mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-13 13:57:22 +00:00
Merge pull request #4137 from MicrosoftDocs/master
Publish USA Election Day! 11/3/2020 10:30 AM PT
This commit is contained in:
Tina Burden
GitHub
commit
fb67beafdc
@ -20,7 +20,7 @@ This article lists new and updated articles for the Mobile Device Management (MD
|
||||
|
||||
|New or updated article | Description|
|
||||
|--- | ---|
|
||||
| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies<br>- [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)<br>- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)<br>- [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)<br>- [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)<br>- [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)<br>- [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)<br>- [Update/DisableWUfBSafeguards](policy-csp-update.md#update-disablewufbsafeguards)<br>- [WindowsSandbox/AllowAudioInput](policy-csp-windowssandbox.md#windowssandbox-allowaudioinput)<br>- [WindowsSandbox/AllowClipboardRedirection](policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection)<br>- [WindowsSandbox/AllowNetworking](policy-csp-windowssandbox.md#windowssandbox-allownetworking)<br>- [WindowsSandbox/AllowPrinterRedirection](policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection)<br>- [WindowsSandbox/AllowVGPU](policy-csp-windowssandbox.md#windowssandbox-allowvgpu)<br>- [WindowsSandbox/AllowVideoInput](policy-csp-windowssandbox.md#windowssandbox-allowvideoinput) |
|
||||
| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies<br>- [Experience/DisableCloudOptimizedContent](policy-csp-experience.md#experience-disablecloudoptimizedcontent)<br>- [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)<br>- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)<br>- [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)<br>- [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)<br>- [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)<br>- [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled)<br>- [Update/DisableWUfBSafeguards](policy-csp-update.md#update-disablewufbsafeguards)<br>- [WindowsSandbox/AllowAudioInput](policy-csp-windowssandbox.md#windowssandbox-allowaudioinput)<br>- [WindowsSandbox/AllowClipboardRedirection](policy-csp-windowssandbox.md#windowssandbox-allowclipboardredirection)<br>- [WindowsSandbox/AllowNetworking](policy-csp-windowssandbox.md#windowssandbox-allownetworking)<br>- [WindowsSandbox/AllowPrinterRedirection](policy-csp-windowssandbox.md#windowssandbox-allowprinterredirection)<br>- [WindowsSandbox/AllowVGPU](policy-csp-windowssandbox.md#windowssandbox-allowvgpu)<br>- [WindowsSandbox/AllowVideoInput](policy-csp-windowssandbox.md#windowssandbox-allowvideoinput) |
|
||||
|
||||
## September 2020
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
|
||||
|
||||
|New or updated article|Description|
|
||||
|-----|-----|
|
||||
| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 20H2:<br>- [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)<br>- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)<br>- [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)<br>- [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)<br>- [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)<br>- [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled) |
|
||||
| [Policy CSP](policy-configuration-service-provider.md) | Added the following new policies in Windows 10, version 20H2:<br>- [Experience/DisableCloudOptimizedContent](policy-csp-experience.md#experience-disablecloudoptimizedcontent)<br>- [LocalUsersAndGroups/Configure](policy-csp-localusersandgroups.md#localusersandgroups-configure)<br>- [MixedReality/AADGroupMembershipCacheValidityInDays](policy-csp-mixedreality.md#mixedreality-aadgroupmembershipcachevalidityindays)<br>- [MixedReality/BrightnessButtonDisabled](policy-csp-mixedreality.md#mixedreality-brightnessbuttondisabled)<br>- [MixedReality/FallbackDiagnostics](policy-csp-mixedreality.md#mixedreality-fallbackdiagnostics)<br>- [MixedReality/MicrophoneDisabled](policy-csp-mixedreality.md#mixedreality-microphonedisabled)<br>- [MixedReality/VolumeButtonDisabled](policy-csp-mixedreality.md#mixedreality-volumebuttondisabled) |
|
||||
| [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) | Updated the description of the following node:<br>- Settings/AllowWindowsDefenderApplicationGuard |
|
||||
|
||||
## What’s new in MDM for Windows 10, version 2004
|
||||
|
||||
@ -2983,6 +2983,9 @@ The following diagram shows the Policy configuration service provider in tree fo
|
||||
<dd>
|
||||
<a href="./policy-csp-experience.md#experience-configurewindowsspotlightonlockscreen" id="experience-configurewindowsspotlightonlockscreen">Experience/ConfigureWindowsSpotlightOnLockScreen</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-experience.md#experience-disablecloudoptimizedcontent" id="experience-disablecloudoptimizedcontent">Experience/DisableCloudOptimizedContent</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="./policy-csp-experience.md#experience-donotshowfeedbacknotifications" id="experience-donotshowfeedbacknotifications">Experience/DoNotShowFeedbackNotifications</a>
|
||||
</dd>
|
||||
|
||||
@ -7,7 +7,7 @@ ms.prod: w10
|
||||
ms.technology: windows
|
||||
author: manikadhiman
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 09/27/2019
|
||||
ms.date: 11/02/2020
|
||||
ms.reviewer:
|
||||
manager: dansimp
|
||||
---
|
||||
@ -73,6 +73,9 @@ manager: dansimp
|
||||
<dd>
|
||||
<a href="#experience-configurewindowsspotlightonlockscreen">Experience/ConfigureWindowsSpotlightOnLockScreen</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#experience-disablecloudoptimizedcontent">Experience/DisableCloudOptimizedContent</a>
|
||||
</dd>
|
||||
<dd>
|
||||
<a href="#experience-donotshowfeedbacknotifications">Experience/DoNotShowFeedbackNotifications</a>
|
||||
</dd>
|
||||
@ -1155,6 +1158,76 @@ The following list shows the supported values:
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="experience-disablecloudoptimizedcontent"></a>**Experience/DisableCloudOptimizedContent**
|
||||
|
||||
<!--SupportedSKUs-->
|
||||
<table>
|
||||
<tr>
|
||||
<th>Windows Edition</th>
|
||||
<th>Supported?</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Home</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>9</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<!--/SupportedSKUs-->
|
||||
<hr/>
|
||||
|
||||
<!--Scope-->
|
||||
[Scope](./policy-configuration-service-provider.md#policy-scope):
|
||||
|
||||
> [!div class = "checklist"]
|
||||
> * Device
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
This policy setting lets you turn off cloud optimized content in all Windows experiences.
|
||||
|
||||
If you enable this policy setting, Windows experiences that use the cloud optimized content client component will present the default fallback content.
|
||||
|
||||
If you disable or do not configure this policy setting, Windows experiences will be able to use cloud optimized content.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
- GP English name: *Turn off cloud optimized content*
|
||||
- GP name: *DisableCloudOptimizedContent*
|
||||
- GP path: *Windows Components/Cloud Content*
|
||||
- GP ADMX file name: *CloudContent.admx*
|
||||
|
||||
<!--/ADMXMapped-->
|
||||
<!--SupportedValues-->
|
||||
The following list shows the supported values:
|
||||
|
||||
- 0 (default) – Disabled.
|
||||
- 1 – Enabled.
|
||||
|
||||
<!--/SupportedValues-->
|
||||
<!--/Policy-->
|
||||
|
||||
<hr/>
|
||||
|
||||
<!--Policy-->
|
||||
<a href="" id="experience-donotshowfeedbacknotifications"></a>**Experience/DoNotShowFeedbackNotifications**
|
||||
|
||||
|
||||
@ -8,7 +8,7 @@ ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: high
|
||||
audience: ITPro
|
||||
ms.author: daniha
|
||||
ms.author: siosulli
|
||||
author: DaniHalfin
|
||||
manager: dansimp
|
||||
ms.collection: M365-security-compliance
|
||||
|
||||
@ -8,7 +8,7 @@ ms.prod: w10
|
||||
ms.topic: article
|
||||
f1.keywords:
|
||||
- NOCSH
|
||||
ms.author: daniha
|
||||
ms.author: siosulli
|
||||
author: DaniHalfin
|
||||
manager: dansimp
|
||||
audience: itpro
|
||||
|
||||
@ -8,7 +8,7 @@ ms.prod: w10
|
||||
ms.topic: article
|
||||
f1.keywords:
|
||||
- NOCSH
|
||||
ms.author: daniha
|
||||
ms.author: siosulli
|
||||
author: DaniHalfin
|
||||
manager: dansimp
|
||||
audience: itpro
|
||||
|
||||
@ -753,7 +753,7 @@
|
||||
#### [Virus information alliance](intelligence/virus-information-alliance-criteria.md)
|
||||
#### [Microsoft virus initiative](intelligence/virus-initiative-criteria.md)
|
||||
#### [Coordinated malware eradication](intelligence/coordinated-malware-eradication.md)
|
||||
### [Information for developers](intelligence/developer-info.md)
|
||||
### [Information for developers]()
|
||||
#### [Software developer FAQ](intelligence/developer-faq.md)
|
||||
#### [Software developer resources](intelligence/developer-resources.md)
|
||||
|
||||
|
||||
@ -48,7 +48,7 @@
|
||||
|
||||
### [Coordinated malware eradication](coordinated-malware-eradication.md)
|
||||
|
||||
## [Information for developers](developer-info.md)
|
||||
## [Information for developers]()
|
||||
|
||||
### [Software developer FAQ](developer-faq.md)
|
||||
|
||||
|
||||
@ -1,29 +0,0 @@
|
||||
---
|
||||
title: Information for developers
|
||||
ms.reviewer:
|
||||
description: This page provides answers to common questions we receive from software developers and other useful resources
|
||||
keywords: software, developer, faq, dispute, false-positive, classify, installer, software, bundler, blocking
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: ellevin
|
||||
author: levinec
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Information for developers
|
||||
|
||||
Learn about the common questions we receive from software developers and get other developer resources such as detection criteria and file submissions.
|
||||
|
||||
## In this section
|
||||
|
||||
Topic | Description
|
||||
:---|:---
|
||||
[Software developer FAQ](developer-faq.md) | Provides answers to common questions we receive from software developers.
|
||||
[Developer resources](developer-resources.md) | Provides information about how to submit files and the detection criteria. Learn how to check your software against the latest security intelligence and cloud protection from Microsoft.
|
||||
@ -18,21 +18,28 @@ ms.topic: article
|
||||
|
||||
The Virus Information Alliance (VIA) is a public antimalware collaboration program for security software providers, security service providers, antimalware testing organizations, and other organizations involved in fighting cybercrime.
|
||||
|
||||
Members of the VIA program collaborate by exchanging technical information on malicious software with Microsoft, with the goal of improving protection for Microsoft customers.
|
||||
Members of the VIA program collaborate by exchanging technical information on malicious software with Microsoft. The goal is to improve protection for Microsoft customers.
|
||||
|
||||
## Better protection for customers against malware
|
||||
|
||||
The VIA program gives members access to information that will help improve protection for Microsoft customers. For example, the program provides malware telemetry and samples to security product teams to identify gaps in their protection and prioritize new threat coverage.
|
||||
The VIA program gives members access to information that will help them improve protection. For example, the program provides malware telemetry and samples to security teams so they can identify gaps and prioritize new threat coverage.
|
||||
|
||||
Malware prevalence data is provided to antimalware testers to assist them in selecting sample sets and setting scoring criteria that represent the real-world threat landscape. Service organizations, such as a CERT, can leverage our data to help assess the impact of policy changes or to help shut down malicious activity.
|
||||
Malware prevalence data is provided to antimalware testers to assist them in selecting sample sets. The data also helps set scoring criteria that represent the real-world threat landscape. Service organizations, such as a CERT, can leverage our data to help assess the impact of policy changes or to help shut down malicious activity.
|
||||
|
||||
Microsoft is committed to continuous improvement to help reduce the impact of malware on customers. By sharing malware-related information, Microsoft enables members of this community to work towards better protection for customers.
|
||||
|
||||
## Becoming a member of VIA
|
||||
|
||||
Microsoft has well-defined, objective, measurable, and tailored membership criteria for prospective members of the Virus Information Alliance (VIA). The criteria is designed to ensure that Microsoft is able to work with security software providers, security service providers, antimalware testing organizations, and other organizations involved in the fight against cybercrime to protect a broad range of customers.
|
||||
Microsoft has well-defined, objective, measurable, and tailored membership criteria for prospective members of the Virus Information Alliance (VIA).
|
||||
|
||||
Members will receive information to facilitate effective malware detection, deterrence, and eradication. This includes technical information on malware as well as metadata on malicious activity. Information shared through VIA is governed by the VIA membership agreement and a Microsoft non-disclosure agreement, where applicable.
|
||||
The criteria is designed to ensure that Microsoft can work with the following groups to protect a broad range of customers:
|
||||
|
||||
- Security software providers
|
||||
- Security service providers
|
||||
- Antimalware testing organizations
|
||||
- Other organizations involved in the fight against cybercrime
|
||||
|
||||
Members will receive information to facilitate effective malware detection, deterrence, and eradication. This information includes technical information on malware as well as metadata on malicious activity. Information shared through VIA is governed by the VIA membership agreement and a Microsoft non-disclosure agreement, where applicable.
|
||||
|
||||
VIA has an open enrollment for potential members.
|
||||
|
||||
@ -43,11 +50,12 @@ To be eligible for VIA your organization must:
|
||||
1. Be willing to sign a non-disclosure agreement with Microsoft.
|
||||
|
||||
2. Fit into one of the following categories:
|
||||
* Your organization develops antimalware technology that can run on Windows and your organization’s product is commercially available.
|
||||
* Your organization provides security services to Microsoft customers or for Microsoft products.
|
||||
* Your organization publishes antimalware testing reports on a regular basis.
|
||||
* Your organization has a research or response team dedicated to fighting malware to protect your organization, your customers, or the general public.
|
||||
|
||||
- Your organization develops antimalware technology that can run on Windows and your organization’s product is commercially available.
|
||||
- Your organization provides security services to Microsoft customers or for Microsoft products.
|
||||
- Your organization publishes antimalware testing reports on a regular basis.
|
||||
- Your organization has a research or response team dedicated to fighting malware to protect your organization, your customers, or the general public.
|
||||
|
||||
3. Be willing to sign and adhere to the VIA membership agreement.
|
||||
|
||||
If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry).
|
||||
If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). For questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry).
|
||||
|
||||
@ -19,13 +19,13 @@ ms.topic: article
|
||||
|
||||
The Microsoft Virus Initiative (MVI) helps organizations to get their products working and integrated with Windows.
|
||||
|
||||
MVI members receive access to Windows APIs and other technologies including IOAV, AMSI and Cloud files. Members also get malware telemetry and samples and invitations to security related events and conferences.
|
||||
MVI members receive access to Windows APIs and other technologies including IOAV, AMSI, and Cloud files. Members also get malware telemetry and samples and invitations to security-related events and conferences.
|
||||
|
||||
## Become a member
|
||||
|
||||
A request for membership is made by an individual as a representative of an organization that develops and produces antimalware or antivirus technology. Your organization must meet the following eligibility requirements to qualify for the MVI program:
|
||||
You can request membership if you're a representative for an organization that develops and produces antimalware or antivirus technology. Your organization must meet the following requirements to qualify for the MVI program:
|
||||
|
||||
1. Offer an antimalware or antivirus product that is one of the following:
|
||||
1. Offer an antimalware or antivirus product that meets one of the following criteria:
|
||||
|
||||
* Your organization's own creation.
|
||||
* Developed by using an SDK (engine and other components) from another MVI Partner company and your organization adds a custom UI and/or other functionality.
|
||||
@ -34,7 +34,7 @@ A request for membership is made by an individual as a representative of an orga
|
||||
|
||||
3. Be active and have a positive reputation in the antimalware industry.
|
||||
|
||||
* Activity can include participation in industry conferences or being reviewed in an industry standard report such as AV Comparatives, OPSWAT or Gartner.
|
||||
* Activity can include participation in industry conferences or being reviewed in an industry standard report such as AV Comparatives, OPSWAT, or Gartner.
|
||||
|
||||
4. Be willing to sign a non-disclosure agreement (NDA) with Microsoft.
|
||||
|
||||
@ -49,7 +49,7 @@ A request for membership is made by an individual as a representative of an orga
|
||||
Test Provider | Lab Test Type | Minimum Level / Score
|
||||
------------- |---------------|----------------------
|
||||
AV-Comparatives | Real-World Protection Test </br> https://www.av-comparatives.org/testmethod/real-world-protection-tests/ |“Approved” rating from AV Comparatives
|
||||
AV-Test | Must pass tests for Windows. Certifications for Mac and Linux are not accepted </br> https://www.av-test.org/en/about-the-institute/certification/ | Achieve "AV-TEST Certified" (for home users) or "AV-TEST Approved” (for corporate users)
|
||||
AV-Test | Must pass tests for Windows. Certifications for Mac and Linux aren't accepted </br> https://www.av-test.org/en/about-the-institute/certification/ | Achieve "AV-TEST Certified" (for home users) or "AV-TEST Approved” (for corporate users)
|
||||
ICSA Labs | Endpoint Anti-Malware Detection </br> https://www.icsalabs.com/technology-program/anti-virus/criteria |PASS/Certified
|
||||
NSS Labs | Advanced Endpoint Protection AEP 3.0, which covers automatic threat prevention and threat event reporting capabilities </br> https://www.nsslabs.com/tested-technologies/advanced-endpoint-protection/ |“Neutral” rating from NSS
|
||||
SKD Labs | Certification Requirements Product: Anti-virus or Antimalware </br> http://www.skdlabs.com/html/english/ </br> http://www.skdlabs.com/cert/ |SKD Labs Star Check Certification Requirements Pass >= 98.5% with On Demand, On Access and Total Detection tests
|
||||
@ -59,4 +59,4 @@ West Coast Labs | Checkmark Certified </br> http://www.checkmarkcertified.com/sm
|
||||
|
||||
## Apply now
|
||||
|
||||
If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). If you have questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry).
|
||||
If your organization meets these criteria and is interested in joining, [apply for membership now](https://www.microsoft.com/wdsi/alliances/apply-alliance-membership). For questions, [contact us for more information](https://www.microsoft.com/wdsi/alliances/collaboration-inquiry).
|
||||
|
||||
@ -24,7 +24,7 @@ A worm is a type of malware that can copy itself and often spreads through a net
|
||||
|
||||
Worms represent a large category of malware. Different worms use different methods to infect devices. Depending on the variant, they can steal sensitive information, change security settings, send information to malicious hackers, stop users from accessing files, and other malicious activities.
|
||||
|
||||
Jenxcus (also known as Dunihi), Gamarue (also known as Androm), and Bondat have consistently remained at the top of the list of malware that infect users running Microsoft security software. Although these worms share some commonalities, it is interesting to note that they also have distinct characteristics.
|
||||
Jenxcus (also known as Dunihi), Gamarue (also known as Androm), and Bondat have consistently remained at the top of the list of malware that infects users running Microsoft software. Although these worms share some commonalities, it's interesting to note that they also have distinct characteristics.
|
||||
|
||||
* **Jenxcus** has capabilities of not only infecting removable drives but can also act as a backdoor that connects back to its server. This threat typically gets into a device from a drive-by download attack, meaning it's installed when users just visit a compromised web page.
|
||||
|
||||
@ -32,9 +32,9 @@ Jenxcus (also known as Dunihi), Gamarue (also known as Androm), and Bondat have
|
||||
|
||||
* **Bondat** typically arrives through fictitious Nullsoft Scriptable Install System (NSIS), Java installers, and removable drives. When Bondat infects a system, it gathers information about the machine such as device name, Globally Unique Identifier (GUID), and OS build. It then sends that information to a remote server.
|
||||
|
||||
Both Bondat and Gamarue have clever ways of obscuring themselves to evade detection. By hiding what they are doing, they try to avoid detection by security software.
|
||||
Both Bondat and Gamarue have clever ways of obscuring themselves to evade detection. By hiding what they're doing, they try to avoid detection by security software.
|
||||
|
||||
* [**WannaCrypt**](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/WannaCrypt) also deserves a mention here. Unlike older worms that often spread just because they could, modern worms often spread to drop a payload (e.g. ransomware).
|
||||
* [**WannaCrypt**](https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/WannaCrypt) also deserves a mention here. Unlike older worms that often spread just because they could, modern worms often spread to drop a payload (like ransomware).
|
||||
|
||||
This image shows how a worm can quickly spread through a shared USB drive.
|
||||
|
||||
|
||||
@ -30,9 +30,9 @@ ms.topic: article
|
||||
|
||||
Refer to the instructions below to use basic permissions management.
|
||||
|
||||
You can use either of the following:
|
||||
You can use either of the following solutions:
|
||||
- Azure PowerShell
|
||||
- Azure Portal
|
||||
- Azure portal
|
||||
|
||||
For granular control over permissions, [switch to role-based access control](rbac.md).
|
||||
|
||||
@ -42,21 +42,21 @@ You can assign users with one of the following levels of permissions:
|
||||
- Read-only access
|
||||
|
||||
### Before you begin
|
||||
- Install Azure PowerShell. For more information see, [How to install and configure Azure PowerShell](https://azure.microsoft.com/documentation/articles/powershell-install-configure/).<br>
|
||||
- Install Azure PowerShell. For more information, see, [How to install and configure Azure PowerShell](https://azure.microsoft.com/documentation/articles/powershell-install-configure/).<br>
|
||||
|
||||
> [!NOTE]
|
||||
> You need to run the PowerShell cmdlets in an elevated command-line.
|
||||
|
||||
- Connect to your Azure Active Directory. For more information see, [Connect-MsolService](https://msdn.microsoft.com/library/dn194123.aspx).
|
||||
- Connect to your Azure Active Directory. For more information, see, [Connect-MsolService](https://msdn.microsoft.com/library/dn194123.aspx).
|
||||
|
||||
**Full access** <br>
|
||||
Users with full access can log in, view all system information and resolve alerts, submit files for deep analysis, and download the onboarding package.
|
||||
Assigning full access rights requires adding the users to the "Security Administrator" or "Global Administrator" AAD built-in roles.
|
||||
|
||||
**Read only access** <br>
|
||||
Users with read only access can log in, view all alerts, and related information.
|
||||
**Read-only access** <br>
|
||||
Users with read-only access can log in, view all alerts, and related information.
|
||||
They will not be able to change alert states, submit files for deep analysis or perform any state changing operations.
|
||||
Assigning read only access rights requires adding the users to the "Security Reader" AAD built-in role.
|
||||
Assigning read-only access rights requires adding the users to the "Security Reader" Azure AD built-in role.
|
||||
|
||||
Use the following steps to assign security roles:
|
||||
|
||||
@ -64,12 +64,12 @@ Use the following steps to assign security roles:
|
||||
```text
|
||||
Add-MsolRoleMember -RoleName "Security Administrator" -RoleMemberEmailAddress "secadmin@Contoso.onmicrosoft.com"
|
||||
```
|
||||
- For **read only** access, assign users to the security reader role by using the following command:
|
||||
- For **read-only** access, assign users to the security reader role by using the following command:
|
||||
```text
|
||||
Add-MsolRoleMember -RoleName "Security Reader" -RoleMemberEmailAddress "reader@Contoso.onmicrosoft.com"
|
||||
```
|
||||
|
||||
For more information see, [Add or remove group memberships](https://technet.microsoft.com/library/321d532e-407d-4e29-a00a-8afbe23008dd#BKMK_ManageGroups).
|
||||
For more information, see, [Add, or remove group memberships](https://technet.microsoft.com/library/321d532e-407d-4e29-a00a-8afbe23008dd#BKMK_ManageGroups).
|
||||
|
||||
## Assign user access using the Azure portal
|
||||
For more information, see [Assign administrator and non-administrator roles to uses with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal).
|
||||
|
||||
@ -22,9 +22,9 @@ ms.topic: article
|
||||
|
||||
|
||||
* The error codes listed in the following table may be returned by an operation on any of Microsoft Defender ATP APIs.
|
||||
* Note that in addition to the error code, every error response contains an error message which can help resolving the problem.
|
||||
* Note that the message is a free text that can be changed.
|
||||
* At the bottom of the page you can find response examples.
|
||||
* In addition to the error code, every error response contains an error message, which can help resolving the problem.
|
||||
* The message is a free text that can be changed.
|
||||
* At the bottom of the page, you can find response examples.
|
||||
|
||||
Error code |HTTP status code |Message
|
||||
:---|:---|:---
|
||||
@ -40,7 +40,7 @@ MaximumBatchSizeExceeded | BadRequest (400) | Maximum batch size exceeded. Recei
|
||||
MissingRequiredParameter | BadRequest (400) | Parameter {the missing parameter} is missing.
|
||||
OsPlatformNotSupported | BadRequest (400) | OS Platform {the client OS Platform} is not supported for this action.
|
||||
ClientVersionNotSupported | BadRequest (400) | {The requested action} is supported on client version {supported client version} and above.
|
||||
Unauthorized | Unauthorized (401) | Unauthorized (usually invalid or expired authorization header).
|
||||
Unauthorized | Unauthorized (401) | Unauthorized (invalid or expired authorization header).
|
||||
Forbidden | Forbidden (403) | Forbidden (valid token but insufficient permission for the action).
|
||||
DisabledFeature | Forbidden (403) | Tenant feature is not enabled.
|
||||
DisallowedOperation | Forbidden (403) | {the disallowed operation and the reason}.
|
||||
@ -48,11 +48,11 @@ NotFound | Not Found (404) | General Not Found error message.
|
||||
ResourceNotFound | Not Found (404) | Resource {the requested resource} was not found.
|
||||
InternalServerError | Internal Server Error (500) | (No error message, try retry the operation or contact us if it does not resolved)
|
||||
|
||||
## Body parameters are case sensitive
|
||||
## Body parameters are case-sensitive
|
||||
|
||||
The submitted body parameters are currently case sensitive.
|
||||
The submitted body parameters are currently case-sensitive.
|
||||
<br>If you experience an **InvalidRequestBody** or **MissingRequiredParameter** errors, it might be caused from a wrong parameter capital or lower-case letter.
|
||||
<br>It is recommended to go to the requested Api documentation page and check that the submitted parameters match the relevant example.
|
||||
<br>We recommend that you go to the requested API documentation page and check that the submitted parameters match the relevant example.
|
||||
|
||||
## Correlation request ID
|
||||
|
||||
|
||||
@ -35,7 +35,7 @@ ms.topic: article
|
||||
>- [Microsoft Defender ATP Detection](api-portal-mapping.md) is composed from the suspicious event occurred on the Device and its related Alert details.
|
||||
>-The Microsoft Defender ATP Alert API is the latest API for alert consumption and contain a detailed list of related evidence for each alert. For more information, see [Alert methods and properties](alerts.md) and [List alerts](get-alerts.md).
|
||||
|
||||
Microsoft Defender ATP supports security information and event management (SIEM) tools to pull detections. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull detections from your enterprise tenant in Azure Active Directory (AAD) using the OAuth 2.0 authentication protocol for an AAD application that represents the specific SIEM connector installed in your environment.
|
||||
Microsoft Defender ATP supports security information and event management (SIEM) tools to pull detections. Microsoft Defender ATP exposes alerts through an HTTPS endpoint hosted in Azure. The endpoint can be configured to pull detections from your enterprise tenant in Azure Active Directory (Azure AD) using the OAuth 2.0 authentication protocol for an Azure AD application that represents the specific SIEM connector installed in your environment.
|
||||
|
||||
|
||||
Microsoft Defender ATP currently supports the following specific SIEM solution tools through a dedicated SIEM integration model:
|
||||
@ -45,14 +45,14 @@ Microsoft Defender ATP currently supports the following specific SIEM solution t
|
||||
|
||||
Other SIEM solutions (such as Splunk, RSA NetWitness) are supported through a different integration model based on the new Alert API. For more information, view the [Partner application](https://securitycenter.microsoft.com/interoperability/partners) page and select the Security Information and Analytics section for full details.
|
||||
|
||||
To use either of these supported SIEM tools you'll need to:
|
||||
To use either of these supported SIEM tools, you'll need to:
|
||||
|
||||
- [Enable SIEM integration in Microsoft Defender ATP](enable-siem-integration.md)
|
||||
- Configure the supported SIEM tool:
|
||||
- [Configure HP ArcSight to pull Microsoft Defender ATP detections](configure-arcsight.md)
|
||||
- Configure IBM QRadar to pull Microsoft Defender ATP detections For more information, see [IBM Knowledge Center](https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/com.ibm.dsm.doc/c_dsm_guide_MS_Win_Defender_ATP_overview.html?cp=SS42VS_7.3.1).
|
||||
|
||||
For more information on the list of fields exposed in the Detection API see, [Microsoft Defender ATP Detection fields](api-portal-mapping.md).
|
||||
For more information on the list of fields exposed in the Detection API, see, [Microsoft Defender ATP Detection fields](api-portal-mapping.md).
|
||||
|
||||
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ ms.topic: conceptual
|
||||
|
||||
This section covers some of the most frequently asked questions regarding privacy and data handling for Microsoft Defender ATP.
|
||||
> [!NOTE]
|
||||
> This document explains the data storage and privacy details related to Microsoft Defender ATP. For more information related to Microsoft Defender ATP and other products and services like Microsoft Defender Antivirus and Windows 10, see [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=827576). See also [Windows 10 privacy FAQ](https://go.microsoft.com/fwlink/?linkid=827577) for more information.
|
||||
> This document explains the data storage and privacy details related to Microsoft Defender ATP. For more information related to Microsoft Defender ATP and other products and services like Microsoft Defender Antivirus and Windows 10, see [Microsoft Privacy Statement](https://go.microsoft.com/fwlink/?linkid=827576). For more information, see [Windows 10 privacy FAQ](https://go.microsoft.com/fwlink/?linkid=827577).
|
||||
|
||||
## What data does Microsoft Defender ATP collect?
|
||||
|
||||
@ -47,7 +47,7 @@ This data enables Microsoft Defender ATP to:
|
||||
Microsoft does not use your data for advertising.
|
||||
|
||||
## Data protection and encryption
|
||||
The Microsoft Defender ATP service utilizes state of the art data protection technologies which are based on Microsoft Azure infrastructure.
|
||||
The Microsoft Defender ATP service utilizes state-of-the-art data protection technologies, which are based on Microsoft Azure infrastructure.
|
||||
|
||||
There are various aspects relevant to data protection that our service takes care of. Encryption is one of the most critical and it includes data encryption at rest, encryption in flight, and key management with Key Vault. For more information on other technologies used by the Microsoft Defender ATP service, see [Azure encryption overview](https://docs.microsoft.com/azure/security/security-azure-encryption-overview).
|
||||
|
||||
@ -79,20 +79,20 @@ Access to data for services deployed in Microsoft Azure Government data centers
|
||||
|
||||
|
||||
## Is data shared with other customers?
|
||||
No. Customer data is isolated from other customers and is not shared. However, insights on the data resulting from Microsoft processing, and which don’t contain any customer specific data, might be shared with other customers. Each customer can only access data collected from its own organization and generic data that Microsoft provides.
|
||||
No. Customer data is isolated from other customers and is not shared. However, insights on the data resulting from Microsoft processing, and which don’t contain any customer-specific data, might be shared with other customers. Each customer can only access data collected from its own organization and generic data that Microsoft provides.
|
||||
|
||||
## How long will Microsoft store my data? What is Microsoft’s data retention policy?
|
||||
**At service onboarding**<br>
|
||||
You can choose the data retention policy for your data. This determines how long Window Defender ATP will store your data. There’s a flexibility of choosing in the range of 1 month to six months to meet your company’s regulatory compliance needs.
|
||||
You can choose the data retention policy for your data. This determines how long Window Defender ATP will store your data. There’s a flexibility of choosing in the range of one month to six months to meet your company’s regulatory compliance needs.
|
||||
|
||||
**At contract termination or expiration**<br>
|
||||
Your data will be kept and will be available to you while the license is under grace period or suspended mode. At the end of this period, that data will be erased from Microsoft’s systems to make it unrecoverable, no later than 180 days from contract termination or expiration.
|
||||
|
||||
|
||||
## Can Microsoft help us maintain regulatory compliance?
|
||||
Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Microsoft Defender ATP services against their own legal and regulatory requirements. Microsoft Defender ATP has achieved a number of certifications including ISO, SOC, FedRAMP High, and PCI and continues to pursue additional national, regional and industry-specific certifications.
|
||||
Microsoft provides customers with detailed information about Microsoft's security and compliance programs, including audit reports and compliance packages, to help customers assess Microsoft Defender ATP services against their own legal and regulatory requirements. Microsoft Defender ATP has achieved a number of certifications including ISO, SOC, FedRAMP High, and PCI and continues to pursue additional national, regional, and industry-specific certifications.
|
||||
|
||||
By providing customers with compliant, independently-verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run.
|
||||
By providing customers with compliant, independently verified services, Microsoft makes it easier for customers to achieve compliance for the infrastructure and applications they run.
|
||||
|
||||
For more information on the Microsoft Defender ATP certification reports, see [Microsoft Trust Center](https://servicetrust.microsoft.com/).
|
||||
|
||||
|
||||
@ -26,21 +26,21 @@ ms.topic: article
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
This page describes how to create an AAD application to get programmatic access to Microsoft Defender ATP on behalf of your customers.
|
||||
This page describes how to create an Azure Active Directory (Azure AD) application to get programmatic access to Microsoft Defender ATP on behalf of your customers.
|
||||
|
||||
Microsoft Defender ATP exposes much of its data and actions through a set of programmatic APIs. Those APIs will help you automate work flows and innovate based on Microsoft Defender ATP capabilities. The API access requires OAuth2.0 authentication. For more information, see [OAuth 2.0 Authorization Code Flow](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-code).
|
||||
|
||||
In general, you’ll need to take the following steps to use the APIs:
|
||||
- Create a **multi-tenant** AAD application.
|
||||
- Create a **multi-tenant** Azure AD application.
|
||||
- Get authorized(consent) by your customer administrator for your application to access Microsoft Defender ATP resources it needs.
|
||||
- Get an access token using this application.
|
||||
- Use the token to access Microsoft Defender ATP API.
|
||||
|
||||
The following steps with guide you how to create an AAD application, get an access token to Microsoft Defender ATP and validate the token.
|
||||
The following steps with guide you how to create an Azure AD application, get an access token to Microsoft Defender ATP and validate the token.
|
||||
|
||||
## Create the multi-tenant app
|
||||
|
||||
1. Log on to your [Azure tenant](https://portal.azure.com) with user that has **Global Administrator** role.
|
||||
1. Sign in to your [Azure tenant](https://portal.azure.com) with user that has **Global Administrator** role.
|
||||
|
||||
2. Navigate to **Azure Active Directory** > **App registrations** > **New registration**.
|
||||
|
||||
@ -59,15 +59,15 @@ The following steps with guide you how to create an AAD application, get an acce
|
||||
|
||||
4. Allow your Application to access Microsoft Defender ATP and assign it with the minimal set of permissions required to complete the integration.
|
||||
|
||||
- On your application page, click **API Permissions** > **Add permission** > **APIs my organization uses** > type **WindowsDefenderATP** and click on **WindowsDefenderATP**.
|
||||
- On your application page, select **API Permissions** > **Add permission** > **APIs my organization uses** > type **WindowsDefenderATP** and select on **WindowsDefenderATP**.
|
||||
|
||||
- **Note**: WindowsDefenderATP does not appear in the original list. You need to start writing its name in the text box to see it appear.
|
||||
- **Note**: WindowsDefenderATP does not appear in the original list. Start writing its name in the text box to see it appear.
|
||||
|
||||
|
||||
|
||||
### Request API permissions
|
||||
|
||||
To determine which permission you need, please look at the **Permissions** section in the API you are interested to call. For instance:
|
||||
To determine which permission you need, review the **Permissions** section in the API you are interested to call. For instance:
|
||||
|
||||
- To [run advanced queries](run-advanced-query-api.md), select 'Run advanced queries' permission
|
||||
|
||||
@ -75,20 +75,20 @@ The following steps with guide you how to create an AAD application, get an acce
|
||||
|
||||
In the following example we will use **'Read all alerts'** permission:
|
||||
|
||||
Choose **Application permissions** > **Alert.Read.All** > Click on **Add permissions**
|
||||
Choose **Application permissions** > **Alert.Read.All** > select on **Add permissions**
|
||||
|
||||
|
||||
|
||||
|
||||
5. Click **Grant consent**
|
||||
5. Select **Grant consent**
|
||||
|
||||
- **Note**: Every time you add permission you must click on **Grant consent** for the new permission to take effect.
|
||||
- **Note**: Every time you add permission you must select on **Grant consent** for the new permission to take effect.
|
||||
|
||||
|
||||
|
||||
6. Add a secret to the application.
|
||||
|
||||
- Click **Certificates & secrets**, add description to the secret and click **Add**.
|
||||
- Select **Certificates & secrets**, add description to the secret and select **Add**.
|
||||
|
||||
**Important**: After click Add, **copy the generated secret value**. You won't be able to retrieve after you leave!
|
||||
|
||||
@ -96,7 +96,7 @@ The following steps with guide you how to create an AAD application, get an acce
|
||||
|
||||
7. Write down your application ID:
|
||||
|
||||
- On your application page, go to **Overview** and copy the following:
|
||||
- On your application page, go to **Overview** and copy the following information:
|
||||
|
||||
|
||||
|
||||
@ -104,7 +104,7 @@ The following steps with guide you how to create an AAD application, get an acce
|
||||
|
||||
You need your application to be approved in each customer tenant where you intend to use it. This is because your application interacts with Microsoft Defender ATP application on behalf of your customer.
|
||||
|
||||
A user with **Global Administrator** from your customer's tenant need to click the consent link and approve your application.
|
||||
A user with **Global Administrator** from your customer's tenant need to select the consent link and approve your application.
|
||||
|
||||
Consent link is of the form:
|
||||
|
||||
@ -114,7 +114,7 @@ The following steps with guide you how to create an AAD application, get an acce
|
||||
|
||||
Where 00000000-0000-0000-0000-000000000000 should be replaced with your Application ID
|
||||
|
||||
After clicking on the consent link, login with the Global Administrator of the customer's tenant and consent the application.
|
||||
After clicking on the consent link, sign in with the Global Administrator of the customer's tenant and consent the application.
|
||||
|
||||
|
||||
|
||||
@ -123,11 +123,11 @@ The following steps with guide you how to create an AAD application, get an acce
|
||||
- **Done!** You have successfully registered an application!
|
||||
- See examples below for token acquisition and validation.
|
||||
|
||||
## Get an access token examples:
|
||||
## Get an access token example:
|
||||
|
||||
**Note:** to get access token on behalf of your customer, use the customer's tenant ID on the following token acquisitions.
|
||||
**Note:** To get access token on behalf of your customer, use the customer's tenant ID on the following token acquisitions.
|
||||
|
||||
<br>For more details on AAD token, refer to [AAD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds)
|
||||
<br>For more information on AAD token, see [AAD tutorial](https://docs.microsoft.com/azure/active-directory/develop/active-directory-v2-protocols-oauth-client-creds)
|
||||
|
||||
### Using PowerShell
|
||||
|
||||
@ -158,14 +158,14 @@ return $token
|
||||
>The below code was tested with Nuget Microsoft.IdentityModel.Clients.ActiveDirectory
|
||||
|
||||
- Create a new Console Application
|
||||
- Install Nuget [Microsoft.IdentityModel.Clients.ActiveDirectory](https://www.nuget.org/packages/Microsoft.IdentityModel.Clients.ActiveDirectory/)
|
||||
- Install NuGet [Microsoft.IdentityModel.Clients.ActiveDirectory](https://www.nuget.org/packages/Microsoft.IdentityModel.Clients.ActiveDirectory/)
|
||||
- Add the below using
|
||||
|
||||
```
|
||||
using Microsoft.IdentityModel.Clients.ActiveDirectory;
|
||||
```
|
||||
|
||||
- Copy/Paste the below code in your application (do not forget to update the 3 variables: ```tenantId, appId, appSecret```)
|
||||
- Copy/Paste the below code in your application (do not forget to update the three variables: ```tenantId, appId, appSecret```)
|
||||
|
||||
```
|
||||
string tenantId = "00000000-0000-0000-0000-000000000000"; // Paste your own tenant ID here
|
||||
@ -221,7 +221,7 @@ Sanity check to make sure you got a correct token:
|
||||
|
||||
- Choose the API you want to use, for more information, see [Supported Microsoft Defender ATP APIs](exposed-apis-list.md)
|
||||
- Set the Authorization header in the Http request you send to "Bearer {token}" (Bearer is the Authorization scheme)
|
||||
- The Expiration time of the token is 1 hour (you can send more then one request with the same token)
|
||||
- The Expiration time of the token is 1 hour (you can send more than one request with the same token)
|
||||
|
||||
- Example of sending a request to get a list of alerts **using C#**
|
||||
```
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Advanced Hunting with Powershell API Guide
|
||||
title: Advanced Hunting with PowerShell API Guide
|
||||
ms.reviewer:
|
||||
description: Use these code samples, querying several Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) APIs.
|
||||
keywords: apis, supported apis, advanced hunting, query
|
||||
@ -28,7 +28,7 @@ ms.date: 09/24/2018
|
||||
|
||||
Full scenario using multiple APIs from Microsoft Defender ATP.
|
||||
|
||||
In this section we share PowerShell samples to
|
||||
In this section, we share PowerShell samples to
|
||||
- Retrieve a token
|
||||
- Use token to retrieve the latest alerts in Microsoft Defender ATP
|
||||
- For each alert, if the alert has medium or high priority and is still in progress, check how many times the device has connected to suspicious URL.
|
||||
@ -43,15 +43,15 @@ In this section we share PowerShell samples to
|
||||
Set-ExecutionPolicy -ExecutionPolicy Bypass
|
||||
```
|
||||
|
||||
For more details, refer to [PowerShell documentation](https://docs.microsoft.com/powershell/module/microsoft.powershell.security/set-executionpolicy)
|
||||
For more information, see [PowerShell documentation](https://docs.microsoft.com/powershell/module/microsoft.powershell.security/set-executionpolicy)
|
||||
|
||||
## Get token
|
||||
|
||||
Run the below:
|
||||
|
||||
- $tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant)
|
||||
- $appId: ID of your AAD app (the app must have 'Run advanced queries' permission to Microsoft Defender ATP)
|
||||
- $appSecret: Secret of your AAD app
|
||||
- $tenantId: ID of the tenant on behalf of which you want to run the query (that is, the query will be run on the data of this tenant)
|
||||
- $appId: ID of your Azure AD app (the app must have 'Run advanced queries' permission to Microsoft Defender ATP)
|
||||
- $appSecret: Secret of your Azure AD app
|
||||
- $suspiciousUrl: The URL
|
||||
|
||||
|
||||
|
||||
@ -45,8 +45,8 @@ Delegated (work or school account) | User.Read.All | 'Read user profiles'
|
||||
|
||||
>[!Note]
|
||||
> When obtaining a token using user credentials:
|
||||
>- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information)
|
||||
>- Response will include users only if the device is visible to the user, based on device group settings (See [Create and manage device groups](machine-groups.md) for more information)
|
||||
>- The user needs to have at least the following role permission: 'View Data'. For more information, see [Create and manage roles](user-roles.md) )
|
||||
>- Response will include users only if the device is visible to the user, based on device group settings. For more information, see [Create and manage device groups](machine-groups.md).
|
||||
|
||||
## HTTP request
|
||||
```http
|
||||
@ -64,7 +64,7 @@ Authorization | String | Bearer {token}. **Required**.
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and device exist - 200 OK with list of [user](user.md) entities in the body. If device was not found - 404 Not Found.
|
||||
If successful and device exists - 200 OK with list of [user](user.md) entities in the body. If device was not found - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Become a Microsoft Defender ATP partner
|
||||
ms.reviewer:
|
||||
description: Learn the steps and requirements so that you can integrate your solution with Microsoft Defender ATP and be a partner
|
||||
description: Learn the steps and requirements to integrate your solution with Microsoft Defender ATP and be a partner
|
||||
keywords: partner, integration, solution validation, certification, requirements, member, misa, application portal
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -29,7 +29,7 @@ ms.topic: conceptual
|
||||
To become a Microsoft Defender ATP solution partner, you'll need to follow and complete the following steps.
|
||||
|
||||
## Step 1: Subscribe to a Microsoft Defender ATP Developer license
|
||||
Subscribing to the [Microsoft Defender ATP Developer license](https://winatpregistration-prd.trafficmanager.net/Developer/UserAgreement?Length=9) allows you to use a Microsoft Defender ATP tenant with up to 10 devices for developing solutions to integrate with Microsoft Defender ATP.
|
||||
Subscribe to the [Microsoft Defender ATP Developer license](https://winatpregistration-prd.trafficmanager.net/Developer/UserAgreement?Length=9). Subscribing allows you to use a Microsoft Defender ATP tenant with up to 10 devices to developing solutions that integrate with Microsoft Defender ATP.
|
||||
|
||||
## Step 2: Fulfill the solution validation and certification requirements
|
||||
The best way for technology partners to certify that their integration works is to have a joint customer approve the suggested integration design (the customer can use the **Recommend a partner** option in the [Partner Application page](https://securitycenter.microsoft.com/interoperability/partners) in the Microsoft Defender Security Center) and have it tested and demoed to the Microsoft Defender ATP team.
|
||||
@ -42,16 +42,16 @@ Once the Microsoft Defender ATP team has reviewed and approves the integration,
|
||||
## Step 4: Get listed in the Microsoft Defender ATP partner application portal
|
||||
Microsoft Defender ATP supports third-party applications discovery and integration using the in-product [partner page](partner-applications.md) that is embedded within the Microsoft Defender ATP management portal.
|
||||
|
||||
To have your company listed as a partner in the in-product partner page, you will need to provide the following:
|
||||
To have your company listed as a partner in the in-product partner page, you will need to provide the following information:
|
||||
|
||||
1. A square logo (SVG).
|
||||
2. Name of the product to be presented.
|
||||
3. Provide a 15-word product description.
|
||||
4. Link to the landing page for the customer to complete the integration or blog post that will include sufficient information for customers. Please note that any press release including the Microsoft Defender ATP product name should be reviewed by the marketing and engineering teams. You should allow at least 10 days for review process to be performed.
|
||||
5. If you use a multi-tenant Azure AD approach, we will need the AAD application name to track usage of the application.
|
||||
6. We'd like to request that you include the User-Agent field in each API call made to Microsoft Defender ATP public set of APIs or Graph Security APIs. This will be used for statistical purposes, troubleshooting, and partner recognition. In addition, this step is a requirement for membership in Microsoft Intelligent Security Association (MISA).
|
||||
4. Link to the landing page for the customer to complete the integration or blog post that will include sufficient information for customers. Any press release including the Microsoft Defender ATP product name should be reviewed by the marketing and engineering teams. Wait for at least 10 days for the review process to be done.
|
||||
5. If you use a multi-tenant Azure AD approach, we will need the Azure AD application name to track usage of the application.
|
||||
6. Include the User-Agent field in each API call made to Microsoft Defender ATP public set of APIs or Graph Security APIs. This will be used for statistical purposes, troubleshooting, and partner recognition. In addition, this step is a requirement for membership in Microsoft Intelligent Security Association (MISA).
|
||||
Follow these steps:
|
||||
1. Identify a name adhering to the following nomenclature that includes your company name and the Microsoft Defender ATP integrated product with the version of the product that includes this integration.
|
||||
1. Identify a name adhering to the following nomenclature that includes your company name and the Microsoft Defender ATP-integrated product with the version of the product that includes this integration.
|
||||
- ISV Nomenclature: `MdatpPartner-{CompanyName}-{ProductName}/{Version}`
|
||||
- Security partner Nomenclature: `MdatpPartner-{CompanyName}-{ProductName}/{TenantID}`
|
||||
|
||||
@ -59,7 +59,7 @@ To have your company listed as a partner in the in-product partner page, you wil
|
||||
For more information, see [RFC 2616 section-14.43](https://tools.ietf.org/html/rfc2616#section-14.43). For example, User-Agent: `MdatpPartner-Contoso-ContosoCognito/1.0.0`
|
||||
|
||||
|
||||
Partnership with Microsoft Defender ATP help our mutual customers to further streamline, integrate, and orchestrate defenses. We are happy that you chose to become a Microsoft Defender ATP partner and to achieve our common goal of effectively protecting customers and their assets by preventing and responding to modern threats together.
|
||||
Partnerships with Microsoft Defender ATP help our mutual customers to further streamline, integrate, and orchestrate defenses. We are happy that you chose to become a Microsoft Defender ATP partner and to achieve our common goal of effectively protecting customers and their assets by preventing and responding to modern threats together.
|
||||
|
||||
## Related topics
|
||||
- [Technical partner opportunities](partner-integration.md)
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Get user related alerts API
|
||||
title: Get user-related alerts API
|
||||
description: Retrieve a collection of alerts related to a given user ID using Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP).
|
||||
keywords: apis, graph api, supported apis, get, user, related, alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -16,7 +16,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get user related alerts API
|
||||
# Get user-related alerts API
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
@ -46,7 +46,7 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'
|
||||
|
||||
>[!Note]
|
||||
> When obtaining a token using user credentials:
|
||||
>- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information)
|
||||
>- The user needs to have at least the following role permission: 'View Data'. For more information, see [Create and manage roles](user-roles.md).
|
||||
>- Response will include only alerts, associated with devices, that the user have access to, based on device group settings (See [Create and manage device groups](machine-groups.md) for more information)
|
||||
|
||||
## HTTP request
|
||||
@ -54,7 +54,7 @@ Delegated (work or school account) | Alert.ReadWrite | 'Read and write alerts'
|
||||
GET /api/users/{id}/alerts
|
||||
```
|
||||
|
||||
**Note that the id is not the full UPN, but only the user name. (e.g., to retrieve alerts for user1@contoso.com use /api/users/user1/alerts)**
|
||||
**The ID is not the full UPN, but only the user name. (for example, to retrieve alerts for user1@contoso.com use /api/users/user1/alerts)**
|
||||
|
||||
## Request headers
|
||||
|
||||
@ -67,7 +67,7 @@ Authorization | String | Bearer {token}. **Required**.
|
||||
Empty
|
||||
|
||||
## Response
|
||||
If successful and user exist - 200 OK. If the user do not exist - 404 Not Found.
|
||||
If successful and user exists - 200 OK. If the user does not exist - 404 Not Found.
|
||||
|
||||
|
||||
## Example
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Get user related machines API
|
||||
description: Learn how to use the Get user related machines API to retrieve a collection of devices related to a user ID in Microsoft Defender Advanced Threat Protection.
|
||||
title: Get user-related machines API
|
||||
description: Learn how to use the Get user-related machines API to retrieve a collection of devices related to a user ID in Microsoft Defender Advanced Threat Protection.
|
||||
keywords: apis, graph api, supported apis, get, user, user related alerts
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
ms.prod: w10
|
||||
@ -16,7 +16,7 @@ ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Get user related machines API
|
||||
# Get user-related machines API
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
@ -46,15 +46,15 @@ Delegated (work or school account) | Machine.ReadWrite | 'Read and write machine
|
||||
|
||||
>[!Note]
|
||||
> When obtaining a token using user credentials:
|
||||
>- The user needs to have at least the following role permission: 'View Data' (See [Create and manage roles](user-roles.md) for more information)
|
||||
>- Response will include only devices that the user can access, based on device group settings (See [Create and manage device groups](machine-groups.md) for more information)
|
||||
>- The user needs to have at least the following role permission: 'View Data'. For more information, see [Create and manage roles](user-roles.md) )
|
||||
>- Response will include only devices that the user can access, based on device group settings. For more information, see [Create and manage device groups](machine-groups.md).
|
||||
|
||||
## HTTP request
|
||||
```
|
||||
GET /api/users/{id}/machines
|
||||
```
|
||||
|
||||
**Note that the id is not the full UPN, but only the user name. (e.g., to retrieve machines for user1@contoso.com use /api/users/user1/machines)**
|
||||
**The ID is not the full UPN, but only the user name. (for example, to retrieve machines for user1@contoso.com use /api/users/user1/machines)**
|
||||
|
||||
|
||||
## Request headers
|
||||
|
||||
@ -68,7 +68,8 @@ Select **Investigations** to see all the automatic investigations launched by th
|
||||
|
||||
|
||||
## Going through the evidence
|
||||
Microsoft Defender Advanced Threat Protection automatically investigates all the incidents' supported events and suspicious entities in the alerts, providing you with auto-response and information about the important files, processes, services, and more. This helps quickly detect and block potential threats in the incident.
|
||||
Microsoft Defender Advanced Threat Protection automatically investigates all the incidents' supported events and suspicious entities in the alerts, providing you with autoresponse and information about the important files, processes, services, and more.
|
||||
|
||||
Each of the analyzed entities will be marked as infected, remediated, or suspicious.
|
||||
|
||||
|
||||
@ -81,7 +82,7 @@ The **Graph** tells the story of the cybersecurity attack. For example, it shows
|
||||
|
||||
|
||||
|
||||
You can click the circles on the incident graph to view the details of the malicious files, associated file detections, how many instances has there been worldwide, whether it’s been observed in your organization, if so, how many instances.
|
||||
You can click the circles on the incident graph to view the details of the malicious files, associated file detections, how many instances have there been worldwide, whether it’s been observed in your organization, if so, how many instances.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -59,7 +59,7 @@ lastExternalIpAddress | String | Last IP through which the [machine](machine.md)
|
||||
healthStatus | Enum | [machine](machine.md) health status. Possible values are: "Active", "Inactive", "ImpairedCommunication", "NoSensorData" and "NoSensorDataImpairedCommunication"
|
||||
rbacGroupName | String | Machine group Name.
|
||||
rbacGroupId | Int | Machine group unique ID.
|
||||
riskScore | Nullable Enum | Risk score as evaluated by Microsoft Defender ATP. Possible values are: 'None', 'Low', 'Medium' and 'High'.
|
||||
riskScore | Nullable Enum | Risk score as evaluated by Microsoft Defender ATP. Possible values are: 'None', 'Informational', 'Low', 'Medium' and 'High'.
|
||||
exposureScore | Nullable Enum | [Exposure score](tvm-exposure-score.md) as evaluated by Microsoft Defender ATP. Possible values are: 'None', 'Low', 'Medium' and 'High'.
|
||||
aadDeviceId | Nullable representation Guid | AAD Device ID (when [machine](machine.md) is AAD Joined).
|
||||
machineTags | String collection | Set of [machine](machine.md) tags.
|
||||
|
||||
@ -25,7 +25,7 @@ ms.topic: article
|
||||
|
||||
- Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
- See [Response Actions](respond-machine-alerts.md) for more information
|
||||
- For more information, see [Response Actions](respond-machine-alerts.md).
|
||||
|
||||
| Method | Return Type | Description |
|
||||
|:------------------------------------------------------------------|:-----------------------------------|:------------------------------------------------------------|
|
||||
@ -47,13 +47,13 @@ ms.topic: article
|
||||
|
||||
| Property | Type | Description |
|
||||
|:--------------------|:---------------|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| id | Guid | Identity of the [Machine Action](machineaction.md) entity. |
|
||||
| ID | Guid | Identity of the [Machine Action](machineaction.md) entity. |
|
||||
| type | Enum | Type of the action. Possible values are: "RunAntiVirusScan", "Offboard", "CollectInvestigationPackage", "Isolate", "Unisolate", "StopAndQuarantineFile", "RestrictCodeExecution" and "UnrestrictCodeExecution" |
|
||||
| scope | string | Scope of the action. "Full" or "Selective" in case of Isolation, "Quick" or "Full" in case of Anti-Virus scan. |
|
||||
| scope | string | Scope of the action. "Full" or "Selective" for Isolation, "Quick" or "Full" for Anti-Virus scan. |
|
||||
| requestor | String | Identity of the person that executed the action. |
|
||||
| requestorComment | String | Comment that was written when issuing the action. |
|
||||
| status | Enum | Current status of the command. Possible values are: "Pending", "InProgress", "Succeeded", "Failed", "TimeOut" and "Cancelled". |
|
||||
| machineId | String | Id of the [machine](machine.md) on which the action was executed. |
|
||||
| status | Enum | Current status of the command. Possible values are: "Pending", "InProgress", "Succeeded", "Failed", "TimeOut" and "Canceled". |
|
||||
| machineId | String | ID of the [machine](machine.md) on which the action was executed. |
|
||||
| machineId | String | Name of the [machine](machine.md) on which the action was executed. |
|
||||
| creationDateTimeUtc | DateTimeOffset | The date and time when the action was created. |
|
||||
| lastUpdateTimeUtc | DateTimeOffset | The last date and time when the action status was updated. |
|
||||
|
||||
@ -55,12 +55,12 @@ The Microsoft Defender ATP APIs can be grouped into three:
|
||||
|
||||
## Microsoft Defender ATP APIs
|
||||
|
||||
Microsoft Defender ATP offers a layered API model exposing data and capabilities in a structured, clear and easy to use model, exposed through a standard Azure AD-based authentication and authorization model allowing access in context of users or SaaS applications. The API model was designed to expose entities and capabilities in a consistent form.
|
||||
Microsoft Defender ATP offers a layered API model exposing data and capabilities in a structured, clear, and easy to use model, exposed through a standard Azure AD-based authentication and authorization model allowing access in context of users or SaaS applications. The API model was designed to expose entities and capabilities in a consistent form.
|
||||
|
||||
Watch this video for a quick overview of Microsoft Defender ATP's APIs.
|
||||
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4d73M]
|
||||
|
||||
The **Investigation API** exposes the richness of Microsoft Defender ATP - exposing calculated or 'profiled' entities (for example, device, user, and file) and discrete events (for example, process creation and file creation) which typically describes a behavior related to an entity, enabling access to data via investigation interfaces allowing a query-based access to data. For more information see, [Supported APIs](exposed-apis-list.md).
|
||||
The **Investigation API** exposes the richness of Microsoft Defender ATP - exposing calculated or 'profiled' entities (for example, device, user, and file) and discrete events (for example, process creation and file creation) which typically describes a behavior related to an entity, enabling access to data via investigation interfaces allowing a query-based access to data. For more information, see, [Supported APIs](exposed-apis-list.md).
|
||||
|
||||
The **Response API** exposes the ability to take actions in the service and on devices, enabling customers to ingest indicators, manage settings, alert status, as well as take response actions on devices programmatically such as isolate devices from the network, quarantine files, and others.
|
||||
|
||||
@ -69,11 +69,11 @@ Microsoft Defender ATP raw data streaming API provides the ability for customers
|
||||
|
||||
The Microsoft Defender ATP event information is pushed directly to Azure storage for long-term data retention, or to Azure Event Hubs for consumption by visualization services or additional data processing engines.
|
||||
|
||||
For more information see, [Raw data streaming API](raw-data-export.md).
|
||||
For more information, see, [Raw data streaming API](raw-data-export.md).
|
||||
|
||||
|
||||
## SIEM API
|
||||
When you enable security information and event management (SIEM) integration it allows you to pull detections from Microsoft Defender Security Center using your SIEM solution or by connecting directly to the detections REST API. This activates the SIEM connector access details section with pre-populated values and an application is created under you Azure Active Directory (AAD) tenant. For more information see, [SIEM integration](enable-siem-integration.md)
|
||||
When you enable security information and event management (SIEM) integration, it allows you to pull detections from Microsoft Defender Security Center using your SIEM solution or by connecting directly to the detections REST API. This activates the SIEM connector access details section with pre-populated values and an application is created under your Azure Active Directory (Azure AD) tenant. For more information, see, [SIEM integration](enable-siem-integration.md)
|
||||
|
||||
## Related topics
|
||||
- [Access the Microsoft Defender Advanced Threat Protection APIs ](apis-intro.md)
|
||||
|
||||
@ -33,8 +33,7 @@ Microsoft Defender Advanced Threat Protection is an enterprise endpoint security
|
||||
|
||||
Microsoft Defender ATP uses the following combination of technology built into Windows 10 and Microsoft's robust cloud service:
|
||||
|
||||
- **Endpoint behavioral sensors**: Embedded in Windows 10, these sensors
|
||||
collect and process behavioral signals from the operating system and sends this sensor data to your private, isolated, cloud instance of Microsoft Defender ATP.
|
||||
- **Endpoint behavioral sensors**: Embedded in Windows 10, these sensors collect and process behavioral signals from the operating system and send this sensor data to your private, isolated, cloud instance of Microsoft Defender ATP.
|
||||
|
||||
|
||||
- **Cloud security analytics**: Leveraging big-data, device-learning, and
|
||||
@ -46,7 +45,7 @@ Microsoft Defender ATP uses the following combination of technology built into W
|
||||
- **Threat intelligence**: Generated by Microsoft hunters, security teams,
|
||||
and augmented by threat intelligence provided by partners, threat
|
||||
intelligence enables Microsoft Defender ATP to identify attacker
|
||||
tools, techniques, and procedures, and generate alerts when these
|
||||
tools, techniques, and procedures, and generate alerts when they
|
||||
are observed in collected sensor data.
|
||||
|
||||
|
||||
@ -86,7 +85,7 @@ This built-in capability uses a game-changing risk-based approach to the discove
|
||||
<a name="asr"></a>
|
||||
|
||||
**[Attack surface reduction](overview-attack-surface-reduction.md)**<br>
|
||||
The attack surface reduction set of capabilities provide the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitation. This set of capabilities also includes [network protection](network-protection.md) and [web protection](web-protection-overview.md), which regulate access to malicious IP addresses, domains, and URLs.
|
||||
The attack surface reduction set of capabilities provides the first line of defense in the stack. By ensuring configuration settings are properly set and exploit mitigation techniques are applied, the capabilities resist attacks and exploitation. This set of capabilities also includes [network protection](network-protection.md) and [web protection](web-protection-overview.md), which regulate access to malicious IP addresses, domains, and URLs.
|
||||
|
||||
<a name="ngp"></a>
|
||||
|
||||
@ -135,7 +134,7 @@ Integrate Microsoft Defender Advanced Threat Protection into your existing workf
|
||||
- Microsoft Cloud App Security
|
||||
|
||||
**[Microsoft Threat Protection](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection)**<br>
|
||||
With Microsoft Threat Protection, Microsoft Defender ATP and various Microsoft security solutions form a unified pre- and post-breach enterprise defense suite that natively integrates across endpoint, identity, email, and applications to detect, prevent, investigate and automatically respond to sophisticated attacks.
|
||||
With Microsoft Threat Protection, Microsoft Defender ATP and various Microsoft security solutions form a unified pre- and post-breach enterprise defense suite that natively integrates across endpoint, identity, email, and applications to detect, prevent, investigate, and automatically respond to sophisticated attacks.
|
||||
|
||||
|
||||
## Related topic
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Configure and manage Microsoft Defender ATP capabilities
|
||||
ms.reviewer:
|
||||
description: Configure and manage Microsoft Defender ATP capabilities such as attack surface reduction, next-generation protection, and security controls
|
||||
description: Configure and manage Microsoft Defender ATP capabilities such as attack surface reduction, and next-generation protection
|
||||
keywords: configure, manage, capabilities, attack surface reduction, next-generation protection, security controls, endpoint detection and response, auto investigation and remediation, security controls, controls
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -32,12 +32,12 @@ Configure and manage all the Microsoft Defender ATP capabilities to get the best
|
||||
## In this section
|
||||
Topic | Description
|
||||
:---|:---
|
||||
[Configure attack surface reduction capabilities](configure-attack-surface-reduction.md) | By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitations.
|
||||
[Configure attack surface reduction capabilities](configure-attack-surface-reduction.md) | By ensuring configuration settings are properly set and exploit mitigation techniques are applied, these set of capabilities resist attacks and exploitation.
|
||||
[Configure next-generation protection](../microsoft-defender-antivirus/configure-microsoft-defender-antivirus-features.md) | Configure next-generation protection to catch all types of emerging threats.
|
||||
[Configure Microsoft Threat Experts capabilities](configure-microsoft-threat-experts.md) | Configure and manage how you would like to get cybersecurity threat intelligence from Microsoft Threat Experts.
|
||||
[Configure Microsoft Threat Protection integration](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/threat-protection-integration)| Configure other solutions that integrate with Microsoft Defender ATP.
|
||||
[Management and API support](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/management-apis)| Pull alerts to your SIEM or use APIs to create custom alerts. Create and build Power BI reports.
|
||||
[Configure Microsoft Defender Security Center settings](preferences-setup.md) | Configure portal related settings such as general settings, advanced features, enable the preview experience and others.
|
||||
[Configure Microsoft Defender Security Center settings](preferences-setup.md) | Configure portal-related settings such as general settings, advanced features, enable the preview experience and others.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -30,9 +30,15 @@ ms.topic: conceptual
|
||||
Microsoft Defender ATP supports third-party applications to help enhance the detection, investigation, and threat intelligence capabilities of the platform.
|
||||
|
||||
|
||||
The support for third-party solutions help to further streamline, integrate, and orchestrate defenses from other vendors with Microsoft Defender ATP; enabling security teams to effectively respond better to modern threats.
|
||||
The support for third-party solutions helps to further streamline, integrate, and orchestrate defenses from other vendors with Microsoft Defender ATP; enabling security teams to effectively respond better to modern threats.
|
||||
|
||||
Microsoft Defender ATP seamlessly integrates with existing security solutions — providing out of the box integration with SIEM, ticketing and IT service management solutions, managed security service providers (MSSP), IoC indicators ingestions and matching, automated device investigation and remediation based on external alerts, and integration with Security orchestration and automation response (SOAR) systems.
|
||||
Microsoft Defender ATP seamlessly integrates with existing security solutions. The integration provides integration with the following solutions such as:
|
||||
- SIEM
|
||||
- Ticketing and IT service management solutions
|
||||
- Managed security service providers (MSSP)
|
||||
- IoC indicators ingestions and matching
|
||||
- Automated device investigation and remediation based on external alerts
|
||||
- Integration with Security orchestration and automation response (SOAR) systems
|
||||
|
||||
## Supported applications
|
||||
|
||||
@ -49,7 +55,7 @@ Logo |Partner name | Description
|
||||
 | [Micro Focus ArcSight](https://go.microsoft.com/fwlink/?linkid=2113548) | Use Micro Focus ArcSight to pull Microsoft Defender ATP detections
|
||||
 | [RSA NetWitness](https://go.microsoft.com/fwlink/?linkid=2118566) | Stream Microsoft Defender ATP Alerts to RSA NetWitness leveraging Microsoft Graph Security API
|
||||
 | [SafeBreach](https://go.microsoft.com/fwlink/?linkid=2114114)| Gain visibility into Microsoft Defender ATP security events that are automatically correlated with SafeBreach simulations
|
||||
 | [Skybox Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2127467) | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network and threat context to uncover your riskiest vulnerabilities
|
||||
 | [Skybox Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2127467) | Skybox Vulnerability Control cuts through the noise of vulnerability management, correlating business, network, and threat context to uncover your riskiest vulnerabilities
|
||||
 | [Splunk](https://go.microsoft.com/fwlink/?linkid=2129805) | The Microsoft Defender ATP Add-on allows Splunk users to ingest all of the alerts and supporting information to their Splunk
|
||||
 | [XM Cyber](https://go.microsoft.com/fwlink/?linkid=2136700) | Prioritize your response to an alert based on risk factors and high value assets
|
||||
|
||||
@ -60,7 +66,7 @@ Logo |Partner name | Description
|
||||
:---|:---|:---
|
||||
 | [CyberSponse CyOps](https://go.microsoft.com/fwlink/?linkid=2115943) | CyOps integrates with Microsoft Defender ATP to automate customers' high-speed incident response playbooks
|
||||
 | [Delta Risk ActiveEye](https://go.microsoft.com/fwlink/?linkid=2127468) | Delta Risk, a leading provider of SOC-as-a-Service and security services, integrate Microsoft Defender ATP with its cloud-native SOAR platform, ActiveEye.
|
||||
 | [Demisto, a Palo Alto Networks Company](https://go.microsoft.com/fwlink/?linkid=2108414) | Demisto integrates with Microsoft Defender ATP to enable security teams to orchestrate and automate endpoint security monitoring, enrichment and response
|
||||
 | [Demisto, a Palo Alto Networks Company](https://go.microsoft.com/fwlink/?linkid=2108414) | Demisto integrates with Microsoft Defender ATP to enable security teams to orchestrate and automate endpoint security monitoring, enrichment, and response
|
||||
 | [Microsoft Flow & Azure Functions](https://go.microsoft.com/fwlink/?linkid=2114300) | Use the Microsoft Defender ATP connectors for Azure Logic Apps & Microsoft Flow to automating security procedures
|
||||
 | [Rapid7 InsightConnect](https://go.microsoft.com/fwlink/?linkid=2116040) | InsightConnect integrates with Microsoft Defender ATP to accelerate, streamline, and integrate your time-intensive security processes
|
||||
 | [ServiceNow](https://go.microsoft.com/fwlink/?linkid=2135621) | Ingest alerts into ServiceNow Security Operations solution based on Microsoft Graph API integration
|
||||
@ -93,7 +99,7 @@ Logo |Partner name | Description
|
||||
 | [Better Mobile](https://go.microsoft.com/fwlink/?linkid=2086214)| AI based MTD solution to stop mobile threats & phishing. Private internet browsing to protect user privacy
|
||||
| [Corrata](https://go.microsoft.com/fwlink/?linkid=2081148) | Mobile solution — Protect your mobile devices with granular visibility and control from Corrata
|
||||
| [Lookout](https://go.microsoft.com/fwlink/?linkid=866935)| Get Lookout Mobile Threat Protection telemetry for Android and iOS mobile devices
|
||||
 | [Symantec Endpoint Protection Mobile](https://go.microsoft.com/fwlink/?linkid=2090992)| SEP Mobile helps businesses predict, detect and prevent security threats and vulnerabilities on mobile devices
|
||||
 | [Symantec Endpoint Protection Mobile](https://go.microsoft.com/fwlink/?linkid=2090992)| SEP Mobile helps businesses predict, detect, and prevent security threats and vulnerabilities on mobile devices
|
||||
| [Zimperium](https://go.microsoft.com/fwlink/?linkid=2118044)|Extend your Microsoft Defender ATP to iOS and Android with Machine Learning-based Mobile Threat Defense
|
||||
|
||||
|
||||
@ -121,7 +127,7 @@ Microsoft Defender ATP offers unique automated investigation and remediation cap
|
||||
|
||||
Integrating the automated investigation and response capability with other solutions such as IDS and firewalls help to address alerts and minimize the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices.
|
||||
|
||||
External alerts can be pushed into Microsoft Defender ATP and is presented side-by-side with additional device-based alerts from Microsoft Defender ATP. This view provides a full context of the alert — with the real process and the full story of attack.
|
||||
External alerts can be pushed into Microsoft Defender ATP and is presented side by side with additional device-based alerts from Microsoft Defender ATP. This view provides a full context of the alert — with the real process and the full story of attack.
|
||||
|
||||
## Indicators matching
|
||||
You can use threat-intelligence from providers and aggregators to maintain and use indicators of compromise (IOCs).
|
||||
|
||||
@ -31,26 +31,27 @@ ms.topic: conceptual
|
||||
|
||||
Partners can easily extend their existing security offerings on top of the open framework and a rich and complete set of APIs to build extensions and integrations with Microsoft Defender ATP.
|
||||
|
||||
The APIs span functional areas including detection, management, response, vulnerabilities and intelligence wide range of use cases. Based on the use case and need, partners can either stream or query data from Microsoft Defender ATP.
|
||||
The APIs span functional areas including detection, management, response, vulnerabilities, and intelligence-wide range of use cases. Based on the use case and need, partners can either stream or query data from Microsoft Defender ATP.
|
||||
|
||||
|
||||
## Scenario 1: External alert correlation and Automated investigation and remediation
|
||||
Microsoft Defender ATP offers unique automated investigation and remediation capabilities to drive incident response at scale.
|
||||
|
||||
Integrating the automated investigation and response capability with other solutions such as network security products or other endpoint security products will help to address alerts and minimize the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices.
|
||||
Integrating the automated investigation and response capability with other solutions such as network security products or other endpoint security products will help to address alerts. The integration also minimizes the complexities surrounding network and device signal correlation, effectively streamlining the investigation and threat remediation actions on devices.
|
||||
|
||||
Microsoft Defender ATP adds support for this scenario in the following forms:
|
||||
- External alerts can be pushed into Microsoft Defender ATP and presented side-by-side with additional device-based alerts from Microsoft Defender ATP. This view provides the full context of the alert - with the real process and the full story of attack.
|
||||
|
||||
- External alerts can be pushed into Microsoft Defender ATP and presented side by side with additional device-based alerts from Microsoft Defender ATP. This view provides the full context of the alert - with the real process and the full story of attack.
|
||||
|
||||
- Once an alert is generated, the signal is shared across all Microsoft Defender ATP protected endpoints in the enterprise. Microsoft Defender ATP takes immediate automated or operator-assisted response to address the alert.
|
||||
|
||||
## Scenario 2: Security orchestration and automation response (SOAR) integration
|
||||
Orchestration solutions can help build playbooks and integrate the rich data model and actions that Microsoft Defender ATP APIs exposes to orchestrate responses, such as query for device data, trigger device isolation, block/allow, resolve alert and others.
|
||||
Orchestration solutions can help build playbooks and integrate the rich data model and actions that Microsoft Defender ATP APIs expose to orchestrate responses, such as query for device data, trigger device isolation, block/allow, resolve alert and others.
|
||||
|
||||
## Scenario 3: Indicators matching
|
||||
Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives the ability to set a list of indicators for prevention, detection and exclusion of entities. One can define the action to be taken as well as the duration for when to apply the action.
|
||||
Indicator of compromise (IoCs) matching is an essential feature in every endpoint protection solution. This capability is available in Microsoft Defender ATP and gives the ability to set a list of indicators for prevention, detection, and exclusion of entities. One can define the action to be taken as well as the duration for when to apply the action.
|
||||
|
||||
The above scenarios serve as examples of the extensibility of the platform. You are not limited to these and we certainly encourage you leverage the open framework to discover and explore other scenarios.
|
||||
The above scenarios serve as examples of the extensibility of the platform. You are not limited to the examples and we certainly encourage you to leverage the open framework to discover and explore other scenarios.
|
||||
|
||||
Follow the steps in [Become a Microsoft Defender ATP partner](get-started-partner-integration.md) to integrate your solution in Microsoft Defender ATP.
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Prepare Microsoft Defender ATP deployment
|
||||
description: Prepare stakeholder sign-off, timelines, environment considerations, and adoption order when deploying Microsoft Defender ATP
|
||||
description: Prepare stakeholder approval, timelines, environment considerations, and adoption order when deploying Microsoft Defender ATP
|
||||
keywords: deploy, prepare, stakeholder, timeline, environment, endpoint, server, management, adoption
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -71,14 +71,14 @@ You are currently in the preparation phase.
|
||||
Preparation is key to any successful deployment. In this article, you'll be guided on the points you'll need to consider as you prepare to deploy Microsoft Defender ATP.
|
||||
|
||||
|
||||
## Stakeholders and Sign-off
|
||||
## Stakeholders and approval
|
||||
The following section serves to identify all the stakeholders that are involved
|
||||
in the project and need to sign-off, review, or stay informed.
|
||||
in the project and need to approve, review, or stay informed.
|
||||
|
||||
Add stakeholders
|
||||
to the table below as appropriate for your organization.
|
||||
|
||||
- SO = Sign-off on this project
|
||||
- SO = Approve project
|
||||
|
||||
- R = Review this project and provide input
|
||||
|
||||
@ -90,14 +90,14 @@ to the table below as appropriate for your organization.
|
||||
| Enter name and email | **Head of Cyber Defense Operations Center (CDOC)** *A representative from the CDOC team in charge of defining how this change is aligned with the processes in the customers security operations team.* | SO |
|
||||
| Enter name and email | **Security Architect** *A representative from the Security team in charge of defining how this change is aligned with the core Security architecture in the organization.* | R |
|
||||
| Enter name and email | **Workplace Architect** *A representative from the IT team in charge of defining how this change is aligned with the core workplace architecture in the organization.* | R |
|
||||
| Enter name and email | **Security Analyst** *A representative from the CDOC team who can provide input on the detection capabilities, user experience and overall usefulness of this change from a security operations perspective.* | I |
|
||||
| Enter name and email | **Security Analyst** *A representative from the CDOC team who can provide input on the detection capabilities, user experience, and overall usefulness of this change from a security operations perspective.* | I |
|
||||
|
||||
|
||||
## Environment
|
||||
|
||||
|
||||
This section is used to ensure your environment is deeply understood by the
|
||||
stakeholders which will help identify potential dependencies and/or changes
|
||||
stakeholders, which will help identify potential dependencies and/or changes
|
||||
required in technologies or processes.
|
||||
|
||||
| What | Description |
|
||||
@ -112,14 +112,14 @@ required in technologies or processes.
|
||||
## Role-based access control
|
||||
|
||||
Microsoft recommends using the concept of least privileges. Microsoft Defender
|
||||
ATP leverages built-in roles within Azure Active Directory. Microsoft recommend
|
||||
ATP leverages built-in roles within Azure Active Directory. Microsoft recommends
|
||||
[review the different roles that are
|
||||
available](https://docs.microsoft.com/azure/active-directory/active-directory-assign-admin-roles-azure-portal)
|
||||
and choose the right one to solve your needs for each persona for this
|
||||
application. Some roles may need to be applied temporarily and removed after the
|
||||
deployment has been completed.
|
||||
|
||||
| Personas | Roles | Azure AD Role (if required) | Assign to |
|
||||
| Personas | Roles | Azure AD Role (if necessary) | Assign to |
|
||||
|------------------------------|-------|-----------------------------|-----------|
|
||||
| Security Administrator | | | |
|
||||
| Security Analyst | | | |
|
||||
@ -157,13 +157,13 @@ structure required for your environment.
|
||||
|--------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------|
|
||||
| Tier 1 | **Local security operations team / IT team**<br>This team usually triages and investigates alerts contained within their geolocation and escalates to Tier 2 in cases where an active remediation is required. | |
|
||||
| Tier 2 | **Regional security operations team**<br>This team can see all the devices for their region and perform remediation actions. | View data |
|
||||
| Tier 3 | **Global security operations team**<br>This team consists of security experts and are authorized to see and perform all actions from the portal. | View data <br> Alerts investigation Active remediation actions <br> Alerts investigation Active remediation actions <br> Manage portal system settings <br> Manage security settings |
|
||||
| Tier 3 | **Global security operations team**<br>This team consists of security experts and is authorized to see and perform all actions from the portal. | View data <br> Alerts investigation Active remediation actions <br> Alerts investigation Active remediation actions <br> Manage portal system settings <br> Manage security settings |
|
||||
|
||||
|
||||
|
||||
## Adoption Order
|
||||
In many cases, organizations will have existing endpoint security products in
|
||||
place. The bare minimum every organization should have is an antivirus solution. But in some cases, an organization might also have implanted an EDR solution already.
|
||||
place. The bare minimum every organization should have been an antivirus solution. But in some cases, an organization might also have implanted an EDR solution already.
|
||||
|
||||
Historically, replacing any security solution used to be time intensive and difficult
|
||||
to achieve due to the tight hooks into the application layer and infrastructure
|
||||
@ -179,7 +179,7 @@ how the endpoint security suite should be enabled.
|
||||
| Endpoint Detection & Response (EDR) | Microsoft Defender ATP endpoint detection and response capabilities provide advanced attack detections that are near real-time and actionable. Security analysts can prioritize alerts effectively, gain visibility into the full scope of a breach, and take response actions to remediate threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response) | 1 |
|
||||
|Threat & Vulnerability Management (TVM)|Threat & Vulnerability Management is a component of Microsoft Defender ATP, and provides both security administrators and security operations teams with unique value, including: <br> - Real-time endpoint detection and response (EDR) insights correlated with endpoint vulnerabilities <br> - Invaluable device vulnerability context during incident investigations <br> - Built-in remediation processes through Microsoft Intune and Microsoft System Center Configuration Manager <br> [Learn more](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Introducing-a-risk-based-approach-to-threat-and-vulnerability/ba-p/377845).| 2 |
|
||||
| Next-generation protection (NGP) | Microsoft Defender Antivirus is a built-in antimalware solution that provides next-generation protection for desktops, portable computers, and servers. Microsoft Defender Antivirus includes: <br> -Cloud-delivered protection for near-instant detection and blocking of new and emerging threats. Along with machine learning and the Intelligent Security Graph, cloud-delivered protection is part of the next-gen technologies that power Microsoft Defender Antivirus. <br> - Always-on scanning using advanced file and process behavior monitoring and other heuristics (also known as "real-time protection"). <br> - Dedicated protection updates based on machine-learning, human and automated big-data analysis, and in-depth threat resistance research. <br> [Learn more](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10). |3 |
|
||||
| Attack Surface Reduction (ASR) | Attack surface reduction capabilities in Microsoft Defender ATP helps protect the devices and applications in the organization from new and emerging threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) | 4 |
|
||||
| Attack Surface Reduction (ASR) | Attack surface reduction capabilities in Microsoft Defender ATP help protect the devices and applications in the organization from new and emerging threats. <br> [Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/overview-attack-surface-reduction) | 4 |
|
||||
| Auto Investigation & Remediation (AIR) | Microsoft Defender ATP uses Automated investigations to significantly reduce the volume of alerts that need to be investigated individually. The Automated investigation feature leverages various inspection algorithms, and processes used by analysts (such as playbooks) to examine alerts and take immediate remediation action to resolve breaches. This significantly reduces alert volume, allowing security operations experts to focus on more sophisticated threats and other high value initiatives. <br>[Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection) | Not applicable |
|
||||
| Microsoft Threat Experts (MTE) | Microsoft Threat Experts is a managed hunting service that provides Security Operation Centers (SOCs) with expert level monitoring and analysis to help them ensure that critical threats in their unique environments don't get missed. <br>[Learn more.](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/microsoft-threat-experts) | Not applicable |
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: Advanced Hunting with Powershell API Basics
|
||||
title: Advanced Hunting with PowerShell API Basics
|
||||
ms.reviewer:
|
||||
description: Learn the basics of querying the Microsoft Defender Advanced Threat Protection API, using PowerShell.
|
||||
keywords: apis, supported apis, advanced hunting, query
|
||||
@ -27,7 +27,7 @@ ms.topic: article
|
||||
|
||||
Run advanced queries using PowerShell, see [Advanced Hunting API](run-advanced-query-api.md).
|
||||
|
||||
In this section we share PowerShell samples to retrieve a token and use it to run a query.
|
||||
In this section, we share PowerShell samples to retrieve a token and use it to run a query.
|
||||
|
||||
## Before you begin
|
||||
You first need to [create an app](apis-intro.md).
|
||||
@ -40,7 +40,7 @@ You first need to [create an app](apis-intro.md).
|
||||
Set-ExecutionPolicy -ExecutionPolicy Bypass
|
||||
```
|
||||
|
||||
>For more details, see [PowerShell documentation](https://docs.microsoft.com/powershell/module/microsoft.powershell.security/set-executionpolicy)
|
||||
>For more information, see [PowerShell documentation](https://docs.microsoft.com/powershell/module/microsoft.powershell.security/set-executionpolicy)
|
||||
|
||||
## Get token
|
||||
|
||||
@ -64,9 +64,9 @@ $aadToken = $response.access_token
|
||||
```
|
||||
|
||||
where
|
||||
- $tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant)
|
||||
- $appId: ID of your AAD app (the app must have 'Run advanced queries' permission to Microsoft Defender ATP)
|
||||
- $appSecret: Secret of your AAD app
|
||||
- $tenantId: ID of the tenant on behalf of which you want to run the query (that is, the query will be run on the data of this tenant)
|
||||
- $appId: ID of your Azure AD app (the app must have 'Run advanced queries' permission to Microsoft Defender ATP)
|
||||
- $appSecret: Secret of your Azure AD app
|
||||
|
||||
## Run query
|
||||
|
||||
@ -88,7 +88,7 @@ $results = $response.Results
|
||||
$schema = $response.Schema
|
||||
```
|
||||
|
||||
- $results contains the results of your query
|
||||
- $results contain the results of your query
|
||||
- $schema contains the schema of the results of your query
|
||||
|
||||
### Complex queries
|
||||
|
||||
@ -28,13 +28,13 @@ ms.topic: article
|
||||
|
||||
Run advanced queries using Python, see [Advanced Hunting API](run-advanced-query-api.md).
|
||||
|
||||
In this section we share Python samples to retrieve a token and use it to run a query.
|
||||
In this section, we share Python samples to retrieve a token and use it to run a query.
|
||||
|
||||
>**Prerequisite**: You first need to [create an app](apis-intro.md).
|
||||
|
||||
## Get token
|
||||
|
||||
- Run the following:
|
||||
- Run the following commands:
|
||||
|
||||
```
|
||||
|
||||
@ -67,9 +67,9 @@ aadToken = jsonResponse["access_token"]
|
||||
```
|
||||
|
||||
where
|
||||
- tenantId: ID of the tenant on behalf of which you want to run the query (i.e., the query will be run on the data of this tenant)
|
||||
- appId: ID of your AAD app (the app must have 'Run advanced queries' permission to Microsoft Defender ATP)
|
||||
- appSecret: Secret of your AAD app
|
||||
- tenantId: ID of the tenant on behalf of which you want to run the query (that is, the query will be run on the data of this tenant)
|
||||
- appId: ID of your Azure AD app (the app must have 'Run advanced queries' permission to Microsoft Defender ATP)
|
||||
- appSecret: Secret of your Azure AD app
|
||||
|
||||
## Run query
|
||||
|
||||
@ -96,7 +96,7 @@ results = jsonResponse["Results"]
|
||||
```
|
||||
|
||||
- schema contains the schema of the results of your query
|
||||
- results contains the results of your query
|
||||
- results contain the results of your query
|
||||
|
||||
### Complex queries
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ ms.topic: article
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-servicestatus-abovefoldlink)
|
||||
|
||||
The **Service health** provides information on the current status of the Microsoft Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues. If there are issues, you'll see details related to the issue such as when the issue was detected, what the preliminary root cause is, and the expected resolution time.
|
||||
**Service health** provides information on the current status of the Microsoft Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues. If there are issues, you'll see information such as when the issue was detected, what the preliminary root cause is, and the expected resolution time.
|
||||
|
||||
You'll also see information on historical issues that have been resolved and details such as the date and time when the issue was resolved. When there are no issues on the service, you'll see a healthy status.
|
||||
|
||||
@ -51,7 +51,7 @@ The **Current status** tab shows the current state of the Microsoft Defender ATP
|
||||
- Next steps
|
||||
- Expected resolution time
|
||||
|
||||
Updates on the progress of an issue is reflected on the page as the issue gets resolved. You'll see updates on information such as an updated estimate resolution time or next steps.
|
||||
Updates on the progress of an issue are reflected on the page as the issue gets resolved. You'll see updates on information such as an updated estimate resolution time or next steps.
|
||||
|
||||
When an issue is resolved, it gets recorded in the **Status history** tab.
|
||||
|
||||
|
||||
@ -57,11 +57,11 @@ If while trying to take an action during a live response session, you encounter
|
||||
|
||||
## Slow live response sessions or delays during initial connections
|
||||
Live response leverages Microsoft Defender ATP sensor registration with WNS service in Windows.
|
||||
If you are having connectivity issues with live response, please confirm the following:
|
||||
1. `notify.windows.com` is not blocked in your environment. For more information see, [Configure device proxy and Internet connectivity settings](configure-proxy-internet.md#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
||||
If you are having connectivity issues with live response, confirm the following details:
|
||||
1. `notify.windows.com` is not blocked in your environment. For more information, see, [Configure device proxy and Internet connectivity settings](configure-proxy-internet.md#enable-access-to-microsoft-defender-atp-service-urls-in-the-proxy-server).
|
||||
2. WpnService (Windows Push Notifications System Service) is not disabled.
|
||||
|
||||
Please refer to the articles below to fully understand the WpnService service behavior and requirements:
|
||||
Refer to the articles below to fully understand the WpnService service behavior and requirements:
|
||||
- [Windows Push Notification Services (WNS) overview](https://docs.microsoft.com/windows/uwp/design/shell/tiles-and-notifications/windows-push-notification-services--wns--overview)
|
||||
- [Enterprise Firewall and Proxy Configurations to Support WNS Traffic](https://docs.microsoft.com/windows/uwp/design/shell/tiles-and-notifications/firewall-allowlist-config)
|
||||
- [Microsoft Push Notifications Service (MPNS) Public IP ranges](https://www.microsoft.com/en-us/download/details.aspx?id=44535)
|
||||
|
||||
@ -36,15 +36,15 @@ If you receive an error message, Microsoft Defender Security Center will provide
|
||||
|
||||
## No subscriptions found
|
||||
|
||||
If while accessing Microsoft Defender Security Center you get a **No subscriptions found** message, it means the Azure Active Directory (AAD) used to login the user to the portal, does not have a Microsoft Defender ATP license.
|
||||
If while accessing Microsoft Defender Security Center you get a **No subscriptions found** message, it means the Azure Active Directory (Azure AD) used to log in the user to the portal, does not have a Microsoft Defender ATP license.
|
||||
|
||||
Potential reasons:
|
||||
- The Windows E5 and Office E5 licenses are separate licenses.
|
||||
- The license was purchased but not provisioned to this AAD instance.
|
||||
- The license was purchased but not provisioned to this Azure AD instance.
|
||||
- It could be a license provisioning issue.
|
||||
- It could be you inadvertently provisioned the license to a different Microsoft AAD than the one used for authentication into the service.
|
||||
- It could be you inadvertently provisioned the license to a different Microsoft Azure AD than the one used for authentication into the service.
|
||||
|
||||
For both cases you should contact Microsoft support at [General Microsoft Defender ATP Support](https://support.microsoft.com/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636419533611396913) or
|
||||
For both cases, you should contact Microsoft support at [General Microsoft Defender ATP Support](https://support.microsoft.com/getsupport?wf=0&tenant=ClassicCommercial&oaspworkflow=start_1.0.0.0&locale=en-us&supportregion=en-us&pesid=16055&ccsid=636419533611396913) or
|
||||
[Volume license support](https://www.microsoft.com/licensing/servicecenter/Help/Contact.aspx).
|
||||
|
||||
|
||||
@ -63,16 +63,16 @@ You can choose to renew or extend the license at any point in time. When accessi
|
||||
## You are not authorized to access the portal
|
||||
|
||||
If you receive a **You are not authorized to access the portal**, be aware that Microsoft Defender ATP is a security monitoring, incident investigation and response product, and as such, access to it is restricted and controlled by the user.
|
||||
For more information see, [**Assign user access to the portal**](https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection).
|
||||
For more information, see, [**Assign user access to the portal**](https://docs.microsoft.com/windows/threat-protection/windows-defender-atp/assign-portal-access-windows-defender-advanced-threat-protection).
|
||||
|
||||
|
||||
|
||||
## Data currently isn't available on some sections of the portal
|
||||
If the portal dashboard, and other sections show an error message such as "Data currently isn't available":
|
||||
If the portal dashboard and other sections show an error message such as "Data currently isn't available":
|
||||
|
||||
|
||||
|
||||
You'll need to allow the `securitycenter.windows.com` and all sub-domains under it. For example `*.securitycenter.windows.com`.
|
||||
You'll need to allow the `securitycenter.windows.com` and all subdomains under it. For example, `*.securitycenter.windows.com`.
|
||||
|
||||
|
||||
## Portal communication issues
|
||||
|
||||
@ -21,16 +21,15 @@ ms.topic: article
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-main-abovefoldlink&rtc=1)
|
||||
|
||||
Web protection lets you monitor your organization’s web browsing security through reports under **Reports > Web protection** in the Microsoft Defender Security Center. The report contains cards that provide web threat detection statistics.
|
||||
|
||||
- **Web threat protection detections over time** — this trending card displays the number of web threats detected by type during the selected time period (Last 30 days, Last 3 months, Last 6 months)
|
||||
- **Web threat protection detections over time** - this trending card displays the number of web threats detected by type during the selected time period (Last 30 days, Last 3 months, Last 6 months)
|
||||
|
||||
|
||||
|
||||
- **Web threat protection summary** — this card displays the total web threat detections in the past 30 days, showing distribution across the different types of web threats. Selecting a slice opens the list of the domains that were found with malicious or unwanted websites.
|
||||
- **Web threat protection summary** - this card displays the total web threat detections in the past 30 days, showing distribution across the different types of web threats. Selecting a slice opens the list of the domains that were found with malicious or unwanted websites.
|
||||
|
||||
|
||||
|
||||
@ -38,23 +37,27 @@ Web protection lets you monitor your organization’s web browsing security thro
|
||||
>It can take up to 12 hours before a block is reflected in the cards or the domain list.
|
||||
|
||||
## Types of web threats
|
||||
|
||||
Web protection categorizes malicious and unwanted websites as:
|
||||
- **Phishing** — websites that contain spoofed web forms and other phishing mechanisms designed to trick users into divulging credentials and other sensitive information
|
||||
- **Malicious** — websites that host malware and exploit code
|
||||
- **Custom indicator** — websites whose URLs or domains you've added to your [custom indicator list](manage-indicators.md) for blocking
|
||||
|
||||
- **Phishing** - websites that contain spoofed web forms and other phishing mechanisms designed to trick users into divulging credentials and other sensitive information
|
||||
- **Malicious** - websites that host malware and exploit code
|
||||
- **Custom indicator** - websites whose URLs or domains you've added to your [custom indicator list](manage-indicators.md) for blocking
|
||||
|
||||
## View the domain list
|
||||
Select a specific web threat category in the **Web threat protection summary** card to open the **Domains** page and display the list of the domains under that threat category. The page provides the following information for each domain:
|
||||
|
||||
- **Access count** — number of requests for URLs in the domain
|
||||
- **Blocks** — number of times requests were blocked
|
||||
- **Access trend** — change in number of access attempts
|
||||
- **Threat category** — type of web threat
|
||||
- **Devices** — number of devices with access attempts
|
||||
Select a specific web threat category in the **Web threat protection summary** card to open the **Domains** page. This page displays the list of the domains under that threat category. The page provides the following information for each domain:
|
||||
|
||||
Select a domain to view the list of devices that have attempted to access URLs in that domain as well as the list of URLs.
|
||||
- **Access count** - number of requests for URLs in the domain
|
||||
- **Blocks** - number of times requests were blocked
|
||||
- **Access trend** - change in number of access attempts
|
||||
- **Threat category** - type of web threat
|
||||
- **Devices** - number of devices with access attempts
|
||||
|
||||
Select a domain to view the list of devices that have attempted to access URLs in that domain and the list of URLs.
|
||||
|
||||
## Related topics
|
||||
|
||||
- [Web protection overview](web-protection-overview.md)
|
||||
- [Web content filtering](web-content-filtering.md)
|
||||
- [Web threat protection](web-threat-protection.md)
|
||||
|
||||
@ -39,15 +39,15 @@ Microsoft Defender SmartScreen protects against phishing or malware websites and
|
||||
|
||||
## Benefits of Microsoft Defender SmartScreen
|
||||
|
||||
Microsoft Defender SmartScreen provide an early warning system against websites that might engage in phishing attacks or attempt to distribute malware through a socially-engineered attack. The primary benefits are:
|
||||
Microsoft Defender SmartScreen provide an early warning system against websites that might engage in phishing attacks or attempt to distribute malware through a socially engineered attack. The primary benefits are:
|
||||
|
||||
- **Anti-phishing and anti-malware support.** Microsoft Defender SmartScreen helps to protect users from sites that are reported to host phishing attacks or attempt to distribute malicious software. It can also help protect against deceptive advertisements, scam sites, and drive-by attacks. Drive-by attacks are web-based attacks that tend to start on a trusted site, targeting security vulnerabilities in commonly used software. Because drive-by attacks can happen even if the user does not click or download anything on the page, the danger often goes unnoticed. For more info about drive-by attacks, see [Evolving Microsoft Defender SmartScreen to protect you from drive-by attacks](https://blogs.windows.com/msedgedev/2015/12/16/SmartScreen-drive-by-improvements/#3B7Bb8bzeAPq8hXE.97)
|
||||
|
||||
- **Reputation-based URL and app protection.** Microsoft Defender SmartScreen evaluates a website's URLs to determine if they're known to distribute or host unsafe content. It also provides reputation checks for apps, checking downloaded programs and the digital signature used to sign a file. If a URL, a file, an app, or a certificate has an established reputation, users won't see any warnings. If, however, there's no reputation, the item is marked as a higher risk and presents a warning to the user.
|
||||
|
||||
- **Operating system integration.** Microsoft Defender SmartScreen is integrated into the Windows 10 operating system, meaning that it checks any files an app (including 3rd-party browsers and email clients) attempts to download and run.
|
||||
- **Operating system integration.** Microsoft Defender SmartScreen is integrated into the Windows 10 operating system. It checks any files an app (including 3rd-party browsers and email clients) attempts to download and run.
|
||||
|
||||
- **Improved heuristics and diagnostic data.** Microsoft Defender SmartScreen is constantly learning and endeavoring to stay up-to-date, so it can help to protect you against potentially malicious sites and files.
|
||||
- **Improved heuristics and diagnostic data.** Microsoft Defender SmartScreen is constantly learning and endeavoring to stay up to date, so it can help to protect you against potentially malicious sites and files.
|
||||
|
||||
- **Management through Group Policy and Microsoft Intune.** Microsoft Defender SmartScreen supports using both Group Policy and Microsoft Intune settings. For more info about all available settings, see [Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings](microsoft-defender-smartscreen-available-settings.md).
|
||||
|
||||
@ -60,7 +60,7 @@ Microsoft Defender SmartScreen provide an early warning system against websites
|
||||
|
||||
If you believe a warning or block was incorrectly shown for a file or application, or if you believe an undetected file is malware, you can [submit a file](https://www.microsoft.com/wdsi/filesubmission/) to Microsoft for review. For more info, see [Submit files for analysis](https://docs.microsoft.com/windows/security/threat-protection/intelligence/submission-guide).
|
||||
|
||||
When submitting Microsoft Defender Smartscreen products, make sure to select **Microsoft Defender SmartScreen** from the product menu.
|
||||
When submitting Microsoft Defender SmartScreen products, make sure to select **Microsoft Defender SmartScreen** from the product menu.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -69,7 +69,7 @@ The following table compares the features and functions of Software Restriction
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Enforcement mode</p></td>
|
||||
<td align="left"><p>SRP works in the “deny list mode” where administrators can create rules for files that they do not want to allow in this Enterprise whereas the rest of the file are allowed to run by default.</p>
|
||||
<td align="left"><p>SRP works in the “deny list mode” where administrators can create rules for files that they do not want to allow in this Enterprise whereas the rest of the file is allowed to run by default.</p>
|
||||
<p>SRP can also be configured in the “allow list mode” so that by default all files are blocked and administrators need to create allow rules for files that they want to allow.</p></td>
|
||||
<td align="left"><p>AppLocker by default works in the “allow list mode” where only those files are allowed to run for which there is a matching allow rule.</p></td>
|
||||
</tr>
|
||||
@ -146,12 +146,12 @@ The following table compares the features and functions of Software Restriction
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Support for rule exceptions</p></td>
|
||||
<td align="left"><p>SRP does not support rule exceptions.</p></td>
|
||||
<td align="left"><p>AppLocker rules can have exceptions which allow you to create rules such as “Allow everything from Windows except for regedit.exe”.</p></td>
|
||||
<td align="left"><p>AppLocker rules can have exceptions, which allow you to create rules such as “Allow everything from Windows except for regedit.exe”.</p></td>
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Support for audit mode</p></td>
|
||||
<td align="left"><p>SRP does not support audit mode. The only way to test SRP policies is to set up a test environment and run a few experiments.</p></td>
|
||||
<td align="left"><p>AppLocker supports audit mode which allows you to test the effect of their policy in the real production environment without impacting the user experience. Once you are satisfied with the results, you can start enforcing the policy.</p></td>
|
||||
<td align="left"><p>AppLocker supports audit mode, which allows you to test the effect of their policy in the real production environment without impacting the user experience. Once you are satisfied with the results, you can start enforcing the policy.</p></td>
|
||||
</tr>
|
||||
<tr class="odd">
|
||||
<td align="left"><p>Support for exporting and importing policies</p></td>
|
||||
@ -160,8 +160,8 @@ The following table compares the features and functions of Software Restriction
|
||||
</tr>
|
||||
<tr class="even">
|
||||
<td align="left"><p>Rule enforcement</p></td>
|
||||
<td align="left"><p>Internally, SRP rules enforcement happens in the user-mode which is less secure.</p></td>
|
||||
<td align="left"><p>Internally, AppLocker rules for .exe and .dll files are enforced in the kernel-mode which is more secure than enforcing them in the user-mode.</p></td>
|
||||
<td align="left"><p>Internally, SRP rules enforcement happens in the user-mode, which is less secure.</p></td>
|
||||
<td align="left"><p>Internally, AppLocker rules for .exe and .dll files are enforced in the kernel-mode, which is more secure than enforcing them in the user-mode.</p></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user