Windows Defender ATP service.
|
||||
|
||||
@ -10,6 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 09/05/2017
|
||||
---
|
||||
# Update general Windows Defender ATP settings
|
||||
|
||||
@ -21,6 +22,8 @@ ms.localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
[!include[Prerelease information](prerelease.md)]
|
||||
|
||||
During the onboarding process, a wizard takes you through the general settings of Windows Defender ATP. After onboarding, you might want to update some settings which you'll be able to do through the **Preferences setup** menu.
|
||||
|
||||
1. In the navigation pane, select **Preferences setup** > **General**.
|
||||
@ -39,3 +42,4 @@ During the onboarding process, a wizard takes you through the general settings o
|
||||
- [Configure email notifications in Windows Defender ATP](configure-email-notifications-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md)
|
||||
- [Enable the custom threat intelligence API in Windows Defender ATP](enable-custom-ti-windows-defender-advanced-threat-protection.md)
|
||||
- [Create and build Power BI reports](powerbi-reports-windows-defender-advanced-threat-protection.md)
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 25 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 18 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 67 KiB After Width: | Height: | Size: 48 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 16 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 16 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 49 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 79 KiB After Width: | Height: | Size: 82 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 44 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 21 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 16 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 50 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 59 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 9.4 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 62 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 59 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 73 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 29 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 16 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 26 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 57 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 128 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 57 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 48 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 20 KiB After Width: | Height: | Size: 17 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 26 KiB After Width: | Height: | Size: 12 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 67 KiB After Width: | Height: | Size: 31 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 180 KiB After Width: | Height: | Size: 179 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 79 KiB After Width: | Height: | Size: 106 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 162 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 52 KiB After Width: | Height: | Size: 73 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 36 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 17 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 16 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 100 KiB After Width: | Height: | Size: 43 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 30 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 28 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 90 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 155 KiB After Width: | Height: | Size: 146 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 76 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 17 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 16 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 62 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 32 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 17 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 17 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 13 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 109 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 81 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 124 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 40 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 52 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 72 KiB After Width: | Height: | Size: 70 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 16 KiB After Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 53 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 24 KiB After Width: | Height: | Size: 17 KiB |
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user