Skip to content

Commit 0a9e04d

Browse files
authored
Merge branch 'public' into patch-2
2 parents 6a0ca91 + 4b714a8 commit 0a9e04d

File tree

286 files changed

+2242
-1856
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

286 files changed

+2242
-1856
lines changed

.openpublishing.redirection.defender-endpoint.json

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,16 @@
124124
"source_path": "defender-endpoint/non-windows.md",
125125
"redirect_url": "/defender-endpoint/microsoft-defender-endpoint",
126126
"redirect_document_id": true
127+
},
128+
{
129+
"source_path": "defender-endpoint/configure-endpoints-non-windows.md",
130+
"redirect_url": "/defender-endpoint/onboarding",
131+
"redirect_document_id": true
132+
},
133+
{
134+
"source_path": "defender-endpoint/configure-server-endpoints.md",
135+
"redirect_url": "/defender-endpoint/onboard-windows-server-2012r2-2016",
136+
"redirect_document_id": true
127137
}
128138
]
129139
}

ATADocs/ATA-versions.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,9 @@
33

44
title: Advanced Threat Analytics versions
55
description: Explains the different support options for Microsoft Advanced Threat Analytics (ATA) versions.
6-
author: batamig
7-
ms.author: bagol
8-
manager: raynew
6+
7+
8+
99
ms.date: 01/10/2023
1010
ms.topic: conceptual
1111
ms.service: advanced-threat-analytics

ATADocs/ata-architecture.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,6 @@
33

44
title: Advanced Threat Analytics architecture
55
description: Describes the architecture of Microsoft Advance Threat Analytics (ATA)
6-
keywords:
7-
author: batamig
8-
ms.author: bagol
9-
manager: raynew
106
ms.date: 01/10/2023
117
ms.topic: conceptual
128
ms.service: advanced-threat-analytics

ATADocs/ata-capacity-planning.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,6 @@
33

44
title: Planning your Advanced Threat Analytics deployment
55
description: Helps you plan your deployment and decide how many ATA servers will be needed to support your network
6-
keywords:
7-
author: batamig
8-
ms.author: bagol
9-
manager: raynew
106
ms.date: 01/10/2023
117
ms.topic: conceptual
128
ms.service: advanced-threat-analytics

ATADocs/ata-configuration-file.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,6 @@
33

44
title: Export and Import Advanced Threat Analytics Configuration
55
description: How to export and import the ATA configuration.
6-
keywords:
7-
author: batamig
8-
ms.author: bagol
9-
manager: raynew
106
ms.date: 01/10/2023
117
ms.topic: conceptual
128
ms.service: advanced-threat-analytics

ATADocs/ata-database-management.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,6 @@
33

44
title: Advanced Threat Analytics Database Management
55
description: Procedures to help you move, backup, or restore the ATA database.
6-
keywords:
7-
author: batamig
8-
ms.author: bagol
9-
manager: raynew
106
ms.date: 01/10/2023
117
ms.topic: conceptual
128
ms.service: advanced-threat-analytics

ATADocs/ata-health-center.md

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,6 @@
33

44
title: Monitor Advanced Threat Analytics System Health and Events
55
description: Use the ATA Health Center to check how the ATA service is working and be alerted to potential problems and view system events in the Event viewer.
6-
keywords:
7-
author: batamig
8-
ms.author: bagol
9-
manager: raynew
106
ms.date: 01/10/2023
117
ms.topic: conceptual
128
ms.service: advanced-threat-analytics

ATADocs/ata-prerequisites.md

Lines changed: 27 additions & 31 deletions
Large diffs are not rendered by default.

ATADocs/ata-privacy-compliance.md

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,6 @@
33

44
title: Advanced Threat Analytics personal data policy
55
description: Provides links to information about how to delete private information and personal data from ATA.
6-
keywords:
7-
author: batamig
8-
ms.author: bagol
9-
manager: raynew
106
ms.date: 01/10/2023
117
ms.topic: conceptual
128
ms.service: advanced-threat-analytics
@@ -34,7 +30,7 @@ ms.suite: ems
3430

3531
All data in ATA that relates to entities is derived from Active Directory (AD) and replicated to ATA from there. When searching for personal data, the first place you should consider searching is AD.
3632

37-
From the ATA Center, use the search bar to view the identifiable personal data that is stored in the database. Users can search for a specific user or device. Selecting the entity will open the user or device profile page. The profile provides you with the comprehensive details about the entity, it's history, and related network activity derived from AD.
33+
From the ATA Center, use the search bar to view the identifiable personal data that is stored in the database. Users can search for a specific user or device. Selecting the entity opens the user or device profile page. The profile provides you with the comprehensive details about the entity, its history, and related network activity derived from AD.
3834

3935
## Updating personal data
4036

@@ -62,7 +58,7 @@ Running this completely removes the entity with the UPN [email protected] from
6258

6359
### Delete entity activity data
6460

65-
This action permanently deletes an entity's activities data from the ATA database. All entities will are unchanged but the activities and security alerts related to them for the specified timeframe are deleted.
61+
This action permanently deletes an entity's activities data from the ATA database. All entities are unchanged but the activities and security alerts related to them for the specified timeframe are deleted.
6662

6763
To run this command, provide the command name `deleteOldData`, and the number of days of data you want to keep in the database.
6864

ATADocs/ata-resources.md

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,7 @@
22
# required metadata
33

44
title: Advanced Threat Analytics resources and readiness roadmap
5-
description: Provides a list of ATA resources, videos, getting started, deployment and readiness roadmap links.
6-
keywords:
7-
author: batamig
8-
ms.author: bagol
9-
manager: raynew
5+
description: Provides a list of ATA resources, videos, getting started, deployment, and readiness roadmap links.
106
ms.date: 01/10/2023
117
ms.topic: conceptual
128
ms.service: advanced-threat-analytics
@@ -28,7 +24,7 @@ ms.suite: ems
2824

2925
[!INCLUDE [Banner for top of topics](includes/banner.md)]
3026

31-
This article provides you a readiness roadmap that will assist you to get started with Advanced Threat Analytics.
27+
This article provides you with a readiness roadmap that assists you to get started with Advanced Threat Analytics.
3228

3329
## Understanding ATA
3430

@@ -51,31 +47,31 @@ ATA is composed of the ATA Center, which you can install on a server, and ATA Ga
5147
|Gateway sizing|Full Gateway, Lightweight Gateway|
5248
|Certificates|PKI, self-signed|
5349

54-
If you are using physical servers, you should plan capacity. You can get help from the sizing tool to allocate space for ATA:
50+
If you're using physical servers, you should plan capacity. You can get help from the sizing tool to allocate space for ATA:
5551

5652
[ATA sizing tool](ata-capacity-planning.md) - The sizing tool automates the collection of the amount of traffic ATA needs. It automatically provides supportability and resource recommendations for both the ATA Center and ATA Lightweight Gateways.
5753

5854
[ATA capacity planning](ata-capacity-planning.md)
5955

6056
## Deploy ATA
6157

62-
These resources will help you download and install the ATA Center, connect to Active Directory, download the ATA Gateway package, set up event collection, and optionally integrate with your VPN and set up honeytoken accounts and exclusions.
58+
These resources help you download and install the ATA Center, connect to Active Directory, download the ATA Gateway package, set up event collection, and optionally integrate with your VPN and set up honeytoken accounts and exclusions.
6359

6460
[Download ATA](install-ata-step1.md#step-1-download-and-install-the-ata-center)
6561

6662
[ATA POC playbook](https://aka.ms/ataplaybook) - Guide to all the steps necessary to do a successful POC deployment of ATA.
6763

6864
## ATA settings
6965

70-
The basic necessary settings in ATA are configured as part of the installation wizard. However, there are a number of other settings that you can configure to fine-tune ATA that makes detections more accurate for your environment, such as SIEM integration and audit settings.
66+
The basic necessary settings in ATA are configured as part of the installation wizard. However, there are many other settings that you can configure to fine-tune ATA that makes detections more accurate for your environment, such as SIEM integration and audit settings.
7167

7268
[Audit settings](https://github.com/microsoft/Azure-Advanced-Threat-Protection/tree/master/Auditing) – Audit your domain controller health before and after an ATA deployment.
7369

7470
[ATA general documentation](index.yml)
7571

7672
## Work with ATA
7773

78-
After ATA is up and running, you can view suspicious activities that are detected in the Attack timeline. This is the default landing page you are taken to when you log in to the ATA Console. By default, all open suspicious activities are shown on the attack time line. You can also see the severity assigned to each activity. Investigate each suspicious activity by drilling down into the entities (computers, devices, users) to open their profile pages that provide more information. These resources will help you work with ATA's suspicious activities:
74+
After ATA is up and running, you can view suspicious activities that are detected in the Attack timeline. This is the default landing page you're taken to when you sign in to the ATA Console. By default, all open suspicious activities are shown on the attack time line. You can also see the severity assigned to each activity. Investigate each suspicious activity by drilling down into the entities (computers, devices, users) to open their profile pages that provide more information. These resources help you work with ATA's suspicious activities:
7975

8076
[ATA suspicious activity playbook](/samples/browse/?redirectedfrom=TechNet-Gallery) - This article walks you through credential theft attack techniques using readily available research tools on the internet. At each point of the attack, you can see how ATA helps you gain visibility into these threats.
8177

0 commit comments

Comments
 (0)