You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/attack-surface-reduction-rules-report.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -68,7 +68,7 @@ To access the attack surface reduction rules report in the Microsoft Defender po
68
68
69
69
To assign these permissions:
70
70
71
-
1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com].
71
+
1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com).
72
72
73
73
2. In the navigation pane, select **Settings**\>**Endpoints**\>**Roles** (under **Permissions**).
74
74
@@ -114,7 +114,7 @@ Selecting the **ASR rules detections** link at the top of the card also opens th
114
114
115
115
The top section focuses on three recommended rules, which protect against common attack techniques. This card shows current-state information about the computers in your organization that have the following [Three \(ASR\) standard protection rules](#simplified-standard-protection-option) set in **Block mode**, **Audit mode**, or **off** (not configured). The **Protect devices** button shows full configuration details for only the three rules; customers can quickly take action to enable these rules.
116
116
117
-
The bottom section surfaces six rules based on the number of unprotected devices per rule. The "View configuration" button surfaces all configuration details for all ASR rules. The "Add exclusion" button shows the **add exclusion** page with all detected file/process names listed for Security Operation Center (SOC) to evaluate. The **Add exclusion** page is linked to Microsoft Intune.
117
+
The bottom section surfaces six rules based on the number of unprotected devices per rule. The **View configuration** button surfaces all configuration details for all ASR rules. The **Add exclusions** button shows the **add exclusion** page with all detected file/process names listed for Security Operation Center (SOC) to evaluate. The **Add exclusion** page is linked to Microsoft Intune.
118
118
119
119
The card also includes two action buttons:
120
120
@@ -258,8 +258,8 @@ To enable ASR rules:
258
258
259
259
:::image type="content" source="media/attack-surface-reduction-rules-report-configuration-add-to-policy.png" alt-text="Shows the ASR rules fly-out to add ASR rules to devices" lightbox="media/attack-surface-reduction-rules-report-configuration-add-to-policy.png":::
260
260
261
-
> [NOTE!]
262
-
> If you have devices that require that different ASR rules be applied, you should configure those devices individually.
261
+
> [NOTE!]
262
+
> If you have devices that require that different ASR rules be applied, you should configure those devices individually.
@@ -269,24 +269,24 @@ The **Add exclusions** tab presents a ranked list of detections by file name and
269
269
-**Detections**: The total number of detected events for named file. Individual devices can trigger multiple ASR rules events.
270
270
-**Devices**: The number of devices on which the detection occurred.
271
271
272
-
>:::image type="content" source="media/attack-surface-reduction-rules-report-exclusion-tab.png" alt-text="Shows the ASR rules report add exclusions tab" lightbox="media/attack-surface-reduction-rules-report-exclusion-tab.png":::
272
+
:::image type="content" source="media/attack-surface-reduction-rules-report-exclusion-tab.png" alt-text="Shows the ASR rules report add exclusions tab." lightbox="media/attack-surface-reduction-rules-report-exclusion-tab.png":::
273
273
274
274
> [!IMPORTANT]
275
275
> Excluding files or folders can severely reduce the protection provided by ASR rules. Excluded files are allowed to run, and no report or event is recorded.
276
276
> If ASR rules are detecting files that you believe shouldn't be detected, you should [use audit mode first to test the rule](attack-surface-reduction-rules-deployment-test.md#step-1-test-attack-surface-reduction-rules-using-audit).
277
277
278
278
When you select a file, a **Summary & expected impact** fly out opens, presenting the following types of information:
279
279
280
-
-**Files selected** The number of files you've selected for exclusion
281
-
-**(_number of_) detections** States the expected reduction in detections after adding the selected exclusions. The reduction in detections is represented graphically for **Actual detections** and **Detections after exclusions**
282
-
-**(_number of_) affected devices** States the expected reduction in devices that report detections for the selected exclusions.
280
+
-**Files selected**- The number of files you've selected for exclusion
281
+
-**(_number of_) detections**- States the expected reduction in detections after adding the selected exclusions. The reduction in detections is represented graphically for **Actual detections** and **Detections after exclusions**.
282
+
-**(_number of_) affected devices**- States the expected reduction in devices that report detections for the selected exclusions.
283
283
284
284
The Add exclusion page has two buttons for actions that can be used on any detected files (after selection). You can:
285
285
286
-
-**Add exclusion** which opens Microsoft Intune ASR policy page. For more information, see:[Intune](enable-attack-surface-reduction.md) in "Enable ASR rules alternate configuration methods."
287
-
-**Get exclusion paths** which downloads file paths in a csv format
286
+
-**Add exclusion** which opens Microsoft Intune ASR policy page. For more information, see [Intune](enable-attack-surface-reduction.md) in "Enable ASR rules alternate configuration methods."
287
+
-**Get exclusion paths** which downloads file paths in a csv format.
288
288
289
-
:::image type="content" source="media/attack-surface-reduction-rules-report-main-add-exclusions-flyout.png" alt-text="Shows the ASR rules report add exclusions tab flyout impact summary" lightbox="media/attack-surface-reduction-rules-report-main-add-exclusions-flyout.png":::
289
+
:::image type="content" source="media/attack-surface-reduction-rules-report-main-add-exclusions-flyout.png" alt-text="Shows the ASR rules report add exclusions tab flyout impact summary." lightbox="media/attack-surface-reduction-rules-report-main-add-exclusions-flyout.png":::
0 commit comments