You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-xdr/entity-page-device.md
+31-30Lines changed: 31 additions & 30 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ ms.author: yelevin
7
7
author: yelevin
8
8
manager: dansimp
9
9
audience: ITPro
10
-
ms.collection:
10
+
ms.collection:
11
11
- m365-security
12
12
- tier3
13
13
- usx-security
@@ -31,7 +31,7 @@ The device entity page in the Microsoft Defender portal helps you in your invest
31
31
> The content set displayed on the device entity page may differ slightly, depending on the device's enrollment in Microsoft Defender for Endpoint and Microsoft Defender for Identity.
32
32
>
33
33
> If your organization onboarded Microsoft Sentinel to the Defender portal, additional information will appear.
34
-
>
34
+
>
35
35
> In Microsoft Sentinel, device entities are also known as **host** entities. [Learn more](/azure/sentinel/entities-reference).
@@ -85,15 +85,15 @@ The **Overview** tab contains the [device details](#device-details) sidebar and
85
85
86
86
The sidebar lists the device's full name and exposure level. It also provides some important basic information in small subsections, which can be expanded or collapsed, such as:
87
87
88
-
|Section|Included information|
89
-
|------- |-------------------- |
90
-
|**VM details**|Machine and domain names and IDs, health and onboarding statuses, timestamps for first and last seen, IP addresses, and more|
91
-
|**DLP policy sync details**|If relevant|
92
-
|**Configuration status**|Details regarding Microsoft Defender for Endpoint configuration|
93
-
|**Cloud resource details**|Cloud platform, resource ID, subscription information, and more|
94
-
|**Hardware and firmware**|VM, processor, and BIOS information, and more|
95
-
|**Device management**|Microsoft Defender for Endpoint enrollment status and management info|
96
-
|**Directory data**|[UAC](/windows/security/identity-protection/user-account-control/user-account-control-overview) flags, [SPNs](/windows/win32/ad/service-principal-names), and group memberships.|
88
+
|Section|Included information|
89
+
|---|---|
90
+
|**VM details**|Machine and domain names and IDs, health and onboarding statuses, timestamps for first and last seen, IP addresses, and more|
91
+
|**DLP policy sync details**|If relevant|
92
+
|**Configuration status**|Details regarding Microsoft Defender for Endpoint configuration|
93
+
|**Cloud resource details**|Cloud platform, resource ID, subscription information, and more|
94
+
|**Hardware and firmware**|VM, processor, and BIOS information, and more|
95
+
|**Device management**|Microsoft Defender for Endpoint enrollment status and management info|
96
+
|**Directory data**|[UAC](/windows/security/identity-protection/user-account-control/user-account-control-overview) flags, [SPNs](/windows/win32/ad/service-principal-names), and group memberships.|
97
97
98
98
### Dashboard
99
99
@@ -282,30 +282,31 @@ Response actions offer shortcuts to analyze, investigate, and defend against thr
282
282
:::image type="content" source="/defender/media/entity-page-device/entity-device-response-actions.png" alt-text="Screenshot of the Action bar for the device entity page in the Microsoft Defender portal.":::
283
283
284
284
> [!IMPORTANT]
285
+
>
285
286
> -[Response actions](/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts) are only available if the device is enrolled in Microsoft Defender for Endpoint.
286
287
> - Devices that are enrolled in Microsoft Defender for Endpoint may display different numbers of response actions, based on the device's OS and version number.
287
288
288
289
Response actions run along the top of a specific device page and include:
289
290
290
-
|Action|Description|
291
-
|------ |----------- |
292
-
|**Device value**||
293
-
|**Set criticality**||
294
-
|**Manage tags**|Updates custom tags you've applied to this device.|
295
-
|**Report device inaccuracy**||
296
-
|**Run Antivirus Scan**|Updates Microsoft Defender Antivirus definitions and immediately runs an antivirus scan. Choose between Quick scan or Full scan.|
297
-
|**Collect Investigation Package**|Gathers information about the device. When the investigation is completed, you can download it.|
298
-
|**Restrict app execution**|Prevents applications that aren't signed by Microsoft from running.|
299
-
|**Initiate automated investigation**|Automatically [investigates and remediates threats](/defender-office-365/air-about). Although you can manually trigger automated investigations to run from this page, [certain alert policies](/Microsoft-365/compliance/alert-policies#default-alert-policies) trigger automatic investigations on their own.|
300
-
|**Initiate Live Response Session**|Loads a remote shell on the device for [in-depth security investigations](/defender-endpoint/live-response).|
301
-
|**Isolate device**|Isolates the device from your organization's network while keeping it connected to Microsoft Defender. You can choose to allow Outlook, Teams, and Skype for Business to run while the device is isolated, for communication purposes.|
302
-
|**Ask Defender Experts**||
303
-
|**Action Center**|Displays information about any response actions that are currently running. Only available if another action has already been selected.|
304
-
|**Download force release from isolation script**||
305
-
|**Exclude**||
306
-
|**Go hunt**||
307
-
|**Turn on troubleshooting mode**||
308
-
|**Policy sync**||
291
+
|Action|Description|
292
+
|---|---|
293
+
|**Device value**||
294
+
|**Set criticality**||
295
+
|**Manage tags**|Updates custom tags you've applied to this device.|
296
+
|**Report device inaccuracy**||
297
+
|**Run Antivirus Scan**|Updates Microsoft Defender Antivirus definitions and immediately runs an antivirus scan. Choose between Quick scan or Full scan.|
298
+
|**Collect Investigation Package**|Gathers information about the device. When the investigation is completed, you can download it.|
299
+
|**Restrict app execution**|Prevents applications that aren't signed by Microsoft from running.|
300
+
|**Initiate automated investigation**|Automatically [investigates and remediates threats](/defender-office-365/air-about). Although you can manually trigger automated investigations to run from this page, [certain alert policies](/Microsoft-365/compliance/alert-policies#default-alert-policies) trigger automatic investigations on their own.|
301
+
|**Initiate Live Response Session**|Loads a remote shell on the device for [in-depth security investigations](/defender-endpoint/live-response).|
302
+
|**Isolate device**|Isolates the device from your organization's network while keeping it connected to Microsoft Defender. You can choose to allow Outlook, Teams, and Skype for Business to run while the device is isolated, for communication purposes.|
303
+
|**Ask Defender Experts**||
304
+
|**Action Center**|Displays information about any response actions that are currently running. Only available if another action has already been selected.|
305
+
|**Download force release from isolation script**||
0 commit comments