You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/discovery-docker-ubuntu-azure.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -46,7 +46,7 @@ If you require more than 10 data sources, we recommend that you split the data s
46
46
To work with a network appliance that isn't listed, select **Other > Customer log format** or **Other (manual only)**. For more information, see [Working with the custom log parser](custom-log-parser.md).
47
47
48
48
>[!NOTE]
49
-
>Integrating with secure transfer protocols (FTPS and Syslog – TLS) often requires additional settings or your firewall/proxy.
49
+
>Integrating with secure transfer protocols (FTPS and Syslog – TLS) often requires additional settings on your firewall/proxy. For more information, see [Advanced log collector management](log-collector-advanced-management.md).
50
50
51
51
Repeat this process for each firewall and proxy whose logs can be used to detect traffic on your network.
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/log-collector-advanced-management.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -50,9 +50,9 @@ You should be able to view the following contents:
50
50
- `ssl_update`
51
51
- `config.json`
52
52
53
-
### Customize certificate files
53
+
### Add certificate files
54
54
55
-
This procedure describes how to customize the certificate files used for secure connections to the cloud discovery Docker instance.
55
+
This procedure describes how to add the required certificate files used for secure connections to the cloud discovery Docker instance.
56
56
57
57
1. Open an FTP client and connect to the log collector host.
58
58
@@ -63,7 +63,7 @@ This procedure describes how to customize the certificate files used for secure
63
63
|**FTP**|- **pure-ftpd.pem**: Includes the key and certificate data |
64
64
|**Syslog**|- **ca.pem**: The certificate authority's certificate that was used to sign the client’s certificate. <br>- **server-key.pem** and **server-cert.pem**: The log collector's certificate and key <br><br>Syslog messages are sent over TLS to the log collector, which requires mutual TLS authentication, including authenticating both the client and server certificates. |
65
65
66
-
Filenames are mandatory. If any of the files are missing, the update fails.
66
+
Files are mandatory. If any of the filesfor the receiver type are missing, the update fails.
To secure the docker image and ensure that only one IP address is allowed to send the syslog messages to the log collector, create an IP table rule on the host machine to allow input traffic and drop the traffic coming over specific ports, such as TCP/601 or UDP/514, depending on the deployment.
163
163
164
-
The following command shows an example of how to create an IP table rule that can be added to the host machine. This table rule allows the IP address `1.2.3.4`` to connect to the log collector container over TCP port 601, and drop all other connections coming from other IP addresses over the same port.
164
+
The following command shows an example of how to create an IP table rule that can be added to the host machine. This table rule allows the IP address `1.2.3.4` to connect to the log collector container over TCP port 601, and drop all other connections coming from other IP addresses over the same port.
Copy file name to clipboardExpand all lines: defender-endpoint/mac-whatsnew.md
+22-8Lines changed: 22 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,9 +2,8 @@
2
2
title: What's new in Microsoft Defender for Endpoint on Mac
3
3
description: Learn about the major changes for previous versions of Microsoft Defender for Endpoint on Mac.
4
4
ms.service: defender-endpoint
5
-
author: emmwalshh
6
-
ms.author: ewalsh
7
-
ms.reviewer: joshbregman
5
+
author: deniseb
6
+
ms.author: deniseb
8
7
manager: deniseb
9
8
ms.localizationpriority: medium
10
9
ms.date: 01/24/2025
@@ -16,6 +15,7 @@ ms.collection:
16
15
ms.topic: reference
17
16
ms.subservice: macos
18
17
search.appverid: met150
18
+
ms.reviewer: mavel
19
19
---
20
20
21
21
# What's new in Microsoft Defender for Endpoint on Mac
@@ -64,18 +64,32 @@ If an end user encounters a prompt for Defender for Endpoint on macOS processes
64
64
65
65
Behavior monitoring monitors process behavior to detect and analyze potential threats based on the behavior of the applications, daemons, and files within the system. As behavior monitoring observes how the software behaves in real-time, it can adapt quickly to new and evolving threats and block them. To learn more, see [Behavior Monitoring in Microsoft Defender for Endpoint on macOS](behavior-monitor-macos.md).
- Removed support of macOS 12, the minimal requirement is now macOS 13.0 or later
78
+
- Fix: Defender quarantines a file even if it is marked as immutable
79
+
-`mdatp health` can return [`out_of_date`](device-health-microsoft-defender-antivirus-health.md#up-to-date-definitions) status for `definitions_status`
-**Improved User/Group Permission Handling** - Added reporting in `mdatp-health` for user/group permission issues for Defender files. On restart Defender attempts to cure these issues.
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
@@ -81,6 +81,9 @@ You can configure anti-malware policies in the Microsoft Defender portal or in P
81
81
- The specified Microsoft 365 Groups.
82
82
-**Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains).
83
83
84
+
> [!TIP]
85
+
> Subdomains are automatically included unless you specifically exclude them. For example, a policy that includes contoso.com also includes marketing.contoso.com unless you exclude marketing.contoso.com.
86
+
84
87
Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value.
85
88
86
89
For users or groups, you can use most identifiers (name, display name, alias, email address, account name, etc.), but the corresponding display name is shown in the results. For users or groups, enter an asterisk (\*) by itself to see all available values.
Copy file name to clipboardExpand all lines: defender-office-365/anti-phishing-policies-eop-configure.md
+4-1Lines changed: 4 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ ms.custom:
16
16
description: Admins can learn how to create, modify, and delete the anti-phishing policies that are available in Exchange Online Protection (EOP) organizations with or without Exchange Online mailboxes.
@@ -78,6 +78,9 @@ For anti-phishing policy procedures in organizations with Microsoft Defender for
78
78
- The specified Microsoft 365 Groups.
79
79
-**Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains).
80
80
81
+
> [!TIP]
82
+
> Subdomains are automatically included unless you specifically exclude them. For example, a policy that includes contoso.com also includes marketing.contoso.com unless you exclude marketing.contoso.com.
83
+
81
84
Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value.
82
85
83
86
For users or groups, you can use most identifiers (name, display name, alias, email address, account name, etc.), but the corresponding display name is shown in the results. For users or groups, enter an asterisk (\*) by itself to see all available values.
Copy file name to clipboardExpand all lines: defender-office-365/anti-phishing-policies-mdo-configure.md
+4-1Lines changed: 4 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ ms.custom:
16
16
description: Admins can learn how to create, modify, and delete the advanced anti-phishing policies that are available in organizations with Microsoft Defender for Office 365.
17
17
ms.service: defender-office-365
18
18
search.appverid: met150
19
-
ms.date: 4/8/2024
19
+
ms.date: 01/29/2025
20
20
appliesto:
21
21
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
@@ -84,6 +84,9 @@ For anti-phishing policy procedures in organizations without Defender for Office
84
84
- The specified Microsoft 365 Groups.
85
85
-**Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains).
86
86
87
+
> [!TIP]
88
+
> Subdomains are automatically included unless you specifically exclude them. For example, a policy that includes contoso.com also includes marketing.contoso.com unless you exclude marketing.contoso.com.
89
+
87
90
Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value.
88
91
89
92
For users or groups, you can use most identifiers (name, display name, alias, email address, account name, etc.), but the corresponding display name is shown in the results. For users or groups, enter an asterisk (\*) by itself to see all available values.
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
@@ -86,6 +86,9 @@ You can configure anti-spam policies in the Microsoft Defender portal or in Powe
86
86
- The specified Microsoft 365 Groups.
87
87
-**Domains**: All recipients in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains).
88
88
89
+
> [!TIP]
90
+
> Subdomains are automatically included unless you specifically exclude them. For example, a policy that includes contoso.com also includes marketing.contoso.com unless you exclude marketing.contoso.com.
91
+
89
92
Click in the appropriate box, start typing a value, and then select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value.
90
93
91
94
For users or groups, you can use most identifiers (name, display name, alias, email address, account name, etc.), but the corresponding display name is shown in the results. For users or groups, enter an asterisk (\*) by itself to see all available values.
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
@@ -78,6 +78,9 @@ You can configure outbound spam policies in the Microsoft Defender portal or in
78
78
- The specified Microsoft 365 Groups.
79
79
-**Domains**: All senders in the organization with a primary email address in the specified [accepted domain](/exchange/mail-flow-best-practices/manage-accepted-domains/manage-accepted-domains).
80
80
81
+
> [!TIP]
82
+
> Subdomains are automatically included unless you specifically exclude them. For example, a policy that includes contoso.com also includes marketing.contoso.com unless you exclude marketing.contoso.com.
83
+
81
84
Click in the appropriate box, start typing a value, and select the value that you want from the results. Repeat this process as many times as necessary. To remove an existing value, select :::image type="icon" source="media/m365-cc-sc-remove-selection-icon.png" border="false"::: next to the value.
82
85
83
86
For users or groups, you can use most identifiers (name, display name, alias, email address, account name, etc.), but the corresponding display name is shown in the results. For users or groups, enter an asterisk (\*) by itself to see all available values.
0 commit comments