You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/behavior-monitor-macos.md
+4-3Lines changed: 4 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.author: deniseb
6
6
manager: deniseb
7
7
ms.service: defender-endpoint
8
8
ms.topic: overview
9
-
ms.date: 12/11/2024
9
+
ms.date: 01/02/2025
10
10
ms.subservice: ngp
11
11
audience: ITPro
12
12
ms.collection:
@@ -278,13 +278,14 @@ NRI should have a low impact on network performance. Instead of holding the conn
278
278
279
279
1. Enable network real-time inspection (NRI):
280
280
281
-
```Bash
281
+
```Bash
282
282
283
283
sudo mdatp network-protection remote-settings-override set --value "{\"enableNriMpengineMetadata\" : true}"
284
284
285
285
286
286
```
287
287
288
288
> [!NOTE]
289
-
> While in Public Preview, since the setting is set via a command line, network real-time inspection (NRI) will not persist reboots. You will need to re-enable it.
289
+
> While this feature is in preview, and because the setting is set by using command line, network real-time inspection (NRI) doesn't persist following reboots. You must re-enable it.
Copy file name to clipboardExpand all lines: defender-endpoint/microsoft-defender-endpoint-linux.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.collection:
15
15
ms.topic: conceptual
16
16
ms.subservice: linux
17
17
search.appverid: met150
18
-
ms.date: 12/24/2024
18
+
ms.date: 01/02/2025
19
19
---
20
20
21
21
# Microsoft Defender for Endpoint on Linux
@@ -59,7 +59,7 @@ Microsoft Defender for Endpoint for Linux includes anti-malware and endpoint det
59
59
> [!NOTE]
60
60
> Performance tuning might be needed based on workloads. See [Troubleshoot performance issues for Microsoft Defender for Endpoint on Linux](linux-support-perf.md).
61
61
62
-
- The following Linux server distributions and x64 (AMD64/EM64T) and x86_64 versions are supported:
62
+
- The following Linux server distributions and x64 (AMD64/EM64T) versions are supported:
Copy file name to clipboardExpand all lines: defender-endpoint/onboard-windows-client.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,7 +13,7 @@ ms.collection:
13
13
ms.topic: conceptual
14
14
ms.subservice: onboard
15
15
search.appverid: met150
16
-
ms.date: 04/03/2024
16
+
ms.date: 12/31/2024
17
17
---
18
18
19
19
# Defender for Endpoint onboarding Windows client devices
@@ -30,7 +30,7 @@ ms.date: 04/03/2024
30
30
31
31
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https:%2F%2Faka.ms%2FMDEp2OpenTrial)
32
32
33
-
To onboard Windows client devices, follow the onboarding steps in the [Microsoft Defender portal](https://security.microsoft.com) (Go to **Settings** > **Endpoints** > **Onboarding**). You can onboard any of the supported devices. Depending on the particular device, you're guided ny appropriate steps and are provided with management and deployment tool options suitable for the device.
33
+
To onboard Windows client devices, follow the onboarding steps in the [Microsoft Defender portal](https://security.microsoft.com) (Go to **Settings** > **Endpoints** > **Onboarding**). You can onboard any of the supported devices. Depending on the particular device, you're guided with the appropriate steps according to the management and deployment tool options suitable for the device.
34
34
35
35
Devices in your organization must be configured so that the Defender for Endpoint service can get sensor data from them. There are various methods and deployment tools that you can use to configure the devices in your organization. In general, you identify the client you're onboarding, then follow the corresponding tool appropriate to the device or your environment.
Copy file name to clipboardExpand all lines: defender-xdr/microsoft-sentinel-onboard.md
+2-1Lines changed: 2 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -87,9 +87,10 @@ To connect a Microsoft Sentinel workspace to the Defender portal, complete the f
87
87
1. Choose the workspace you want to connect and select **Next**.
88
88
1. Read and understand the product changes associated with connecting your workspace. These changes include:
89
89
90
+
- Incidents are no longer created by Microsoft Sentinel. They're now created by the correlation engine in the Microsoft Defender portal. This change is reflected in the incident's "incident provider name" field, which now reads "Microsoft Defender XDR."
91
+
- Therefore, any active [Microsoft security incident creation rules](/azure/sentinel/threat-detection#microsoft-security-rules) are deactivated to avoid creating duplicate incidents. The incident creation settings in other types of analytics rules remain as they were, but those settings are implemented in the Defender portal, not in Microsoft Sentinel.
90
92
- Log tables, queries, and functions in the Microsoft Sentinel workspace are also available in advanced hunting within the Defender portal.
91
93
- The Microsoft Sentinel Contributor role is assigned to the Microsoft Threat Protection and WindowsDefenderATP apps within the subscription.
92
-
- Active [Microsoft security incident creation rules](/azure/sentinel/threat-detection#microsoft-security-rules) are deactivated to avoid duplicate incidents. This change only applies to incident creation rules for Microsoft alerts and not to other analytics rules.
93
94
- All alerts related to Defender XDR products are streamed directly from the main Defender XDR data connector to ensure consistency. Make sure you have incidents and alerts from this connector turned on in the workspace.
Content distribution helps you manage content at scale, across tenants in multitenant management in Microsoft Defender XDR. In content distribution, you can create tenant groups to copy existing content, like custom detection rules, from the source tenant to the target tenants you assign during tenant group creation. The content then runs on the target tenant's devices or device groups that you set in the tenant group scope.
25
23
26
24
Distributing content in this manner, across tenants, enables you to organize tenants and content based on categories like business groups or location.
0 commit comments