You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/linux-exclusions.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.collection:
15
15
ms.topic: conceptual
16
16
ms.subservice: linux
17
17
search.appverid: met150
18
-
ms.date: 10/11/2024
18
+
ms.date: 10/14/2024
19
19
---
20
20
21
21
# Configure and validate exclusions for Microsoft Defender for Endpoint on Linux
@@ -32,7 +32,7 @@ ms.date: 10/11/2024
32
32
This article provides information on how to define antivirus and global exclusions for Microsoft Defender for Endpoint. Antivirus exclusions apply to on-demand scans, real-time protection (RTP), and behavior monitoring (BM). Global exclusions apply to real-time protection (RTP), behavior monitoring (BM), and endpoint detection and response (EDR), thus stopping all the associated antivirus detections, EDR alerts, and visibility for the excluded item.
33
33
34
34
> [!IMPORTANT]
35
-
> The antivirus exclusions described in this article apply to only antivirus capabilities and not endpoint detection and response (EDR). Files that you exclude using the antivirus exclusions described in this article can still trigger EDR alerts and other detections. Whereas the global exclusions described in this section apply to antivirus as well as endpoint detection and response capabilities thus stopping all associated AV protection, EDR alerts and detection. Global exclusions are available from Defender for Endpoint version `101.23092.0012` or later till Insider Slow Ring. For EDR exclusions, [contact support](/microsoft-365/admin/get-help-support).
35
+
> The antivirus exclusions described in this article apply to only antivirus capabilities and not to endpoint detection and response (EDR). Files that you exclude using the antivirus exclusions described in this article can still trigger EDR alerts and other detections. Global exclusions described in this section apply to antivirus **and**endpoint detection and response capabilities, thus stopping all associated antivirus protection, EDR alerts, and detections. Global exclusions are currently in public preview, and are available in Defender for Endpoint version `101.23092.0012` or later, in the Insiders Slow and Production rings. For EDR exclusions, [contact support](/microsoft-365/admin/get-help-support).
36
36
37
37
You can exclude certain files, folders, processes, and process-opened files from Defender for Endpoint on Linux.
Copy file name to clipboardExpand all lines: defender-endpoint/linux-preferences.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.service: defender-endpoint
6
6
ms.author: deniseb
7
7
author: denisebmsft
8
8
ms.localizationpriority: medium
9
-
ms.date: 10/11/2024
9
+
ms.date: 10/14/2024
10
10
manager: deniseb
11
11
audience: ITPro
12
12
ms.collection:
@@ -220,7 +220,7 @@ Specifies the behavior of RTP on mount point marked as noexec. There are two val
220
220
221
221
- Unmuted (`unmute`): The default value, all mount points are scanned as part of RTP.
222
222
- Muted (`mute`): Mount points marked as noexec aren't scanned as part of RTP, these mount point can be created for:
223
-
- Database files on Database servers for keeping data base files.
223
+
- Database files on Database servers for keeping database files.
224
224
- File server can keep data files mountpoints with noexec option.
225
225
- Backup can keep data files mountpoints with noexec option.
226
226
@@ -384,9 +384,9 @@ Specify the maximum number of entries to keep in the scan history. Entries inclu
384
384
**Exlusion setting preferences are currently in preview**.
385
385
386
386
> [!NOTE]
387
-
> Available in Defender for Endpoint version `101.23092.0012` or later till Insider Slow Ring.
387
+
> Global exclusions are currently in public preview, and are available in Defender for Endpoint beginning with version `101.23092.0012` or later in the Insiders Slow and Production rings.
388
388
389
-
The *exclusionSettings* section of the configuration profile is used to configure various exclusions for Microsoft Defender for Endpoint for Linux.
389
+
The `exclusionSettings` section of the configuration profile is used to configure various exclusions for Microsoft Defender for Endpoint for Linux.
Copy file name to clipboardExpand all lines: defender-endpoint/linux-whatsnew.md
+24-4Lines changed: 24 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.author: deniseb
6
6
author: denisebmsft
7
7
ms.reviewer: kumasumit, gopkr
8
8
ms.localizationpriority: medium
9
-
ms.date: 10/11/2024
9
+
ms.date: 10/14/2024
10
10
manager: deniseb
11
11
audience: ITPro
12
12
ms.collection:
@@ -34,16 +34,36 @@ This article is updated frequently to let you know what's new in the latest rele
34
34
-[What's new in Defender for Endpoint on iOS](ios-whatsnew.md)
35
35
36
36
> [!IMPORTANT]
37
-
> Starting with version `101.2408.0000`, Microsoft defender for Endpoint for Linux no longer supports the Auditd event provider. We're transitioning completely to the more efficient eBPF technology. This change allows for better performance, reduced resource consumption, and overall improved stability. eBPF support has been available since August 2023 and is fully integrated into all updates of Defender for Endpoint on Linux (version `101.23082.0006` and later). We strongly encourage you to adopt the eBPF build, as it provides significant enhancements over Auditd. If eBPF is not supported on your machines, or if there are specific requirements to remain on Auditd, you have the following options:
37
+
> Starting with version `101.2408.0004`, Defender for Endpoint on Linux no longer supports the `Auditd` event provider. We're transitioning completely to the more efficient eBPF technology. This change allows for better performance, reduced resource consumption, and overall improved stability. eBPF support has been available since August 2023, and is fully integrated into all updates of Defender for Endpoint on Linux (version `101.23082.0006` and later). We strongly encourage you to adopt the eBPF build, as it provides significant enhancements over Auditd. If eBPF is not supported on your machines, or if there are specific requirements to remain on Auditd, you have the following options:
38
38
>
39
-
> 1.Continue to use Defender for Endpoint on Linux build `101.24072.0000` with Auditd. This build will continue to be supported for several months, so you have time to plan and execute your migration to eBPF.
39
+
> 1. Continue to use Defender for Endpoint on Linux build `101.24072.0000` with Auditd. This build will continue to be supported for several months, so you have time to plan and execute your migration to eBPF.
40
40
>
41
-
> 2.If you are on versions later than `101.24072.0000`, Defender for Endpoint on Linux relies on `netlink` as a backup supplementary event provider. In the event of a fallback, all process operations continue to flow seamlessly.
41
+
> 2. If you are on versions later than `101.24072.0000`, Defender for Endpoint on Linux relies on `netlink` as a backup supplementary event provider. In the event of a fallback, all process operations continue to flow seamlessly.
42
42
>
43
43
> Review your current Defender for Endpoint on Linux deployment, and begin planning your migration to the eBPF-supported build. For more information on eBPF and how it works, see [Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux](/defender-endpoint/linux-support-ebpf).
44
44
>
45
45
> If you have any concerns or need assistance during this transition, contact support.
- Starting this version, Defender for Endpoint on Linux no longer supports `AuditD` as a supplementary event provider. For improved stability and performance, we have completely transitioned to eBPF. If you disable eBPF, or in the event eBPF is not supported on any specific kernel, Defender for Endpoint on Linux automatically switches back to Netlink as a fallback supplementary event provider. Netlink provides reduced functionality and tracks only process-related events. In this case, all process operations continue to flow seamlessly, but you could miss specific file and socket-related events that eBPF would otherwise capture. For more details, see [Use eBPF-based sensor for Microsoft Defender for Endpoint on Linux](linux-support-ebpf.md). If you have any concerns or need assistance during this transition, contact support.
Copy file name to clipboardExpand all lines: defender-xdr/copilot-in-defender-device-summary.md
+31-11Lines changed: 31 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,7 +18,7 @@ ms.topic: conceptual
18
18
search.appverid:
19
19
- MOE150
20
20
- MET150
21
-
ms.date: 04/01/2024
21
+
ms.date: 10/04/2024
22
22
appliesto:
23
23
- Microsoft Defender XDR
24
24
- Microsoft Sentinel in the Microsoft Defender portal
@@ -30,13 +30,27 @@ appliesto:
30
30
31
31
[Microsoft Copilot for Security](/security-copilot/microsoft-security-copilot) in the Microsoft Defender portal helps security teams in speeding up device inspection through AI-powered investigation capabilities.
32
32
33
+
## Know before you begin
34
+
35
+
If you're new to Copilot for Security, you should familiarize yourself with it by reading the following articles:
36
+
37
+
-[What is Copilot for Security?](/security-copilot/microsoft-security-copilot)
38
+
-[Copilot for Security experiences](/security-copilot/experiences-security-copilot)
39
+
-[Get started with Copilot for Security](/security-copilot/get-started-security-copilot)
40
+
-[Understand authentication in Copilot for Security](/security-copilot/authentication)
41
+
-[Prompting in Copilot for Security](/security-copilot/prompting-security-copilot)
42
+
33
43
Security operations teams are tasked to sift through device data to find suspicious activities or entities to prevent malicious attacks. These teams need to summarize large amounts of data and simplify complex information to quickly assess, triage, and connect a device's status and activities to potentially malicious attacks.
34
44
35
45
The device summary capability of Copilot in Defender enables security teams to get a device's security posture, vulnerable software information, and any unusual behaviors. Security analysts can use a device's summary to speed up their investigation of incidents and alerts.
36
46
37
-
The device summary capability is available in the Microsoft Defender portal through the [Copilot for Security license](/security-copilot/faq-security-copilot). This capability is also available in the Copilot for Security standalone portal through the Microsoft Defender XDR plugin.
47
+
## Copilot for Security integration in Microsoft Defender
48
+
49
+
The device summary capability is available in the Microsoft Defender portal for customers who have provisioned access to Copilot for Security.
50
+
51
+
This capability is also available in the Copilot for Security standalone portal through the Microsoft Defender XDR plugin. Know more about [preinstalled plugins in Copilot for Security](/security-copilot/manage-plugins#preinstalled-plugins).
38
52
39
-
## Summarize device information
53
+
## Key features
40
54
41
55
The device summary generated by Copilot contains noteworthy information about the device, including:
42
56
@@ -61,18 +75,24 @@ You can access the device summary capability through the following ways:
61
75
62
76
:::image type="content" source="/defender/media/copilot-in-defender/device-summary/copilot-defender-device-summary-assets-small.png" alt-text="Screenshot highlighting the device summary option in the assets tab of an incident page in Copilot in Defender." lightbox="/defender/media/copilot-in-defender/device-summary/copilot-defender-device-summary-assets.png":::
63
77
64
-
Review the results. You can copy the results to clipboard, regenerate the results, or open the Copilot for Security portal by selecting the More actions ellipsis (...) on top of the device summary card.
78
+
Review the results of the device summary. You can copy the results to clipboard, regenerate the results, or open the Copilot for Security portal by selecting the More actions ellipsis (...) on top of the device summary card.
65
79
66
-
You can provide feedback about the results by navigating to the bottom of the Copilot pane and selecting the feedback icon .
80
+
## Sample device summary prompt
81
+
82
+
In the Copilot for Security standalone portal, you can use the following prompt to generate a device summary:
83
+
84
+
-*Summarize device information in Defender incident {incident number.*
85
+
86
+
> [!TIP]
87
+
> When investigating devices in the Copilot for Security portal, Microsoft recommends including the word ***Defender*** in your prompts to ensure that the device summary capability delivers the results.
88
+
89
+
## Provide feedback
90
+
91
+
Your feedback helps improve the quality of the results generated by Copilot. You can provide feedback about the results by navigating to the bottom of the Copilot pane and selecting the feedback icon .
Copy file name to clipboardExpand all lines: defender-xdr/copilot-in-defender-file-analysis.md
+30-10Lines changed: 30 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -18,7 +18,7 @@ ms.topic: conceptual
18
18
search.appverid:
19
19
- MOE150
20
20
- MET150
21
-
ms.date: 04/01/2024
21
+
ms.date: 10/04/2024
22
22
appliesto:
23
23
- Microsoft Defender XDR
24
24
- Microsoft Sentinel in the Microsoft Defender portal
@@ -30,13 +30,27 @@ appliesto:
30
30
31
31
[Microsoft Copilot for Security](/security-copilot/microsoft-security-copilot) in the Microsoft Defender portal enables security teams to quickly identify malicious and suspicious files through AI-powered file analysis capabilities.
32
32
33
+
## Know before you begin
34
+
35
+
If you're new to Copilot for Security, you should familiarize yourself with it by reading the following articles:
36
+
37
+
-[What is Copilot for Security?](/security-copilot/microsoft-security-copilot)
38
+
-[Copilot for Security experiences](/security-copilot/experiences-security-copilot)
39
+
-[Get started with Copilot for Security](/security-copilot/get-started-security-copilot)
40
+
-[Understand authentication in Copilot for Security](/security-copilot/authentication)
41
+
-[Prompting in Copilot for Security](/security-copilot/prompting-security-copilot)
42
+
33
43
Security operations teams tracking and resolving attacks need tools and techniques to quickly analyze potentially malicious files. Sophisticated attacks often use files that mimic legitimate or system files to avoid detection. In addition, new-to-the-field security analysts might require time and gain significant experience to use available analysis tools and techniques.
34
44
35
45
The file analysis capability of Copilot in Defender reduces the barrier to learning file analysis by immediately delivering reliable and complete file investigation results. This capability empowers security analysts from all levels to complete their investigation with a shorter turnaround time. The report includes an overview of the file, details of the file's contents, and a summary of the file's assessment.
36
46
37
-
The file analysis capability is available in Microsoft Defender through the [Copilot for Security license](/security-copilot/faq-security-copilot). Copilot for Security standalone portal users also have the file analysis capability and other Defender XDR capabilities through the Microsoft Defender XDR plugin.
47
+
## Copilot for Security integration in Microsoft Defender
48
+
49
+
The file analysis capability is available in Microsoft Defender for customers who have provisioned access to Copilot for Security.
50
+
51
+
Copilot for Security standalone portal users also have the file analysis capability and other Defender XDR capabilities through the Microsoft Defender XDR plugin. Know more about [preinstalled plugins in Copilot for Security](/security-copilot/manage-plugins#preinstalled-plugins).
38
52
39
-
## Analyze a file
53
+
## Key features
40
54
41
55
The file analysis results generated by Copilot usually contains the following information:
42
56
@@ -59,16 +73,22 @@ You can access the file analysis capability through the following ways:
59
73
60
74
You can copy the results to clipboard, regenerate the results, or open the Copilot for Security portal by selecting the More actions ellipsis (...) on top of the file analysis card.
61
75
62
-
Always review the results generated by Copilot in Defender. Select the feedback icon  at the bottom of the Copilot pane to provide feedback.
76
+
## Sample file analysis prompt
77
+
78
+
In the Copilot for Security standalone portal, you can use the following prompt to generate a device summary:
79
+
80
+
-*Tell me about the files in Defender incident {incident number). Which files are malicious?*
81
+
82
+
> [!TIP]
83
+
> When investigating files in the Copilot for Security portal, Microsoft recommends including the word ***Defender*** in your prompts to ensure that the file analysis capability delivers the results.
84
+
85
+
## Provide feedback
86
+
87
+
Always review the results generated by Copilot in Defender. Your feedback helps improve the quality of the results generated by Copilot. Select the feedback icon  at the bottom of the Copilot pane to provide feedback.
Copy file name to clipboardExpand all lines: defender-xdr/experts-on-demand.md
+8-1Lines changed: 8 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -19,7 +19,7 @@ ms.collection:
19
19
- essentials-manage
20
20
ms.topic: conceptual
21
21
search.appverid: met150
22
-
ms.date: 09/12/2024
22
+
ms.date: 10/14/2024
23
23
---
24
24
25
25
# Collaborate with experts on demand
@@ -52,6 +52,13 @@ You need to select one of the following Microsoft Entra ID roles to view and sub
52
52
53
53
To learn more about how Microsoft Entra ID roles map to Microsoft Defender Unified RBAC permissions, see [Microsoft Entra Global roles access](compare-rbac-roles.md#microsoft-entra-global-roles-access).
54
54
55
+
Microsoft Defender Experts customers using Ask Defender Experts capability will also be able to use the following permissions from [Microsoft Defender XDR Unified RBAC](../defender-xdr/custom-permissions-details.md).
56
+
57
+
|Microsoft Unified RBAC role|Permission level|
58
+
|---|---|---|
59
+
| Security data basics | Read |
60
+
| Alerts or Response | Read and submit |
61
+
55
62
### Where to submit inquiries to Ask Defender Experts
56
63
57
64
The option to **Ask Defender Experts** is available in several places throughout the portal:
0 commit comments