Skip to content

Commit 5416a72

Browse files
padmagit77padmagit77
authored
Merge branch 'main' into WI364634-remove-the-word-portal-correct-to-defender-for-cloud-apps
2 parents d59a7c2 + 05b40f9 commit 5416a72

File tree

8 files changed

+214
-77
lines changed

8 files changed

+214
-77
lines changed

‎defender-endpoint/TOC.yml‎

Lines changed: 67 additions & 70 deletions
Original file line numberDiff line numberDiff line change
@@ -926,25 +926,21 @@
926926

927927
- name: Troubleshooting Microsoft Defender Antivirus
928928
items:
929-
- name: Troubleshoot Microsoft Defender Antivirus performance issues
930-
items:
929+
- name: Troubleshoot performance issues related to real-time protection
930+
href: troubleshoot-performance-issues.md
931+
items:
931932
- name: Performance analyzer for Microsoft Defender Antivirus
932933
href: tune-performance-defender-antivirus.md
933934
- name: Performance analyzer reference
934935
href: performance-analyzer-reference.md
935-
displayName: high cpu msmpeng.exe antimalware engine microsoft defender
936-
antivirus windows defender antivirus
937-
- name: Troubleshoot performance issues related to real-time protection
938-
href: troubleshoot-performance-issues.md
939-
- name: Troubleshoot Microsoft Defender Antivirus performance issues with WPRUI
940-
href: troubleshoot-av-performance-issues-with-wprui.md
941-
displayName: Troubleshoot antivirus performance issues with WPRUI windows
942-
performance recorder UI WPR windows performance recorder
943936
- name: Troubleshoot Microsoft Defender Antivirus performance issues with Process
944937
Monitor
945938
href: troubleshoot-av-performance-issues-with-procmon.md
946-
displayName: Troubleshoot Microsoft Defender Antivirus MDAV performance perf
947-
issues with Process Monitor ProcMon
939+
- name: Troubleshoot Microsoft Defender Antivirus performance issues with WPRUI
940+
href: troubleshoot-av-performance-issues-with-wprui.md
941+
- name: Troubleshoot Microsoft Defender Antivirus performance issues
942+
items:
943+
948944
- name: Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus
949945
href: troubleshoot-microsoft-defender-antivirus.yml
950946
- name: Troubleshoot Microsoft Defender Antivirus while migrating from a third-party solution
@@ -1090,15 +1086,6 @@
10901086
- name: Use sensitivity labels to prioritize incident response
10911087
href: information-protection-investigation.md
10921088

1093-
- name: Reporting
1094-
items:
1095-
- name: Power BI - How to use API - Samples
1096-
href: api/api-power-bi.md
1097-
- name: Threat protection reports
1098-
href: threat-protection-reports.md
1099-
- name: Monthly security summary
1100-
href: monthly-security-summary-report.md
1101-
11021089
- name: Advanced hunting
11031090
href: /defender-xdr/advanced-hunting-overview
11041091

@@ -1132,54 +1119,16 @@
11321119

11331120
- name: Reference
11341121
items:
1135-
- name: Microsoft Security Resources
1136-
items:
1137-
- name: Threat actor naming
1138-
href: /defender-xdr/microsoft-threat-actor-naming
1139-
- name: Malware names
1140-
href: /defender-xdr/malware-naming
1141-
- name: How Microsoft identifies malware and PUA
1142-
href: /defender-xdr/criteria
1143-
- name: Submit files for analysis
1144-
href: /defender-xdr/submission-guide
1145-
- name: Troubleshoot MSI portal errors caused by admin block
1146-
href: /defender-xdr/portal-submission-troubleshooting
1147-
- name: Microsoft virus initiative
1148-
href: /defender-xdr/virus-initiative-criteria
1149-
- name: Software developer FAQ
1150-
href: /defender-xdr/developer-faq
1151-
- name: Malware information
1152-
items:
1153-
- name: Understanding malware
1154-
href: malware/understanding-malware.md
1155-
- name: Coinminers
1156-
href: malware/coinminer-malware.md
1157-
- name: Exploits and Exploit Kits
1158-
href: malware/exploits-malware.md
1159-
- name: Fileless threats
1160-
href: malware/fileless-threats.md
1161-
- name: Macro threats
1162-
href: malware/macro-malware.md
1163-
- name: Phishing trends
1164-
href: malware/phishing-trends.md
1165-
- name: Phishing
1166-
href: malware/phishing.md
1167-
- name: Prevent malware infection
1168-
href: malware/prevent-malware-infection.md
1169-
- name: Rootkits
1170-
href: malware/rootkits-malware.md
1171-
- name: Supply chain malware
1172-
href: malware/supply-chain-malware.md
1173-
- name: Support scams
1174-
href: malware/support-scams.md
1175-
- name: Trojans
1176-
href: malware/trojans-malware.md
1177-
- name: Unwanted software
1178-
href: malware/unwanted-software.md
1179-
- name: Worms
1180-
href: malware/worms-malware.md
1181-
- name: Understand threat intelligence concepts
1182-
href: threat-indicator-concepts.md
1122+
- name: Reports
1123+
items:
1124+
- name: Monthly security summary
1125+
href: monthly-security-summary-report.md
1126+
- name: Create custom reports using Power BI
1127+
href: api/api-power-bi.md
1128+
- name: Threat protection reports
1129+
href: threat-protection-reports.md
1130+
- name: Aggregated reports
1131+
href: aggregated-reporting.md
11831132
- name: Configure integration with other Microsoft solutions
11841133
items:
11851134
- name: Configure conditional access
@@ -1582,7 +1531,55 @@
15821531
href: conditional-access.md
15831532
- name: Microsoft Defender for Cloud Apps integration overview
15841533
href: microsoft-cloud-app-security-integration.md
1585-
1534+
- name: Microsoft Security Resources
1535+
items:
1536+
- name: Threat actor naming
1537+
href: /defender-xdr/microsoft-threat-actor-naming
1538+
- name: Malware names
1539+
href: /defender-xdr/malware-naming
1540+
- name: How Microsoft identifies malware and PUA
1541+
href: /defender-xdr/criteria
1542+
- name: Submit files for analysis
1543+
href: /defender-xdr/submission-guide
1544+
- name: Troubleshoot MSI portal errors caused by admin block
1545+
href: /defender-xdr/portal-submission-troubleshooting
1546+
- name: Microsoft virus initiative
1547+
href: /defender-xdr/virus-initiative-criteria
1548+
- name: Software developer FAQ
1549+
href: /defender-xdr/developer-faq
1550+
- name: Malware information
1551+
items:
1552+
- name: Understanding malware
1553+
href: malware/understanding-malware.md
1554+
- name: Coinminers
1555+
href: malware/coinminer-malware.md
1556+
- name: Exploits and Exploit Kits
1557+
href: malware/exploits-malware.md
1558+
- name: Fileless threats
1559+
href: malware/fileless-threats.md
1560+
- name: Macro threats
1561+
href: malware/macro-malware.md
1562+
- name: Phishing trends
1563+
href: malware/phishing-trends.md
1564+
- name: Phishing
1565+
href: malware/phishing.md
1566+
- name: Prevent malware infection
1567+
href: malware/prevent-malware-infection.md
1568+
- name: Rootkits
1569+
href: malware/rootkits-malware.md
1570+
- name: Supply chain malware
1571+
href: malware/supply-chain-malware.md
1572+
- name: Support scams
1573+
href: malware/support-scams.md
1574+
- name: Trojans
1575+
href: malware/trojans-malware.md
1576+
- name: Unwanted software
1577+
href: malware/unwanted-software.md
1578+
- name: Worms
1579+
href: malware/worms-malware.md
1580+
- name: Understand threat intelligence concepts
1581+
href: threat-indicator-concepts.md
1582+
15861583
- name: Microsoft Defender XDR docs
15871584
items:
15881585
- name: Microsoft Defender XDR

‎defender-endpoint/aggregated-reporting.md‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
---
2+
title: Aggregated reporting in Microsoft Defender for Endpoint
3+
description: Learn how you collect important telemetry in Microsoft Defender for Endpoint by turning on aggregated reporting.
4+
ms.service: defender-endpoint
5+
ms.author: diannegali
6+
author: diannegali
7+
ms.localizationpriority: medium
8+
manager: deniseb
9+
audience: ITPro
10+
ms.collection:
11+
- m365-security
12+
- tier3
13+
ms.topic: conceptual
14+
search.appverid: met150
15+
ms.date: 01/21/2025
16+
appliesto:
17+
- Microsoft Defender for Endpoint Plan 2
18+
---
19+
20+
# Aggregated reporting in Microsoft Defender for Endpoint
21+
22+
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
23+
24+
> [!IMPORTANT]
25+
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
26+
27+
Aggregated reporting addresses constraints on event reporting in Microsoft Defender for Endpoint. Aggregated reporting extends signal reporting intervals to significantly reduce the size of reported events while preserving essential event properties.
28+
29+
Defender for Endpoint reduces noise in collected data to improve the signal-to-noise ratio while balancing product performance and efficiency. It limits data collection to maintain this balance.
30+
31+
With aggregated reporting, Defender for Endpoint ensures that all essential event properties valuable to investigation and threat hunting activities are continuously collected. It does this by extended reporting intervals of one hour, which reduces the size of reported events and enables efficient yet valuable data collection.
32+
33+
When aggregated reporting is turned on, you can query for a summary of all supported event types, including low-efficacy telemetry, that you can use for investigation and hunting activities.
34+
35+
## Prerequisites
36+
37+
The following requirements must be met before turning on aggregated reporting:
38+
39+
- Defender for Endpoint Plan 2 license
40+
- Permissions to enable advanced features
41+
42+
Aggregated reporting supports the following:
43+
44+
- Client version: Windows version 2411 and above
45+
- Operating systems: Windows 11 22H2, Windows Server 2022, Windows 11 Enterprise, Windows 10 20H2, 21H1, 21H2, Windows Server version 20H2, and Windows Server 2019
46+
47+
## Turn on aggregated reporting
48+
49+
To turn aggregated reporting on, go to **Settings > Endpoints > Advanced features**. Toggle on the **Aggregated reporting** feature.
50+
51+
:::image type="content" source="/defender-endpoint/media/reports/aggregated-reporting/aggregated-reporting-toggle.png" alt-text="Screenshot of the aggregated reporting toggle in the Microsoft Defender portal settings page.":::
52+
53+
Once aggregated reporting is turned on, it can take up to seven days for aggregated reports to become available. You can then begin to query new data after the feature is turned on.
54+
55+
When you turn off aggregated reporting, the changes take a few hours to be applied. All previously collected data remains.
56+
57+
## Query aggregated reports
58+
59+
Aggregated reporting supports the following event types:
60+
61+
> [!div class="mx-tdBreakAll"]
62+
> |Action type|Advanced hunting table|Device timeline presentation|Properties|
63+
> |:---|:---|:-------|:-------------------------------|
64+
> |FileCreatedAggregatedReport|DeviceFileEvents|{ProcessName} created {Occurrences} {FilePath} files|1. File path </br> 2. Process name </br> 3. Process name|
65+
>|FileRenamedAggregatedReport|DeviceFileEvents|{ProcessName} renamed {Occurrences} {FilePath} files|1. File path </br> 2. Process name </br> 3. Process name|
66+
> |FileModifiedAggregatedReport|DeviceFileEvents|{ProcessName} modified {Occurrences} {FilePath} files|1. File path </br> 2. Process name </br> 3. Process name|
67+
> |ProcessCreatedAggregatedReport|DeviceProcessEvents|{InitiatingProcessName} created {Occurrences} {ProcessName} processes|1. Initiating process command line </br> 2. Initiating process SHA1 </br> 3. Initiating process file path </br> 4. Process command line </br> 5. Process SHA1 </br> 6. Folder path|
68+
> |ConnectionSuccessAggregatedReport|DeviceNetworkEvents|{InitiatingProcessName} established {Occurrences} connections with {RemoteIP}:{RemotePort}|1. Initiating process name </br> 2. Source IP </br> 3. Remote IP </br> 4. Remote port|
69+
> |ConnectionFailedAggregatedReport|DeviceNetworkEvents|{InitiatingProcessName} failed to establish {Occurrences} connections with {RemoteIP:RemotePort}|1. Initiating process name </br> 2. Source IP </br> 3. Remote IP </br> 4. Remote port|
70+
> |LogonSuccessAggregatedReport|DeviceLogonEvents|{Occurrences} {LogonType} logons by {UserName}&bsol;{DomainName}|1. Target username </br> 2. Target user SID </br> 3. Target domain name </br> 4. Logon type|
71+
> |LogonFailedAggregatedReport|DeviceLogonEvents|{Occurrences}{LogonType} logons failed by {UserName}&bsol;{DomainName} |1. Target username </br> 2. Target user SID </br> 3. Target domain name </br> 4. Logon type|
72+
73+
> [!NOTE]
74+
> Turning on aggregated reporting improves signal visibility, which might incur higher storage costs if you are streaming Defender for Endpoint advanced hunting tables to your SIEM or storage solutions.
75+
76+
To query new data with aggregated reports:
77+
78+
1. Go to **Investigation & response > Hunting > Custom detection rules**.
79+
2. Review and modify [existing rules and queries](/defender-xdr/custom-detection-rules) that might be affected by aggregated reporting.
80+
3. When necessary, create new custom rules to incorporate new action types.
81+
4. Go to the **Advanced Hunting** page and query the new data.
82+
83+
Here is an example of advanced hunting query results with aggregated reports.
84+
85+
:::image type="content" source="/defender-endpoint/media/reports/aggregated-reporting/sample-results-aggregated-reports-small.png" alt-text="Screenshot of advanced hunting query results with aggregated reports." lightbox="/defender-endpoint/media/reports/aggregated-reporting/sample-results-aggregated-reports.png":::
86+
87+
## Sample advanced hunting queries
88+
89+
You can use the following KQL queries to gather specific information using aggregated reporting.
90+
91+
### Query for noisy process activity
92+
93+
The following query highlights noisy process activity, which can be correlated with malicious signals.
94+
95+
```KQL
96+
DeviceProcessEvents
97+
| where Timestamp > ago(1h)
98+
| where ActionType == "ProcessCreatedAggregatedReport"
99+
| extend uniqueEventsAggregated = toint(todynamic(AdditionalFields).uniqueEventsAggregated)
100+
| project-reorder Timestamp, uniqueEventsAggregated, ProcessCommandLine, InitiatingProcessCommandLine, ActionType, SHA1, FolderPath, InitiatingProcessFolderPath, DeviceName
101+
| sort by uniqueEventsAggregated desc
102+
```
103+
104+
### Query for repeated sign in attempt failures
105+
106+
The following query identifies repeated sign-in attempt failures.
107+
108+
```KQL
109+
DeviceLogonEvents
110+
| where Timestamp > ago(30d)
111+
| where ActionType == "LogonFailedAggregatedReport"
112+
| extend uniqueEventsAggregated = toint(todynamic(AdditionalFields).uniqueEventsAggregated)
113+
| where uniqueEventsAggregated > 10
114+
| project-reorder Timestamp, DeviceId, uniqueEventsAggregated, LogonType, AccountName, AccountDomain, AccountSid
115+
| sort by uniqueEventsAggregated desc
116+
```
117+
118+
### Query for suspicious RDP connections
119+
120+
The following query identifies suspicious RDP connections, which might indicate malicious activity.
121+
122+
```KQL
123+
DeviceNetworkEvents
124+
| where Timestamp > ago(1d)
125+
| where ActionType endswith "AggregatedReport"
126+
| where RemotePort == "3389"
127+
| extend uniqueEventsAggregated = toint(todynamic(AdditionalFields).uniqueEventsAggregated)
128+
| where uniqueEventsAggregated > 10
129+
| project-reorder ActionType, Timestamp, uniqueEventsAggregated
130+
| sort by uniqueEventsAggregated desc
131+
```

‎defender-endpoint/media/reports/aggregated-reporting/aggregated-reporting-toggle.png‎

13.9 KB
Loading

‎defender-endpoint/media/reports/aggregated-reporting/sample-results-aggregated-reports-small.png‎

306 KB
Loading

‎defender-endpoint/media/reports/aggregated-reporting/sample-results-aggregated-reports.png‎

597 KB
Loading

‎defender-endpoint/whats-new-in-microsoft-defender-endpoint.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.author: deniseb
77
author: denisebmsft
88
ms.reviewer: noamhadash, pahuijbr, yongrhee
99
ms.localizationpriority: medium
10-
ms.date: 08/26/2024
10+
ms.date: 01/21/2025
1111
manager: deniseb
1212
audience: ITPro
1313
ms.collection:
@@ -51,6 +51,10 @@ For more information on Microsoft Defender for Endpoint on specific operating sy
5151
- [What's new in Defender for Endpoint on Android](android-whatsnew.md)
5252
- [What's new in Defender for Endpoint on iOS](ios-whatsnew.md)
5353

54+
## January 2025
55+
56+
- (Preview) **Aggregated reporting in Microsoft Defender for Endpoint**: Aggregated reporting extends signal reporting intervals to significantly reduce the size of reported events while preserving essential event properties. This feature is available for Microsoft Defender for Endpoint Plan 2. For more information, see [Aggregated reporting in Microsoft Defender for Endpoint](aggregated-reporting.md).
57+
5458
## August 2024
5559

5660
- **Network Protection feature is enabled by default** in Microsoft Defender for Endpoint on Android. As a result, users will be able to see a network protection card in the Defender for Endpoint app, along with App Protection and Web Protection. Users are also required to provide location permission to complete the setup process. Admins can change the default value for network protection if they decide not to use it via the Intune App Configuration policies. This feature was already enabled by default earlier on Microsoft Defender for Endpoint on iOS. For more information, see [network protection](/defender-endpoint/android-configure#network-protection).

‎defender-office-365/mdo-threat-classification.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ ms.collection:
1616
- tier1
1717
description: Admins can learn about threat classification in Microsoft Defender for Office 365.
1818
ms.service: defender-office-365
19-
ms.date: 01/06/2025
19+
ms.date: 01/21/2025
2020
appliesto:
2121
- ✅ <a href="https://learn.microsoft.com/defender-office-365/mdo-about#defender-for-office-365-plan-1-vs-plan-2-cheat-sheet" target="_blank">Microsoft Defender for Office 365 Plan 1 and Plan 2</a>
2222
- ✅ <a href="https://learn.microsoft.com/defender-xdr/microsoft-365-defender" target="_blank">Microsoft Defender XDR</a>
@@ -84,3 +84,5 @@ The results of threat classification are available in the following experiences
8484
- [Explorer (Threat Explorer)](threat-explorer-real-time-detections-about.md)
8585
- [Incidents and alerts](mdo-sec-ops-manage-incidents-and-alerts.md)
8686
- [Advanced hunting](/defender-xdr/advanced-hunting-overview)
87+
- The [Threat protection status report](reports-email-security.md#view-data-by-email--phish-and-chart-breakdown-by-threat-classification-defender-for-office-365)
88+
- The [Mailflow status report](reports-email-security.md#mailflow-view-for-the-mailflow-status-report)

0 commit comments

Comments
 (0)