Skip to content

Commit 23ee190

Browse files
batamigbatamig
authored
Merge branch 'main' into batamig-patch-3
2 parents cd8a86a + b4ae113 commit 23ee190

38 files changed

+201
-202
lines changed

‎defender-endpoint/api/device-health-api-methods-properties.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ Retrieves a list of Microsoft Defender Antivirus device health details. This API
4848
Data that is collected using either '_JSON response_ or _via files_' is the current snapshot of the current state. It doesn't contain historic data. To collect historic data, customers must save the data in their own data storages.
4949

5050
> [!IMPORTANT]
51-
> For Windows Server 2012 R2 and Windows Server 2016 to appear in device health reports, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](../configure-server-endpoints.md#windows-server-2016-functionality-in-the-modern-unified-solution).
51+
> For Windows Server 2012 R2 and Windows Server 2016 to appear in device health reports, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](../configure-server-endpoints.md#functionality-in-the-modern-unified-solution).
5252
>
5353
> For information about using the **Device health and antivirus compliance** reporting tool in the Microsoft 365 Security dashboard, see: [Device health and antivirus report in Microsoft Defender for Endpoint](../device-health-reports.md).
5454

‎defender-endpoint/api/device-health-export-antivirus-health-report-api.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@ Data that is collected using either '_JSON response_ or _via files_' is the curr
5454
5555
> [!IMPORTANT]
5656
>
57-
> For Windows Server 2012 R2 and Windows Server 2016 to appear in device health reports, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](../configure-server-endpoints.md#windows-server-2016-functionality-in-the-modern-unified-solution).
57+
> For Windows Server 2012 R2 and Windows Server 2016 to appear in device health reports, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](../configure-server-endpoints.md#functionality-in-the-modern-unified-solution).
5858
5959
> [!NOTE]
6060
>

‎defender-endpoint/attack-surface-reduction-rules-reference.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ The following table lists the supported operating systems for rules that are cur
113113
>
114114
> Unless otherwise indicated, the minimum Windows 10 build is version 1709 (RS3, build 16299) or later; the minimum Windows Server build is version 1809 or later.
115115
>
116-
> Attack surface reduction rules in Windows Server 2012 R2 and Windows Server 2016 are available for devices onboarded using the modern unified solution package. For more information, see [New Windows Server 2012 R2 and 2016 functionality in the modern unified solution](configure-server-endpoints.md#windows-server-2016-functionality-in-the-modern-unified-solution).
116+
> Attack surface reduction rules in Windows Server 2012 R2 and Windows Server 2016 are available for devices onboarded using the modern unified solution package. For more information, see [New Windows Server 2012 R2 and 2016 functionality in the modern unified solution](configure-server-endpoints.md#functionality-in-the-modern-unified-solution).
117117
118118
| Rule name| Windows&nbsp;11 <br>and<br> Windows&nbsp;10 | Windows&nbsp;Server <br> 2022 <br>and<br> Windows&nbsp;Server <br> 2019 | Windows Server | Windows&nbsp;Server <br> 2016 <sup>[[1, 2](#fn1)]</sup> | Windows&nbsp;Server <br> 2012&nbsp;R2 <sup>[[1, 2](#fn1)]</sup> |
119119
|:---|:---:|:---:|:---:|:---:|:---:|

‎defender-endpoint/attack-surface-reduction-rules-report.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ For more information about individual attack surface reduction rules, see [Attac
5656

5757
> [!IMPORTANT]
5858
> To access the **Attack surface reduction rules report**, read permissions are required for the Microsoft Defender portal. Access to this report granted by Microsoft Entra roles, such as Security Global Admin or Security role, is being deprecated and will be removed in April 2023.
59-
> For Windows&nbsp;Server&nbsp;2012&nbsp;R2 and Windows&nbsp;Server&nbsp;2016 to appear in the **Attack surface reduction rules report**, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](configure-server-endpoints.md#windows-server-2016-functionality-in-the-modern-unified-solution).
59+
> For Windows&nbsp;Server&nbsp;2012&nbsp;R2 and Windows&nbsp;Server&nbsp;2016 to appear in the **Attack surface reduction rules report**, these devices must be onboarded using the modern unified solution package. For more information, see [New functionality in the modern unified solution for Windows Server 2012 R2 and 2016](configure-server-endpoints.md#functionality-in-the-modern-unified-solution).
6060
6161
## Report access permissions
6262

‎defender-endpoint/attack-surface-reduction.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ You can set attack surface reduction rules for devices that are running any of t
141141
- [Windows Server 2012 R2](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh801901(v=ws.11))
142142

143143
> [!NOTE]
144-
> Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2016) for this feature to work.
144+
> Windows Server 2016 and Windows Server 2012 R2 must be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2016-and-windows-server-2012-r2) for this feature to work.
145145
146146
Although attack surface reduction rules don't require a [Windows E5 license](/windows/deployment/deploy-enterprise-licenses), if you have Windows E5, you get advanced management capabilities. The advanced capabilities - available only in Windows E5 - include:
147147

‎defender-endpoint/automated-investigations.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ Currently, AIR only supports the following OS versions:
9292
- Windows 11
9393

9494
> [!NOTE]
95-
> Automated investigation and response on Windows Server 2012 R2 and Windows Server 2016 requires the [Unified Agent](configure-server-endpoints.md#windows-server-2016-functionality-in-the-modern-unified-solution) to be installed.
95+
> Automated investigation and response on Windows Server 2012 R2 and Windows Server 2016 requires the [Unified Agent](configure-server-endpoints.md#functionality-in-the-modern-unified-solution) to be installed.
9696
9797
## Next steps
9898

‎defender-endpoint/behavior-monitor-macos.md‎

Lines changed: 87 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -71,71 +71,71 @@ The following sections describe each of these methods in detail.
7171
<?xml version="1.0" encoding="UTF-8"?>
7272
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
7373
<plist version="1.0">
74-
<dict>
75-
        <key>PayloadUUID</key>
76-
        <string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
77-
        <key>PayloadType</key>
78-
        <string>Configuration</string>
79-
        <key>PayloadOrganization</key>
80-
        <string>Microsoft</string>
81-
        <key>PayloadIdentifier</key>
82-
        <string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
83-
        <key>PayloadDisplayName</key>
84-
        <string>Microsoft Defender for Endpoint settings</string>
85-
        <key>PayloadDescription</key>
86-
        <string>Microsoft Defender for Endpoint configuration settings</string>
87-
        <key>PayloadVersion</key>
88-
        <integer>1</integer>
89-
        <key>PayloadEnabled</key>
90-
        <true/>
91-
        <key>PayloadRemovalDisallowed</key>
92-
        <true/>
93-
        <key>PayloadScope</key>
94-
        <string>System</string>
95-
        <key>PayloadContent</key>
96-
        <array>
97-
            <dict>
98-
                <key>PayloadUUID</key>
99-
                <string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
100-
                <key>PayloadType</key>
101-
                <string>com.microsoft.wdav</string>
102-
                <key>PayloadOrganization</key>
103-
                <string>Microsoft</string>
104-
                <key>PayloadIdentifier</key>
105-
                <string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
106-
                <key>PayloadDisplayName</key>
107-
                <string>Microsoft Defender for Endpoint configuration settings</string>
108-
                <key>PayloadDescription</key>
109-
                <string/>
110-
                <key>PayloadVersion</key>
111-
                <integer>1</integer>
112-
                <key>PayloadEnabled</key>
113-
                <true/>
114-
              <key>antivirusEngine</key>
115-
              <dict>
116-
                            <key>behaviorMonitoring</key>
117-
                           <string>enabled</string>
118-
              </dict>
119-
              <key>features</key>
120-
              <dict>
121-
                            <key>behaviorMonitoring</key>
122-
                           <string>enabled</string>
123-
              <key>behaviorMonitoringConfigurations</key>
124-
                           <dict>
125-
                                 <key>blockExecution</key>
126-
                                 <string>enabled</string>
127-
                                 <key>notifyForks</key>
128-
                                 <string>enabled</string>
129-
                                 <key>forwardRtpToBm</key>
130-
                                 <string>enabled</string>
131-
                                 <key>avoidOpenCache</key>
132-
                                 <string>enabled</string>
133-
                           </dict>
134-
              </dict>
135-
</dict>
74+
<dict>
75+
<key>PayloadUUID</key>
76+
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
77+
<key>PayloadType</key>
78+
<string>Configuration</string>
79+
<key>PayloadOrganization</key>
80+
<string>Microsoft</string>
81+
<key>PayloadIdentifier</key>
82+
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
83+
<key>PayloadDisplayName</key>
84+
<string>Microsoft Defender for Endpoint settings</string>
85+
<key>PayloadDescription</key>
86+
<string>Microsoft Defender for Endpoint configuration settings</string>
87+
<key>PayloadVersion</key>
88+
<integer>1</integer>
89+
<key>PayloadEnabled</key>
90+
<true/>
91+
<key>PayloadRemovalDisallowed</key>
92+
<true/>
93+
<key>PayloadScope</key>
94+
<string>System</string>
95+
<key>PayloadContent</key>
96+
<array>
97+
<dict>
98+
<key>PayloadUUID</key>
99+
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
100+
<key>PayloadType</key>
101+
<string>com.microsoft.wdav</string>
102+
<key>PayloadOrganization</key>
103+
<string>Microsoft</string>
104+
<key>PayloadIdentifier</key>
105+
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
106+
<key>PayloadDisplayName</key>
107+
<string>Microsoft Defender for Endpoint configuration settings</string>
108+
<key>PayloadDescription</key>
109+
<string/>
110+
<key>PayloadVersion</key>
111+
<integer>1</integer>
112+
<key>PayloadEnabled</key>
113+
<true/>
114+
<key>antivirusEngine</key>
115+
<dict>
116+
<key>behaviorMonitoring</key>
117+
<string>enabled</string>
118+
</dict>
119+
<key>features</key>
120+
<dict>
121+
<key>behaviorMonitoring</key>
122+
<string>enabled</string>
123+
<key>behaviorMonitoringConfigurations</key>
124+
<dict>
125+
<key>blockExecution</key>
126+
<string>enabled</string>
127+
<key>notifyForks</key>
128+
<string>enabled</string>
129+
<key>forwardRtpToBm</key>
130+
<string>enabled</string>
131+
<key>avoidOpenCache</key>
132+
<string>enabled</string>
133+
</dict>
134+
</dict>
135+
</dict>
136+
</array>
137+
</dict>
136138
</plist>
137-
</array>
138-
</dict>
139139
```
140140

141141
2. Open **Devices** > **Configuration profiles**.
@@ -154,29 +154,29 @@ The following sections describe each of these methods in detail.
154154
<?xml version="1.0" encoding="UTF-8"?>
155155
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
156156
<plist version="1.0">
157-
<dict>
158-
              <key>antivirusEngine</key>
159-
              <dict>
160-
                            <key>behaviorMonitoring</key>
161-
                           <string>enabled</string>
162-
              </dict>
163-
              <key>features</key>
164-
              <dict>
165-
                            <key>behaviorMonitoring</key>
166-
                           <string>enabled</string>
167-
              <key>behaviorMonitoringConfigurations</key>
168-
                           <dict>
169-
                                 <key>blockExecution</key>
170-
                                         <string>enabled</string>
171-
                                 <key>notifyForks</key>
172-
                                         <string>enabled</string>
173-
                                 <key>forwardRtpToBm</key>
174-
                                         <string>enabled</string>
175-
                                 <key>avoidOpenCache</key>
176-
                                         <string>enabled</string>
177-
                           </dict>
178-
              </dict>
179-
</dict>
157+
<dict>
158+
<key>antivirusEngine</key>
159+
<dict>
160+
<key>behaviorMonitoring</key>
161+
<string>enabled</string>
162+
</dict>
163+
<key>features</key>
164+
<dict>
165+
<key>behaviorMonitoring</key>
166+
string>enabled</string>
167+
<key>behaviorMonitoringConfigurations</key>
168+
<dict>
169+
<key>blockExecution</key>
170+
<string>enabled</string>
171+
<key>notifyForks</key>
172+
<string>enabled</string>
173+
<key>forwardRtpToBm</key>
174+
<string>enabled</string>
175+
<key>avoidOpenCache</key>
176+
<string>enabled</string>
177+
</dict>
178+
</dict>
179+
</dict>
180180
</plist>
181181
```
182182

@@ -215,9 +215,6 @@ For more information on how to test for a behavior monitoring (prevention/block)
215215

216216
### Frequently Asked Questions (FAQ):
217217

218-
#### Do Behavior Monitoring protection alerts show up in the Device timeline and/or Advanced Hunting?
219-
Not at this time, it's in telemetry mode.
220-
221218
#### What if I see an increase in cpu utilization or memory utilization?
222219
Disable Behavior Monitoring and see if the issue goes away.
223220
- If the issue doesn't go away, it is not related to Behavior Monitoring.

‎defender-endpoint/configure-endpoints-vdi.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ The following steps guide you through onboarding VDI devices and highlight steps
7070
### Onboarding steps
7171

7272
> [!NOTE]
73-
> Windows Server 2016 and Windows Server 2012 R2 must be prepared by applying the installation package first using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2016) for this feature to work.
73+
> Windows Server 2016 and Windows Server 2012 R2 must be prepared by applying the installation package first using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2016-and-windows-server-2012-r2) for this feature to work.
7474
7575
1. Open the VDI configuration package .zip file (*WindowsDefenderATPOnboardingPackage.zip*) that you downloaded from the service onboarding wizard. You can also get the package from the <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft Defender portal</a>:
7676

0 commit comments

Comments
 (0)