Skip to content

Commit d0244f7

Browse files
kerodrikerodri
committed
Auto-update: nav, content, or metadata
1 parent 339a6b3 commit d0244f7

File tree

3 files changed

+166
-0
lines changed

3 files changed

+166
-0
lines changed

‎all_links.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# 🔗 Navigation URLs
2+
3+
- [Home](https://tep.cyberpax.cloud/index/)
4+
- [Defender for Endpoint > Endpoint Detection and Response > Alert Tunning > Alert Tuning Quick‐Start Guide (Beginner Edition)](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Alert%20Tunning/Alert-Tuning-Quick%E2%80%90Start-Guide-%28Beginner-Edition%29/)
5+
- [Defender for Endpoint > Endpoint Detection and Response > Alert Tunning > Alert Tuning – Comprehensive Guide (Advanced Edition)](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Alert%20Tunning/Alert-Tuning-%E2%80%93-Comprehensive-Guide-%28Advanced-Edition%29/)
6+
- [Defender for Endpoint > Endpoint Detection and Response > Device Control > How To Configure Device Control On Macos, Use Case 1. Deny Write Access To All Usb Storage Except For Specific Vendorid And Productid Combinations (Jamf)](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Device%20Control/How-to-Configure-Device-Control-on-macOS%2C-Use-case-1.-Deny-write-access-to-all-USB-storage-except-for-specific-VendorID-and-ProductID-combinations-%28Jamf%29/)
7+
- [Defender for Endpoint > Endpoint Detection and Response > Device Control > Using The Device Control Policy Sample Builder](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Device%20Control/Using-the-device-control-policy-sample-builder/)
8+
- [Defender for Endpoint > Endpoint Detection and Response > Microsoft Defender Core Service > Ecs Connectivity Diagnostic](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Microsoft%20Defender%20Core%20Service/ecs_connectivity_diagnostic/)
9+
- [Defender for Endpoint > Endpoint Detection and Response > Tags > Data Driven Tags – Disabled And Isolated In Microsoft Defender For Endpoint](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Tags/Data-Driven%20Tags%20%E2%80%93%20Disabled%20and%20Isolated%20in%20Microsoft%20Defender%20for%20Endpoint/)
10+
- [Defender for Endpoint > Endpoint Detection and Response > Threat Vulnerability Management > Troubleshooting Guide (Tsg) Cve‐2023‐49210 – Openssl Vulnerability In Node‐Openssl Npm Package](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Threat%20Vulnerability%20Management/Troubleshooting-Guide-%28TSG%29-CVE%E2%80%902023%E2%80%9049210-%E2%80%93-OpenSSL-Vulnerability-in-node%E2%80%90openssl-NPM-Package/)
11+
- [Support Tips and Tools > Effective Case Notation Good Practices And Template](https://tep.cyberpax.cloud/Support%20Tips%20and%20Tools/Effective-Case-Notation-Good-practices-and-template/)
12+
- [Support Tips and Tools > How To Craft An Effective Root Cause Analysis (Rca)](https://tep.cyberpax.cloud/Support%20Tips%20and%20Tools/How-to-Craft-an-Effective-Root-Cause-Analysis-%28RCA%29/)
13+
- [Derecho informático > Delitos Informáticos En Costa Rica Mapeo Jurídico‐Técnico Y Controles Att&Ck](https://tep.cyberpax.cloud/Derecho%20inform%C3%A1tico/Delitos-Inform%C3%A1ticos-en-Costa-Rica-Mapeo-Jur%C3%ADdico%E2%80%90T%C3%A9cnico-y-Controles-ATT%26CK/)
14+
- [Derecho informático > Reflexión, Bienes Jurídicos Tutelados En Una Eventual Legislación De Ia En Costa Rica](https://tep.cyberpax.cloud/Derecho%20inform%C3%A1tico/Reflexi%C3%B3n%2C-Bienes-jur%C3%ADdicos-tutelados-en-una-eventual-legislaci%C3%B3n-de-IA-en-Costa-Rica/)
15+
- [Day-to-Day Stuff > Birthday Reminders](https://tep.cyberpax.cloud/Day-to-Day%20Stuff/birthday-reminders/)
16+
17+
---
18+
19+
# 📄 All Docs URLs
20+
21+
- [/Day-to-Day Stuff/birthday-reminders/](https://tep.cyberpax.cloud/Day-to-Day%20Stuff/birthday-reminders/)
22+
- [/Defender for Endpoint/Endpoint Detection and Response/Alert Tunning/Alert-Tuning-Quick‐Start-Guide-(Beginner-Edition)/](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Alert%20Tunning/Alert-Tuning-Quick%E2%80%90Start-Guide-%28Beginner-Edition%29/)
23+
- [/Defender for Endpoint/Endpoint Detection and Response/Alert Tunning/Alert-Tuning-–-Comprehensive-Guide-(Advanced-Edition)/](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Alert%20Tunning/Alert-Tuning-%E2%80%93-Comprehensive-Guide-%28Advanced-Edition%29/)
24+
- [/Defender for Endpoint/Endpoint Detection and Response/Device Control/How-to-Configure-Device-Control-on-macOS,-Use-case-1.-Deny-write-access-to-all-USB-storage-except-for-specific-VendorID-and-ProductID-combinations-(Jamf)/](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Device%20Control/How-to-Configure-Device-Control-on-macOS%2C-Use-case-1.-Deny-write-access-to-all-USB-storage-except-for-specific-VendorID-and-ProductID-combinations-%28Jamf%29/)
25+
- [/Defender for Endpoint/Endpoint Detection and Response/Device Control/Using-the-device-control-policy-sample-builder/](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Device%20Control/Using-the-device-control-policy-sample-builder/)
26+
- [/Defender for Endpoint/Endpoint Detection and Response/Microsoft Defender Core Service/ecs_connectivity_diagnostic/](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Microsoft%20Defender%20Core%20Service/ecs_connectivity_diagnostic/)
27+
- [/Defender for Endpoint/Endpoint Detection and Response/Tags/Data-Driven Tags – Disabled and Isolated in Microsoft Defender for Endpoint/](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Tags/Data-Driven%20Tags%20%E2%80%93%20Disabled%20and%20Isolated%20in%20Microsoft%20Defender%20for%20Endpoint/)
28+
- [/Defender for Endpoint/Endpoint Detection and Response/Threat Vulnerability Management/Troubleshooting-Guide-(TSG)-CVE‐2023‐49210-–-OpenSSL-Vulnerability-in-node‐openssl-NPM-Package/](https://tep.cyberpax.cloud/Defender%20for%20Endpoint/Endpoint%20Detection%20and%20Response/Threat%20Vulnerability%20Management/Troubleshooting-Guide-%28TSG%29-CVE%E2%80%902023%E2%80%9049210-%E2%80%93-OpenSSL-Vulnerability-in-node%E2%80%90openssl-NPM-Package/)
29+
- [/Derecho informático/Delitos-Informáticos-en-Costa-Rica-Mapeo-Jurídico‐Técnico-y-Controles-ATT&CK/](https://tep.cyberpax.cloud/Derecho%20inform%C3%A1tico/Delitos-Inform%C3%A1ticos-en-Costa-Rica-Mapeo-Jur%C3%ADdico%E2%80%90T%C3%A9cnico-y-Controles-ATT%26CK/)
30+
- [/Derecho informático/Reflexión,-Bienes-jurídicos-tutelados-en-una-eventual-legislación-de-IA-en-Costa-Rica/](https://tep.cyberpax.cloud/Derecho%20inform%C3%A1tico/Reflexi%C3%B3n%2C-Bienes-jur%C3%ADdicos-tutelados-en-una-eventual-legislaci%C3%B3n-de-IA-en-Costa-Rica/)
31+
- [/Support Tips and Tools/Effective-Case-Notation-Good-practices-and-template/](https://tep.cyberpax.cloud/Support%20Tips%20and%20Tools/Effective-Case-Notation-Good-practices-and-template/)
32+
- [/Support Tips and Tools/How-to-Craft-an-Effective-Root-Cause-Analysis-(RCA)/](https://tep.cyberpax.cloud/Support%20Tips%20and%20Tools/How-to-Craft-an-Effective-Root-Cause-Analysis-%28RCA%29/)
33+
- [/index/](https://tep.cyberpax.cloud/index/)

‎docs/Defender for Endpoint/Endpoint Detection and Response/mde_connectivity_channels.md‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
# Understanding Microsoft Defender for Endpoint Connectivity Channels: What They Do and Why They Matter
2+
3+
When deploying Microsoft Defender for Endpoint (MDE), organizations are often told which endpoints and services must be accessible. However, what’s frequently missing is **why** these channels exist and **what functionality breaks** if they're blocked. This article explains each core connectivity channel, provides real-world examples, and clarifies the difference between standard and streamlined connectivity.
4+
5+
For official documentation on configuring your environment, including connectivity requirements, visit:
6+
**[Microsoft Learn - Configure Microsoft Defender for Endpoint in your environment](https://learn.microsoft.com/en-us/defender-endpoint/configure-environment)**
7+
8+
---
9+
10+
## 🧐 CNC Channel (Command and Control)
11+
12+
**Purpose:** Provides centralized control from the Microsoft Defender cloud to the endpoint client (Sense).
13+
14+
**Payloads and Traffic:**
15+
- Heartbeat signals (WinATP traffic)
16+
- Sensor and OS version info
17+
- Remote command dispatching:
18+
- Isolate device
19+
- Restrict app execution
20+
- Run antivirus scan
21+
- Collect investigation package
22+
- Start Live Response session
23+
- Trigger automated investigation
24+
- Configure troubleshooting mode
25+
- Offboarding commands
26+
27+
**Why It Matters:**
28+
Blocking CNC traffic prevents remote security actions. For instance, you wouldn’t be able to isolate a compromised device during an incident. Live Response sessions and forensic data collection would fail.
29+
30+
**Example from ECS Configuration:** The ECS (Experimentation and Configuration Service) sends configuration payloads via CNC to enforce settings such as enabling a feature or toggling troubleshooting mode. URLs like `*.ecs.office.com` must be reachable to ensure consistent policy enforcement. ECS ensures product health and supports controlled rollouts without impacting all users at once.
31+
32+
---
33+
34+
## 📡 Cyber Channel (Telemetry and Reporting)
35+
36+
**Purpose:** Sends telemetry data and security event logs from the device to Microsoft Defender’s cloud backend.
37+
38+
**Payloads and Events:**
39+
- Device and component versions (Defender AV, MOCAMP, engine, definitions)
40+
- Response action results (e.g., AV scan outcome, package collection success)
41+
- Raw telemetry: `DeviceInfoEvents`, `RegistryEvents`, `NetworkEvents`, `FileEvents`, etc.
42+
- Alert and incident data
43+
- Timeline event population
44+
- Security recommendations
45+
- Software inventories and vulnerability insights
46+
- Tags pushed through registry keys
47+
48+
**Why It Matters:**
49+
Without telemetry, the device becomes invisible to SecOps teams. No alerts, incident timelines, or vulnerability reports will show up in the portal. Hunting and correlation tools lose value.
50+
51+
**Example:** A blocked Cyber Channel would prevent reporting of discovered vulnerabilities and KB patch statuses, impacting compliance visibility.
52+
53+
---
54+
55+
## 🗺️ Maps Channel (Cloud-Based Protection)
56+
57+
**Purpose:** Supports Microsoft Defender Antivirus and Endpoint Detection and Response (EDR) cloud functionalities.
58+
59+
**Key Services:**
60+
- Real-time cloud lookups for suspicious files
61+
- Custom indicators (hashes, IPs, URLs)
62+
- Network protection enforcement
63+
- Web content filtering
64+
- EDR block mode
65+
- Tamper Protection toggled via MDE portal
66+
67+
**Why It Matters:**
68+
Cloud-delivered protection is essential for detecting emerging threats and enforcing org-specific threat indicators. Without it, devices fall back to outdated, local-only detection.
69+
70+
**Example:** If `*.wdcp.microsoft.com` or `*.wd.microsoft.com` is blocked, the endpoint cannot perform real-time cloud lookups, severely degrading AV performance.
71+
72+
---
73+
74+
## 🔍 Standard vs Streamlined Connectivity
75+
76+
Microsoft supports two connectivity models:
77+
78+
### Standard Connectivity:
79+
- Requires access to a broader range of domains and URLs.
80+
- Granular separation between features, updates, and telemetry paths.
81+
- Full-featured but complex to configure in restricted environments.
82+
83+
### Streamlined Connectivity:
84+
- Introduced for simpler firewall/proxy configurations.
85+
- Consolidates MDE services under fewer FQDNs like:
86+
- `*.endpoint.security.microsoft.com`
87+
- `*.events.data.microsoft.com`
88+
- `*.ecs.office.com`
89+
- Offers nearly the same capabilities with reduced overhead.
90+
91+
**From Attached Files:** The spreadsheet `mde-streamlined-urls-commercial.xlsx` shows that many URLs for sensor telemetry, Live Response, and feature configuration are unified under the streamlined model, reducing friction for security teams.
92+
93+
---
94+
95+
## 📂 URL-to-Feature Mapping Table
96+
97+
| Feature / Capability | Channel | Example Domains (FQDNs) | Streamlined Available |
98+
|-------------------------------|----------------|--------------------------------------------------|------------------------|
99+
| Device Isolation / Response | CNC | `*.endpoint.security.microsoft.com` | ✅ |
100+
| ECS Config & Troubleshooting | CNC | `*.ecs.office.com` | ✅ |
101+
| Sensor and OS Version Reports | CNC/Cyber | `*.events.data.microsoft.com` | ✅ |
102+
| Telemetry Events & Alerts | Cyber | `*.events.data.microsoft.com` | ✅ |
103+
| Defender AV Cloud Protection | Maps | `*.wdcp.microsoft.com`, `*.wd.microsoft.com` | ✅ |
104+
| Web Content Filtering | Maps | `*.microsoft.com`, `*.cloudfilter.net` (region-dependent) | ✅ |
105+
| Vulnerability Management | Cyber | `*.endpoint.security.microsoft.com` | ✅ |
106+
| Live Response / Package Upload | CNC/Cyber | `*.endpoint.security.microsoft.com`, `*.events.data.microsoft.com` | ✅ |
107+
108+
---
109+
110+
## 🌐 Regional Considerations
111+
112+
MDE connectivity varies slightly based on data residency requirements. From the uploaded spreadsheets:
113+
114+
| Region | Example FQDNs |
115+
|------------------|---------------------------------------------------------------------|
116+
| Commercial | `*.endpoint.security.microsoft.com`, `*.ecs.office.com` |
117+
| GCC High & DoD | `*.endpoint.security.microsoft.us`, `*.config.ecs.dod.teams.microsoft.us` |
118+
| GCC Moderate | `*.gccmod.ecs.office.com` |
119+
120+
Ensure endpoints in regulated environments like the US Government use the region-specific FQDNs listed in the [official documentation](https://learn.microsoft.com/en-us/defender-endpoint/configure-environment).
121+
122+
---
123+
124+
## 🚧 Final Thoughts
125+
126+
Proper configuration of MDE connectivity is not just a best practice — it’s a **requirement** for effective detection, response, and protection. Every blocked call reduces visibility or disables key functionality. ECS and streamlined connectivity models help simplify management while ensuring full-feature coverage.
127+
128+
Ensure the right domains are always reachable, monitor connectivity health, and use logs (like heartbeat or command telemetry) to validate end-to-end operation.
129+
130+
For the most current list of required endpoints and their functions, always refer to:
131+
**[Microsoft Learn - Configure Microsoft Defender for Endpoint in your environment](https://learn.microsoft.com/en-us/defender-endpoint/configure-environment)**
132+

‎mkdocs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ nav:
2323
: Defender for Endpoint/Endpoint Detection and Response/Device Control/How-to-Configure-Device-Control-on-macOS,-Use-case-1.-Deny-write-access-to-all-USB-storage-except-for-specific-VendorID-and-ProductID-combinations-(Jamf).md
2424
- Using The Device Control Policy Sample Builder: Defender for Endpoint/Endpoint
2525
Detection and Response/Device Control/Using-the-device-control-policy-sample-builder.md
26+
- Mde Connectivity Channels: Defender for Endpoint/Endpoint Detection and Response/mde_connectivity_channels.md
2627
- Microsoft Defender Core Service:
2728
- Ecs Connectivity Diagnostic: Defender for Endpoint/Endpoint Detection and
2829
Response/Microsoft Defender Core Service/ecs_connectivity_diagnostic.md

0 commit comments

Comments
 (0)