You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/enable-adaptive-application-controls.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Enable and manage adaptive application controls
3
-
description: This document helps you enable and manage adaptive application control in Microsoft Defender for Cloud to create an allowlist of applications running for Azure machines.
3
+
description: Learn how to enable and manage adaptive application control in Microsoft Defender for Cloud to create an allowlist of applications running for Azure machines.
4
4
author: dcurwin
5
5
ms.author: dacurwin
6
6
ms.topic: how-to
@@ -45,7 +45,7 @@ Select the recommendation, or open the adaptive application controls page to vie
45
45
46
46
1. Open the **Recommended** tab. The groups of machines with recommended allowlists appear.
47
47
48
-
:::image type="content" source="media/enable-adaptive-application-controls/adaptive-application-recommended-tab.png" alt-text="Screenshot that shows you where on the screen the recommendation tab is.":::
48
+
:::image type="content" source="media/enable-adaptive-application-controls/adaptive-application-recommended-tab.png" alt-text="Screenshot that shows you where on the screen the recommendation tab is.":::
49
49
50
50
1. Select a group.
51
51
@@ -82,7 +82,7 @@ To edit the rules for a group of machines:
82
82
83
83
1. Select **Add rule**.
84
84
85
-
:::image type="content" source="media/enable-adaptive-application-controls/adaptive-application-add-custom-rule.png" alt-text="Screenshot that showsyou where the add rule button is located.":::
85
+
:::image type="content" source="media/enable-adaptive-application-controls/adaptive-application-add-custom-rule.png" alt-text="Screenshot that shows you where the add rule button is located.":::
86
86
87
87
1. If you're defining a known safe path, change the **Rule type** to 'Path' and enter a single path. You can include wildcards in the path. The following screens show some examples of how to use wildcards.
:::image type="content" source="media/enable-adaptive-application-controls/recent-alerts.png" alt-text="Screenshot showing recent alerts in Configured tab.":::
138
138
139
139
1. For further details, and the list of affected machines, select an alert.
140
140
@@ -180,10 +180,10 @@ Some of the functions available from the REST API include:
180
180
>
181
181
> Remove the following properties before using the JSON in the **Put** request: recommendationStatus, configurationStatus, issues, location, and sourceSystem.
182
182
183
-
## Next steps
183
+
## Related content
184
184
185
185
On this page, you learned how to use adaptive application control in Microsoft Defender for Cloud to define allowlists of applications running on your Azure and non-Azure machines. To learn more about some other cloud workload protection features, see:
186
186
187
187
-[Understanding just-in-time (JIT) VM access](just-in-time-access-overview.md)
188
188
-[Securing your Azure Kubernetes clusters](defender-for-kubernetes-introduction.md)
189
-
- View common question about [Adaptive application controls](faq-defender-for-servers.yml)
189
+
- View common question about [Adaptive application controls](faq-defender-for-servers.yml)
@@ -58,7 +59,7 @@ You can enable agentless scanning on
58
59
59
60
1. In the settings pane, turn on **Agentless scanning for machines**.
60
61
61
-
:::image type="content" source="media/enable-vulnerability-assessment-agentless/turn-on-agentles-scanning-azure.png" alt-text="Screenshot of settings and monitoring screen to turn on agentless scanning." lightbox="media/enable-vulnerability-assessment-agentless/turn-on-agentles-scanning-azure.png":::
62
+
:::image type="content" source="media/enable-vulnerability-assessment-agentless/turn-on-agentless-scanning-azure.png" alt-text="Screenshot of settings and monitoring screen to turn on agentless scanning." lightbox="media/enable-vulnerability-assessment-agentless/turn-on-agentless-scanning-azure.png":::
62
63
63
64
1. Select **Save**.
64
65
@@ -90,23 +91,23 @@ After you enable agentless scanning, software inventory and vulnerability inform
90
91
91
92
### Enable agentless scanning in GCP
92
93
93
-
1. In Defender for Cloud, select **Environment settings**.
94
-
1. Select the relevant project or organization.
95
-
1. For either the Defender Cloud Security Posture Management (CSPM) or Defender for Servers P2 plan, select **Settings**.
94
+
1. In Defender for Cloud, select **Environment settings**.
95
+
1. Select the relevant project or organization.
96
+
1. For either the Defender Cloud Security Posture Management (CSPM) or Defender for Servers P2 plan, select **Settings**.
96
97
97
98
:::image type="content" source="media/enable-agentless-scanning-vms/gcp-select-plan.png" alt-text="Screenshot that shows where to select the plan for GCP projects." lightbox="media/enable-agentless-scanning-vms/gcp-select-plan.png":::
98
99
99
100
1. Toggle Agentless scanning to **On**.
100
101
101
102
:::image type="content" source="media/enable-agentless-scanning-vms/gcp-select-agentless.png" alt-text="Screenshot that shows where to select agentless scanning." lightbox="media/enable-agentless-scanning-vms/gcp-select-agentless.png":::
102
103
103
-
1. Select **Save and Next: Configure Access**.
104
+
1. Select **Save and Next: Configure Access**.
104
105
1. Copy the onboarding script.
105
106
1. Run the onboarding script in the GCP organization/project scope (GCP portal or gcloud CLI).
106
-
1. Select **Next: Review and generate**.
107
-
1. Select **Update**.
107
+
1. Select **Next: Review and generate**.
108
+
1. Select **Update**.
108
109
109
-
## Test the agentless malware scanner's deployment
110
+
## Test the agentless malware scanner's deployment
110
111
111
112
Security alerts appear on the portal only in cases where threats are detected on your environment. If you do not have any alerts it may be because there are no threats on your environment. You can test to see that the device is properly onboarded and reporting to Defender for Cloud by creating a test file.
112
113
@@ -167,37 +168,35 @@ The alert `MDC_Test_File malware was detected (Agentless)` will appear within 24
# Write the test string to the file without a trailing newline
185
185
[IO.File]::WriteAllText($FILE_PATH, $TEST_STRING)
186
-
186
+
187
187
# Check if the file was created and contains the correct string
188
188
if (Test-Path -Path $FILE_PATH) {
189
-
$content = [IO.File]::ReadAllText($FILE_PATH)
190
-
if ($content -eq $TEST_STRING) {
191
-
Write-Host "Test file created and validated successfully."
192
-
} else {
193
-
Write-Host "Test file does not contain the correct string."
194
-
}
189
+
$content = [IO.File]::ReadAllText($FILE_PATH)
190
+
if ($content -eq $TEST_STRING) {
191
+
Write-Host "Test file created and validated successfully."
192
+
} else {
193
+
Write-Host "Test file does not contain the correct string."
194
+
}
195
195
} else {
196
-
Write-Host "Failed to create test file."
196
+
Write-Host "Failed to create test file."
197
197
}
198
198
```
199
199
200
-
201
200
The alert `MDC_Test_File malware was detected (Agentless)` will appear within 24 hours in the Defender forCloud Alerts page andin the Defender XDR portal.
202
201
203
202
:::image type="content" source="media/enable-agentless-scanning-vms/test-alert.jpg" alt-text="Screenshot of the test alert that appears in Defender for Cloud for Windows with because of the PowerShell script." lightbox="media/enable-agentless-scanning-vms/test-alert.jpg":::
@@ -221,7 +220,7 @@ Agentless scanning applies to all of the eligible machines in the subscription.
Copy file name to clipboardExpand all lines: articles/defender-for-cloud/enable-defender-for-endpoint.md
+1-3Lines changed: 1 addition & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -304,10 +304,8 @@ To remove the Defender for Endpoint solution from your machines:
304
304
305
305
1. Follow the steps in [Offboard devices from the Microsoft Defender for Endpoint service](/microsoft-365/security/defender-endpoint/offboard-machines) from the Defender for Endpoint documentation.
306
306
307
-
## Next steps
307
+
## Related content
308
308
309
309
- [Platforms and features supported by Microsoft Defender for Cloud](security-center-os-coverage.md)
310
310
- [Learn how recommendations help you protect your Azure resources](review-security-recommendations.md)
311
311
- View common question about the [Defender for Cloud integration with Microsoft Defender for Endpoint](faq-defender-for-servers.yml)
0 commit comments