Skip to content

Commit 456b140

Browse files
authored
Merge pull request #177 from vboyev-MSFT/patch-6
Update defender-endpoint-false-positives-negatives.md -- Emm is reviewing
2 parents 4dba218 + efe4604 commit 456b140

File tree

1 file changed

+2
-0
lines changed

1 file changed

+2
-0
lines changed

defender-endpoint/defender-endpoint-false-positives-negatives.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -212,9 +212,11 @@ To define exclusions across Microsoft Defender for Endpoint, perform the followi
212212

213213
- [Create "allow" indicators for Microsoft Defender for Endpoint](#indicators-for-defender-for-endpoint)
214214
- [Define exclusions for Microsoft Defender Antivirus](#exclusions-for-microsoft-defender-antivirus)
215+
- For Attack Surface Reduction Rule exclusions [Configure attack surface reduction per-rule exclusions](/defender-endpoint/attack-surface-reduction-rules-deployment-test#configure-attack-surface-reduction-per-rule-exclusions) or you can leverage [ASR rule only exclusions](/defender-endpoint/enable-attack-surface-reduction#exclude-files-and-folders-from-attack-surface-reduction-rules)
215216

216217
> [!NOTE]
217218
> Microsoft Defender Antivirus exclusions apply only to antivirus protection, not across other Microsoft Defender for Endpoint capabilities. To exclude files broadly, use [custom indicators](indicators-overview.md) for Microsoft Defender for Endpoint and exclusions for Microsoft Defender Antivirus.
219+
> ASR Rules can leverage ASR Rule Exclusions - where the exclusions apply to all ASR Rules; ASR per Rule Exclusions; Defender AV exclusions; as well as allow indicators defined in Custom Indicators.
218220

219221
The procedures in this section describe how to define indicators and exclusions.
220222

0 commit comments

Comments
 (0)