Merge branch 'main' into iot-in-mde

limwainstein · web-flow · commit 4e9f13242b28 · 2024-08-12T16:24:48.000+03:00
diff --git a/defender-endpoint/microsoft-defender-antivirus-updates.md b/defender-endpoint/microsoft-defender-antivirus-updates.md
@@ -3,7 +3,7 @@ title: Microsoft Defender Antivirus security intelligence and product updates
 description: Manage how Microsoft Defender Antivirus receives protection and product updates.
 ms.service: defender-endpoint
 ms.localizationpriority: high
-ms.date: 08/07/2024
+ms.date: 08/08/2024
 audience: ITPro
 ms.topic: reference
 author: siosulli
@@ -150,22 +150,6 @@ All our updates contain:
 - Fixed a crash caused by a race condition with a device control driver.
 - Added Event Viewer Logging for scan start event where the scan originates from PowerShell.
 
-### April-2024 (Engine: 1.1.24040.1 | Platform: 4.18.24040.4)
-
-- Security intelligence update version: **1.411.7.0**
-- Release date: **May 07, 2024** (Engine) / **May 16, 2024** (Platform)
-- Engine: **1.1.24040.1**
-- Platform: **4.18.24040.4**
-- Support phase: **Security and Critical Updates**
-
-#### What's new
-
-- Added an opt-out feature for Experimental Configuration Services (ECS) and One collector in the Core Service.
-- Fixed an issue where occasionally exclusions deployed via Intune were not being honored when tamper protection was enabled.
-- After a new engine version is released, support for older versions (N-2) will now reduce to technical support only. Engine versions older than N-2 are no longer supported.
-- Improved health monitoring and telemetry for [attack surface rules](overview-attack-surface-reduction.md) exclusions.
-- Updated inaccurate information in [Configure exclusions for files opened by processes](configure-process-opened-file-exclusions-microsoft-defender-antivirus.md) regarding wildcard usage with contextual exclusions.
-
 ### Previous version updates: Technical upgrade support only
 
 After a new package version is released, support for the previous two versions is reduced to technical support only. For more information about previous versions, see [Microsoft Defender Antivirus updates: Previous versions for technical upgrade support](msda-updates-previous-versions-technical-upgrade-support.md).
diff --git a/defender-endpoint/update-agent-mma-windows.md b/defender-endpoint/update-agent-mma-windows.md
@@ -70,7 +70,7 @@ A new agent was released in April 2022 for Windows Server 2012 R2 and Windows Se
 - If you are, however, still using MMA for other purposes (such as Log Analytics), MMA is currently set to retire in August 2024. See [We're retiring the Log Analytics agent in Azure Monitor on 31 August 2024](https://azure.microsoft.com/updates/were-retiring-the-log-analytics-agent-in-azure-monitor-on-31-august-2024/). Depending on your particular scenario, now might be a good time to upgrade to [Azure Monitoring Agent, the successor of MMA](/azure/azure-monitor/agents/azure-monitor-agent-migration). 
 
 > [!IMPORTANT]
-> Devices running Windows 7 SP1, Windows 8.1, or Windows Server 2008 R2 remain dependent on MMA.
+> Defender for Endpoint devices running Windows 7 SP1, Windows 8.1, or Windows Server 2008 R2 are still supported and remain dependent on MMA.
 >
 > Devices running Windows Server 2012 R2 or Windows Server 2016 should be upgraded to the [new, unified solution](application-deployment-via-mecm.md) so that they no longer require the use of MMA. 
 >
diff --git a/defender-for-iot/discover-vulnerabilities-overview.md b/defender-for-iot/discover-vulnerabilities-overview.md
@@ -1,6 +1,6 @@
 ---
-title: Overview of vulnerability management with Microsoft Defender for IoT in the Defender portal
-description: This article describes the features and benefits of Microsoft Defender for IoT vulnerability management.
+title: Overview of vulnerability management and weaknesses with Microsoft Defender for IoT in the Defender portal
+description: This article describes the vulnerability management and weaknesses features of Microsoft Defender for IoT in the Defender portal.
 ms.service: defender-for-iot
 author: limwainstein
 ms.author: lwainstein
diff --git a/defender-for-iot/get-started.md b/defender-for-iot/get-started.md
@@ -1,6 +1,6 @@
 ---
-title: Get started with Microsoft Defender for IoT in the Defender portal
-description: This article describes how to set up Microsoft Defender for IoT in the Defender portal.
+title: Get started and set up a license for Microsoft Defender for IoT in the Defender portal
+description: This article describes how to get started and set up a license got Microsoft Defender for IoT in the Defender portal.
 ms.service: defender-for-iot
 author: lwainstein
 ms.author: lwainstein
@@ -25,7 +25,7 @@ To add a trial license for Microsoft Defender for IoT:
 
 1. Open the [Microsoft Defender for IoT - OT Site License (1000 max devices per site) Trial wizard](https://signup.microsoft.com/get-started/signup?products=d2bdd05f-4856-4569-8474-2f9ec298923b).
 
-    :::image type="content" source="media/get-started/trial-license-get-started.png" alt-text="Screenshot of the set up page for the Microsoft Defender for IoT trial license.":::
+    :::image type="content" source="media/get-started/trial-license-get-started.png" alt-text="Screenshot to get started and set up page for the Microsoft Defender for IoT trial license.":::
 
 1. In the **Email** field, type the email address you want to associate with the trial license, and select **Next**.
 
diff --git a/defender-for-iot/manage-devices-inventory.md b/defender-for-iot/manage-devices-inventory.md
@@ -1,5 +1,5 @@
 ---
-title: Discover and manage devices for Microsoft Defender for IoT in the Defender portal
+title: Discover and manage devices in the device inventory for Microsoft Defender for IoT in the Defender portal
 description: This article describes how to discover and manage devices in the device inventory for Microsoft Defender for IoT in the Defender portal.
 ms.service: defender-for-iot
 author: limwainstein
@@ -10,7 +10,7 @@ ms.topic: how-to
 ---
 
 # Discover and manage devices
-
+<!-- possibly add to h1 in the device inventory-->
 Microsoft Defender for IoT in the Microsoft Defender portal includes the device inventory, which helps you identify details about specific OT devices. Gathering details about your devices helps your teams proactively investigate vulnerabilities that can compromise your most critical assets. This article describes how to discover and manage your devices in the device inventory. You can filter data in the inventory, explore the inventory, investigate device details, and more.
 
 Learn more about the benefits of OT [device discovery](device-discovery.md).
@@ -28,7 +28,7 @@ Review the [Defender for IoT prerequisites](prerequisites.md).
 > [!NOTE]
 >
 > If you don't yet have a Defender for IoT license, the **Device inventory** page lists OT devices without security data. For example, the device name, IP, and category are visible, while the risk level isn't visible. The device inventory also displays a note at the top of the page that indicates the number of unprotected OT devices.
-> 
+>
 > In this case, [onboard Defender for IoT](get-started.md) to get security value for your OT devices.
 
 ## View OT devices
diff --git a/defender-for-iot/prerequisites.md b/defender-for-iot/prerequisites.md
@@ -1,6 +1,6 @@
 ---
-title: Prerequisites for Microsoft Defender for IoT in the Defender portal
-description: This article describes the prerequisites for Microsoft Defender for IoT in the Microsoft Defender portal.
+title: Prerequisites for a license or setting up a site for Microsoft Defender for IoT in the Defender portal
+description: This article describes the prerequisites for a license or setting up a site for Microsoft Defender for IoT in the Microsoft Defender portal.
 ms.service: defender-for-iot
 author: lwainstein
 ms.author: lwainstein
diff --git a/defender-for-iot/prioritize-vulnerabilities.md b/defender-for-iot/prioritize-vulnerabilities.md
@@ -1,6 +1,6 @@
 ---
-title: Prioritize and remediate vulnerabilities with Microsoft Defender for IoT in the Defender portal
-description: This article describes how to prioritize and remediate vulnerabilities with Microsoft Defender for IoT in the Defender portal.
+title: Prioritize, investigate and remediate vulnerabilities with Microsoft Defender for IoT in the Defender portal
+description: This article describes how to prioritize, investigate and remediate vulnerabilities with Microsoft Defender for IoT in the Defender portal.
 ms.service: defender-for-iot
 author: limwainstein
 ms.author: lwainstein
diff --git a/defender-for-iot/set-up-sites.md b/defender-for-iot/set-up-sites.md
@@ -1,6 +1,6 @@
 ---
-title: Set up sites with Microsoft Defender for IoT in the Defender portal
-description: This article describes how to set up a site as part of the site security feature included in Microsoft Defender for IoT in the Microsoft Defender portal.
+title: Set up and create sites for site security with Microsoft Defender for IoT in the Defender portal
+description: This article describes how to set up and create a site as part of the site security feature included in Microsoft Defender for IoT in the Microsoft Defender portal.
 ms.service: defender-for-iot
 author: limwainstein
 ms.author: lwainstein
@@ -11,9 +11,9 @@ ms.topic: how-to
 
 # Set up sites
 
-Microsoft Defender for IoT in the Microsoft Defender portal includes the **Site security** page, which offers an overview of the security state of your entire operational technology (OT) environment. Your organization's security team can use this page to regularly monitor the security status of your production sites.
+Microsoft Defender for IoT in the Microsoft Defender portal includes the **Site security** page, which offers an overview of the security state of your entire operational technology (OT) environment. Your organization's security team use this page to regularly monitor the security status of your production sites.
 
-In this article, you learn how to set up a site in the **Site security** page. 
+In this article, you learn how to set up a site in the **Site security** page.
 
 Learn more about the [site security benefits and use cases](site-security-overview.md).
 
@@ -39,7 +39,7 @@ To set up a site and associate the OT devices in your network to it:
     - **Site description**: Describe the purpose of the site, what activities occur there, the types and number of devices used, and other important information about the site.
     - **Owners**: The contact emails of any users administering the site who must be contacted when problems occur.
 
-    :::image type="content" source="media/set-up-sites/site-security-set-up-details-new.png" alt-text="Screenshot showing the details for a new site in the Site security page of Microsoft Defender for IoT in the Microsoft Defender portal.":::
+    :::image type="content" source="media/set-up-sites/site-security-set-up-details-new.png" alt-text="Screenshot showing the details for creating a new site in the Site security page of Microsoft Defender for IoT in the Microsoft Defender portal.":::
 
 1. When completed, select **Next** to associate devices to the site.
 
@@ -74,7 +74,7 @@ Review that information for the site you want to create:
 1. Review the selected OT devices. If needed, select **Edit devices** to return to the **Associate devices** screen.
 1. Select **Complete**.
 
-    The site is now set up and appears in the **Site security** page. 
+    The site is now set up and appears in the **Site security** page.
 
     Regarding device data:
 
@@ -87,21 +87,21 @@ Review that information for the site you want to create:
 
 Use a device group to make sure that the correct users have access to the site. To create a device group:
 
-1. Select **Create device group**. 
+1. Select **Create device group**.
 
     The **Settings > Endpoints > Device groups** page opens.
 
 1. Select **Add device group** and type a device group name.
-1. Select the remediation level, type a description, and select **Next**. 
+1. Select the remediation level, type a description, and select **Next**.
 
     The **Devices** page opens.
 
 1. Type the value for the **Tag** condition in the format: *Site: \<Site name\>*. For example, *Site: San Francisco*.
-1. Select **Next**. 
+1. Select **Next**.
 
-    The **Preview devices** page opens with a list of devices in the group. 
+    The **Preview devices** page opens with a list of devices in the group.
 
-1. Select **Next**. 
+1. Select **Next**.
 
     The **User access** page opens.
 
diff --git a/defender-for-iot/site-security-overview.md b/defender-for-iot/site-security-overview.md
@@ -1,6 +1,6 @@
 ---
-title: Microsoft Defender for IoT in the Defender portal - Site security 
-description: Read this article to learn about site security in Microsoft Defender for IoT in the Defender portal.
+title: Site security features and capabilities in Microsoft Defender for IoT in the Defender portal 
+description: Read this article to learn about site security features, capabilities, scenarios and users of Microsoft Defender for IoT in the Defender portal.
 ms.service: defender-for-iot
 author: limwainstein
 ms.author: lwainstein
@@ -44,4 +44,4 @@ The **Site security** page is designed to assist the following users:
 - **Chief Security Information Officers (CISOs)** and **Security Decision Makers**: develop and improve the organization's overall security strategy giving insights into risk and exposure.  
 - **OT Security Manager**: develop and implement OT security initiatives across multiple sites or the entire organization.
 - **Site Manager**: oversee daily operations at a specific site, ensuring smooth production and implementation of security measures.
-- **OT Security Engineers**: design, implement, and maintain security solutions that are aligned with the security program of the site or with the overall organizational security.
+- **OT Security Engineers**: design, implement, and maintain security solutions that are aligned with the security program of the site or with the overall organizational security.
diff --git a/defender-office-365/anti-phishing-policies-eop-configure.md b/defender-office-365/anti-phishing-policies-eop-configure.md
@@ -154,7 +154,7 @@ On the **Anti-phishing** page, the following properties are displayed in the lis
 - **Status**: Values are:
   - **Always on** for the default anti-phishing policy.
   - **On** or **Off** for other anti-spam policies.
-- **Priority**: For more information, see the [Set the priority of custom anti-spam policies](#use-the-microsoft-defender-portal-to-set-the-priority-of-custom-anti-phishing-policies) section.
+- **Priority**: For more information, see the [Set the priority of custom anti-phishing policies](#use-the-microsoft-defender-portal-to-set-the-priority-of-custom-anti-phishing-policies) section.
 
 To change the list of policies from normal to compact spacing, select :::image type="icon" source="media/m365-cc-sc-standard-icon.png" border="false"::: **Change list spacing to compact or normal**, and then select :::image type="icon" source="media/m365-cc-sc-compact-icon.png" border="false"::: **Compact list**.
 
diff --git a/defender-xdr/deception-overview.md b/defender-xdr/deception-overview.md
@@ -16,7 +16,7 @@ ms.topic: conceptual
 search.appverid: 
   - MOE150
   - MET150
-ms.date: 07/08/2024
+ms.date: 08/08/2024
 ---
 
 # Manage the deception capability in Microsoft Defender XDR
@@ -94,7 +94,7 @@ The alert details contain:
 - The decoy device or user account where the alert originated
 - The type of attack like sign in attempts or lateral movement attempts
 
-:::image type="content" source="/defender/media/deception/fig2-deception.png" alt-text="Screenshot of a deception alert highlighting the tag and the attempt" lightbox="/defender/media/deception/fig2-deception.png":::
+:::image type="content" source="/defender/media/deception/deception-alert-small.png" alt-text="Screenshot of a deception alert highlighting the tag and the attempt" lightbox="/defender/media/deception/deception-alert.png":::
 
 *Figure 2. Details of a deception-related alert*
 
diff --git a/defender-xdr/m365d-enable.md b/defender-xdr/m365d-enable.md
@@ -18,7 +18,7 @@ ms.topic: conceptual
 search.appverid: 
   - MOE150
   - MET150
-ms.date: 09/21/2023
+ms.date: 08/12/2024
 ---
 
 # Turn on Microsoft Defender XDR
@@ -55,6 +55,21 @@ You must be one of the following roles to turn on Microsoft Defender XDR:
 
 [View your roles in Microsoft Entra ID](/azure/active-directory/users-groups-roles/directory-manage-roles-portal)
 
+## Configure your network firewall
+
+Configuring your network firewall ensures a smooth experience while navigating the Microsoft Defender portal https://security.microsoft.com.
+
+Add to your firewall's allow list the outbound IP addresses in the following page:
+
+- [IP addresses used by Azure Monitor](/azure/azure-monitor/ip-addresses#outgoing-ports)
+
+In addition, ensure that other Defender services are properly configured. You can refer to the following pages for configuration information:
+
+- [Enable access to Microsoft Defender for Endpoint service in the proxy server](/defender-endpoint/configure-environment#enable-access-to-microsoft-defender-for-endpoint-service-urls-in-the-proxy-server)
+- [Get started with Microsoft Defender for Office 365](/defender-office-365/mdo-deployment-guide)
+- [Configure endpoint proxy and internet connectivity settings for Microsoft Defender for Identity](/defender-for-identity/deploy/configure-proxy)
+- [Ensure portal access for Microsoft Defender for Cloud Apps](/defender-cloud-apps/network-requirements#portal-access)
+
 ## Supported services
 
 Microsoft Defender XDR aggregates data from the various supported services that you've already deployed. It will process and store data centrally to identify new insights and make centralized response workflows possible. It does this without affecting existing deployments, settings, or data associated with the integrated services.
diff --git a/defender-xdr/whats-new.md b/defender-xdr/whats-new.md
@@ -6,7 +6,7 @@ ms.service: defender-xdr
 ms.author: diannegali
 author: diannegali
 ms.localizationpriority: medium
-ms.date: 07/16/2024
+ms.date: 08/12/2024
 manager: dansimp
 audience: ITPro
 ms.collection:
@@ -29,6 +29,10 @@ For more information on what's new with other Microsoft Defender security produc
 
 You can also get product updates and important notifications through the [message center](https://admin.microsoft.com/Adminportal/Home#/MessageCenter).
 
+## August 2024
+
+- To ensure a smooth experience while navigating the Microsoft Defender portal, configure your network firewall by adding the appropriate addresses to your allow list. For more information, see [Network firewall configuration for Microsoft Defender XDR](m365d-enable.md#configure-your-network-firewall).
+
 ## July 2024
 
 - Incidents with alerts where a compromised device communicated with an operational technology (OT) device are now visible in the Microsoft Defender portal through the [Microsoft Defender for IoT license and Defender for Endpoint’s device discovery capabilities](/defender-endpoint/device-discovery#device-discovery-integration). Using Defender for Endpoint data, Defender XDR automatically correlates these new OT alerts to incidents to provide a comprehensive attack story. To filter related incidents, see [Prioritize incidents in the Microsoft Defender portal](incident-queue.md#filters-).  
diff --git a/defender/media/deception/deception-alert-small.png b/defender/media/deception/deception-alert-small.png
diff --git a/defender/media/deception/deception-alert.png b/defender/media/deception/deception-alert.png

Original file line number	Diff line number	Diff line change
`@@ -70,7 +70,7 @@ A new agent was released in April 2022 for Windows Server 2012 R2 and Windows Se`
`70`	`70`	- If you are, however, still using MMA for other purposes (such as Log Analytics), MMA is currently set to retire in August 2024. See [We're retiring the Log Analytics agent in Azure Monitor on 31 August 2024](https://azure.microsoft.com/updates/were-retiring-the-log-analytics-agent-in-azure-monitor-on-31-august-2024/). Depending on your particular scenario, now might be a good time to upgrade to [Azure Monitoring Agent, the successor of MMA](/azure/azure-monitor/agents/azure-monitor-agent-migration).
`71`	`71`
`72`	`72`	`> [!IMPORTANT]`
`73`		`-> Devices running Windows 7 SP1, Windows 8.1, or Windows Server 2008 R2 remain dependent on MMA.`
	`73`	`+> Defender for Endpoint devices running Windows 7 SP1, Windows 8.1, or Windows Server 2008 R2 are still supported and remain dependent on MMA.`
`74`	`74`	`>`
`75`	`75`	`> Devices running Windows Server 2012 R2 or Windows Server 2016 should be upgraded to the [new, unified solution](application-deployment-via-mecm.md) so that they no longer require the use of MMA.`
`76`	`76`	`>`