Skip to content

Commit 4c74f03

Browse files
tarTech23tarTech23
authored
Merge branch 'main' into mansa
2 parents 4fcd084 + c04b9e1 commit 4c74f03

File tree

2 files changed

+60
-50
lines changed

2 files changed

+60
-50
lines changed

‎defender-endpoint/troubleshoot-asr.md‎

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.localizationpriority: medium
66
audience: ITPro
77
author: denisebmsft
88
ms.author: deniseb
9-
ms.date: 07/28/2023
9+
ms.date: 11/05/2024
1010
ms.reviewer:
1111
manager: deniseb
1212
ms.custom: asr
@@ -33,8 +33,8 @@ search.appverid: met150
3333
3434
When you use [attack surface reduction rules](attack-surface-reduction.md) you might run into issues, such as:
3535

36-
- A rule blocks a file, process, or performs some other action that it shouldn't (false positive)
37-
- A rule doesn't work as described, or doesn't block a file or process that it should (false negative)
36+
- A rule blocks a file, process, or performs some other action that it shouldn't (false positive); or
37+
- A rule doesn't work as described, or doesn't block a file or process that it should (false negative).
3838

3939
There are four steps to troubleshooting these problems:
4040

@@ -47,41 +47,43 @@ There are four steps to troubleshooting these problems:
4747

4848
Attack surface reduction rules only work on devices with the following conditions:
4949

50-
- Endpoints are running Windows 10 Enterprise or later.
50+
- Devices are running Windows 10 Enterprise or later.
51+
- Devices are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app causes Microsoft Defender Antivirus to disable itself](/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility).
52+
- [Real-time protection](/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) is enabled.
53+
- Audit mode isn't enabled. Use Group Policy to set the rule to `Disabled` (value: `0`) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
5154

52-
- Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. [Using any other antivirus app causes Microsoft Defender Antivirus to disable itself](/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-compatibility).
55+
If these prerequisites are met, proceed to the next step to test the rule in audit mode.
5356

54-
- [Real-time protection](/windows/security/threat-protection/microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus) is enabled.
57+
## Best practices when setting up attack surface reduction rules using Group Policy
5558

56-
- Audit mode isn't enabled. Use Group Policy to set the rule to **Disabled** (value: **0**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
59+
When setting up the attack surface reduction rules by using Group Policy, here are a few best practices to avoid making common mistakes:
5760

58-
If these prerequisites are met, proceed to the next step to test the rule in audit mode.
61+
1. Make sure when adding the GUID for attack surface reduction rules, there are **no double quotes** (like this: "ASR Rules GUID") at the beginning or at the end of the GUID.
62+
63+
2. Make sure that there are **no spaces** at the beginning or at the end when adding the GUID for attack surface reduction rules.
5964

6065
## Use audit mode to test the rule
6166

6267
Follow these instructions in [Use the demo tool to see how attack surface reduction rules work](attack-surface-reduction-rules-deployment-test.md) to test the specific rule you're encountering problems with.
6368

64-
1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to **Audit mode** (value: **2**) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). Audit mode allows the rule to report the file or process, but allows it to run.
65-
66-
2. Perform the activity that is causing an issue (for example, open or execute the file or process that should be blocked but is being allowed).
69+
1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to `Audit mode` (value: `2`) as described in [Enable attack surface reduction rules](enable-attack-surface-reduction.md). Audit mode allows the rule to report the file or process, but allows it to run.
6770

68-
3. [Review the attack surface reduction rule event logs](attack-surface-reduction.md) to see if the rule would block the file or process if the rule were set to **Enabled**.
71+
2. Perform the activity that is causing an issue. For example, open the file or run the process that should be blocked, but is allowed.
6972

70-
If a rule isn't blocking a file or process that you're expecting it should block, first check if audit mode is enabled.
73+
3. [Review the attack surface reduction rule event logs](attack-surface-reduction.md) to see if the rule would block the file or process if the rule were set to `Enabled`.
7174

72-
Audit mode might be enabled for testing another feature, or by an automated PowerShell script, and might not be disabled after the tests were completed.
75+
If a rule isn't blocking a file or process that you're expecting it should block, first check to see if audit mode is enabled. Audit mode might be enabled for testing another feature, or by an automated PowerShell script, and might not be disabled after the tests were completed.
7376

7477
If you've tested the rule with the demo tool and with audit mode, and attack surface reduction rules are working on preconfigured scenarios, but the rule isn't working as expected, proceed to either of the following sections based on your situation:
7578

76-
1. If the attack surface reduction rule is blocking something that it shouldn't block (also known as a false positive), you can [first add an attack surface reduction rule exclusion](#add-exclusions-for-a-false-positive).
77-
78-
2. If the attack surface reduction rule isn't blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data-for-file-submissions).
79+
- If the attack surface reduction rule is blocking something that it shouldn't block (also known as a false positive), you can [first add an attack surface reduction rule exclusion](#add-exclusions-for-a-false-positive).
80+
- If the attack surface reduction rule isn't blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, [collecting diagnostic data and submitting the issue to us](#collect-diagnostic-data-for-file-submissions).
7981

8082
## Add exclusions for a false positive
8183

8284
If the attack surface reduction rule is blocking something that it shouldn't block (also known as a false positive), you can add exclusions to prevent attack surface reduction rules from evaluating the excluded files or folders.
8385

84-
To add an exclusion, see [Customize Attack surface reduction](attack-surface-reduction-rules-deployment-implement.md#customize-attack-surface-reduction-rules).
86+
To add an exclusion, see [Customize attack surface reduction](attack-surface-reduction-rules-deployment-implement.md#customize-attack-surface-reduction-rules).
8587

8688
> [!IMPORTANT]
8789
> You can specify individual files and folders to be excluded, but you cannot specify individual rules.
@@ -95,7 +97,7 @@ Use the [Microsoft Security Intelligence web-based submission form](https://www.
9597

9698
When you report a problem with attack surface reduction rules, you're asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues.
9799

98-
1. Open an elevated command prompt and change to the Windows Defender directory:
100+
1. Open Command Prompt as an administrator and open the Windows Defender directory:
99101

100102
```console
101103
cd "c:\program files\Windows Defender"
@@ -114,4 +116,5 @@ When you report a problem with attack surface reduction rules, you're asked to c
114116
- [Attack surface reduction rules](attack-surface-reduction.md)
115117
- [Enable attack surface reduction rules](enable-attack-surface-reduction.md)
116118
- [Evaluate attack surface reduction rules](attack-surface-reduction-rules-deployment-test.md)
119+
117120
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]

‎defender-xdr/streaming-api-storage.md‎

Lines changed: 38 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ ms.topic: conceptual
1616
ms.date: 06/21/2024
1717
---
1818

19-
# Configure Microsoft Defender XDR to stream Advanced Hunting events to your Storage account
19+
# Stream Microsoft Defender XDR events to your storage account
2020

2121
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
2222

@@ -30,41 +30,47 @@ ms.date: 06/21/2024
3030

3131
## Before you begin
3232

33-
1. Create a [Storage account](/azure/storage/common/storage-account-overview) in your tenant.
34-
35-
2. Log in to your [Azure tenant](https://ms.portal.azure.com/), go to **Subscriptions > Your subscription > Resource Providers > Register to Microsoft.Insights**.
33+
- Create a [Storage account](/azure/storage/common/storage-account-overview) in your tenant.
34+
- Sign in to your [Azure tenant](https://ms.portal.azure.com/), and go to **Subscriptions** > **Your subscription** > **Resource Providers** > **Register to Microsoft.Insights**.
3635

3736
### Add contributor permissions
3837

39-
Once the Storage account is created, you'll need to:
38+
Once the storage account is created, you need to define the user who is signing in as a contributor.
4039

41-
1. Define the user who is logging into Microsoft Defender XDR as Contributor.
40+
1. Go to **Storage Account** > **Access control (IAM)**, and then select **Add**.
4241

43-
Go to **Storage Account > Access control (IAM) > Add** and verify under **Role assignments**.
42+
2. Verify the user is listed under **Role assignments**.
4443

4544
## Enable raw data streaming
4645

47-
1. Log in to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft Defender XDR</a> as a ***Security Administrator*** at a minimum.
46+
> [!NOTE]
47+
> When using the Streaming API to an Azure Storage account, ensure the option `Allow trusted Microsoft services to access this storage account` is enabled in the storage account settings to allow for data to be streamed from Microsoft Defender for Endpoint.
48+
49+
1. Go to the [Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2077139) and sign in using an account with at least Security Administrator permissions.
4850

49-
>[!IMPORTANT]
50-
>Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
51+
> [!IMPORTANT]
52+
> Microsoft recommends that you use roles with the fewest permissions. Using lower permissioned accounts helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
5153
52-
2. Go to **Settings** \> **Microsoft Defender XDR** \> **Streaming API**. To go directly to the **Streaming API** page, use <https://security.microsoft.com/settings/mtp_settings/raw_data_export>.
54+
2. Go to **Settings** > **Microsoft Defender XDR** > **Streaming API**. To go directly to the **Streaming API** page, use [https://security.microsoft.com/settings/mtp_settings/raw_data_export](https://security.microsoft.com/settings/mtp_settings/raw_data_export).
5355

5456
3. Select **Add**.
5557

5658
4. In the **Add new Streaming API settings** flyout that appears, configure the following settings:
57-
1. **Name**: Choose a name for your new settings.
58-
2. Select **Forward events to Azure Storage**.
59-
4. To display the Azure Resource Manager resource ID for a storage account in the Azure portal, follow these steps:
6059

61-
1. Navigate to your storage account in the Azure portal.
62-
2. On the **Overview** page, in the **Essentials** section, select the **JSON View** link.
63-
3. The resource ID for the storage account is displayed at the top of the page, copy the text under **Storage Account Resource ID**.
60+
- **Name**: Choose a name for your new settings.
61+
- Select **Forward events to Azure Storage**.
62+
63+
5. To display the Azure Resource Manager resource ID for a storage account in the Azure portal, follow these steps:
64+
65+
1. Navigate to your storage account in the [Azure portal](https://portal.azure.com).
66+
67+
2. In the **Overview** page, in the **Essentials** section, select the **JSON View** link.
6468

65-
4. Back on the **Add new Streaming API settings** flyout, choose the **Event types** that you want to stream.
69+
3. The resource ID for the storage account is displayed at the top of the page. Copy the text under **Storage Account Resource ID**.
6670

67-
When you're finished, select **Submit**.
71+
4. In the **Add new Streaming API settings** flyout, choose the **Event types** that you want to stream.
72+
73+
5. When you're finished, select **Submit**.
6874

6975
## The schema of the events in the Storage account
7076

@@ -74,14 +80,14 @@ Once the Storage account is created, you'll need to:
7480

7581
- The schema of each row in a blob is the following JSON:
7682

77-
```JSON
78-
{
83+
```JSON
84+
{
7985
"time": "<The time Microsoft Defender XDR received the event>"
8086
"tenantId": "<Your tenant ID>"
8187
"category": "<The Advanced Hunting table name with 'AdvancedHunting-' prefix>"
8288
"properties": { <Microsoft Defender XDR Advanced Hunting event as Json> }
83-
}
84-
```
89+
}
90+
```
8591

8692
- Each blob contains multiple rows.
8793

@@ -91,9 +97,11 @@ Once the Storage account is created, you'll need to:
9197

9298
## Data types mapping
9399

94-
In order to get the data types for our events properties do the following:
100+
To get the data types for events properties, follow these steps:
101+
102+
1. Go to the [Microsoft Defender portal](https://go.microsoft.com/fwlink/p/?linkid=2077139) and sign in.
95103

96-
1. Log in to <a href="https://go.microsoft.com/fwlink/p/?linkid=2077139" target="_blank">Microsoft Defender XDR</a> and go to **Hunting** \> **Advanced hunting**. To go directly to the **Advanced hunting** page, use <security.microsoft.com/advanced-hunting>.
104+
2. Go to **Hunting** \> **Advanced hunting**. To go directly to the **Advanced hunting** page, use [https://security.microsoft.com/advanced-hunting](https://security.microsoft.com/advanced-hunting).
97105

98106
2. On the **Query** tab, run the following query to get the data types mapping for each event:
99107

@@ -103,21 +111,20 @@ In order to get the data types for our events properties do the following:
103111
| project ColumnName, ColumnType
104112
```
105113

106-
- Here's an example for Device Info event:
114+
Here's an example for Device Info event:
107115

108-
:::image type="content" source="/defender-endpoint/media/machine-info-datatype-example.png" alt-text="An example device info query" lightbox="/defender-endpoint/media/machine-info-datatype-example.png":::
116+
:::image type="content" source="/defender-endpoint/media/machine-info-datatype-example.png" alt-text="An example device info query" lightbox="/defender-endpoint/media/machine-info-datatype-example.png":::
109117

110118
## Monitoring created resources
111119

112-
You can monitor the resources created by the streaming API using **Azure Monitor**.
113-
For more information, see [Monitor destinations - Azure Monitor | Microsoft Docs](/azure/azure-monitor/logs/logs-data-export?tabs=portal#monitor-destinations).
120+
You can monitor the resources created by the streaming API using **Azure Monitor**. For more information, see [Monitor destinations - Azure Monitor](/azure/azure-monitor/logs/logs-data-export?tabs=portal#monitor-destinations).
114121

115-
## Related topics
122+
## Related articles
116123

117124
- [Use the Microsoft Graph security API - Microsoft Graph | Microsoft Learn](/graph/api/resources/security-api-overview)
118-
119125
- [Overview of Advanced Hunting](advanced-hunting-overview.md)
120126
- [Microsoft Defender XDR Streaming API](streaming-api.md)
121127
- [Stream Microsoft Defender XDR events to your Azure storage account](streaming-api-storage.md)
122128
- [Azure Storage Account documentation](/azure/storage/common/storage-account-overview)
129+
123130
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]

0 commit comments

Comments
 (0)