Skip to content

Commit 63f61a1

Browse files
denisebmsftdenisebmsft
committed
Update network-protection.md
1 parent 08b7152 commit 63f61a1

File tree

1 file changed

+36
-30
lines changed

1 file changed

+36
-30
lines changed

‎defender-endpoint/network-protection.md‎

Lines changed: 36 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ title: Use network protection to help prevent connections to malicious or suspic
33
description: Protect your network by preventing users from accessing known malicious and suspicious network addresses
44
ms.service: defender-endpoint
55
ms.localizationpriority: medium
6-
ms.date: 12/12/2024
6+
ms.date: 12/13/2024
77
audience: ITPro
88
author: denisebmsft
99
ms.author: deniseb
@@ -53,24 +53,28 @@ The following table summarizes network protection areas of coverage.
5353
| Web Content Filtering | SmartScreen must be enabled | Network protection must be in block mode | Not supported |
5454

5555
> [!NOTE]
56-
> On Mac and Linux, you must have network protection in block mode to get support for these features in Edge.
56+
> On Mac and Linux, you must have network protection in block mode for these features to be supported in the Microsoft Edge browser.
5757
> On Windows, network protection does not monitor Microsoft Edge. For processes other than Microsoft Edge and Internet Explorer, web protection scenarios leverage network protection for inspection and enforcement.
58-
- IP is supported for all three protocols (TCP, HTTP, and HTTPS (TLS)).
58+
59+
Here are a few important points to keep in mind:
60+
61+
- IP is supported for all three protocols (`TCP`, `HTTP`, and `HTTPS` (TLS)).
5962
- Only single IP addresses are supported (no CIDR blocks or IP ranges) in custom indicators.
60-
- Encrypted URLs (full path) can only be blocked on first party browsers (Internet Explorer, Edge).
61-
> - Encrypted URLs (FQDN only) can be blocked in third party browsers (i.e. other than Internet Explorer, Edge).
62-
> - URLs loaded via HTTP connection coalescing, such as content loaded by modern CDN's, can only be blocked on first party browsers (Internet Explorer, Edge), unless the CDN URL itself is added to the indicator list.
63-
> - Full URL path blocks can be applied for unencrypted URLs.
64-
>
65-
> There might be up to 2 hours of latency (usually less) between the time the action is taken, and the URL and IP being blocked.
66-
>
63+
- Encrypted URLs (full path) are only blocked on Microsoft browsers (Internet Explorer, Edge).
64+
- Encrypted URLs (FQDN only) are blocked in non-Microsoft browsers.
65+
- URLs loaded via HTTP connection coalescing, such as content loaded by modern CDN's, are only blocked on Microsoft browsers (Internet Explorer, Edge), unless the CDN URL itself is added to the indicator list.
66+
- Full URL path blocks are applied for unencrypted URLs.
67+
68+
There might be up to two hours of latency (usually less) between the time when the action is taken and the URL/IP is blocked.
69+
6770
Watch this video to learn how Network protection helps reduce the attack surface of your devices from phishing scams, exploits, and other malicious content:
6871

6972
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4r4yZ]
7073
7174
## Requirements for network protection
7275

7376
Network protection requires devices running one of the following operating systems:
77+
7478
- Windows 10 or 11 (Pro or Enterprise) (see [Supported Windows versions](minimum-requirements.md#supported-windows-versions))
7579
- Windows Server, version 1803 or later (see [Supported Windows versions](minimum-requirements.md#supported-windows-versions))
7680
- macOS version 12 (Monterey) or later (see [Microsoft Defender for Endpoint on Mac](microsoft-defender-endpoint-mac.md))
@@ -119,13 +123,13 @@ Support for Command and Control servers (C2) is an important part of this ransom
119123

120124
| New mapping | Response category | Sources |
121125
| :--- | :--- | :--- |
122-
| phishing | Phishing | SmartScreen |
123-
| malicious | Malicious | SmartScreen |
124-
| command and control | C2 | SmartScreen |
125-
| command and control | COCO | SmartScreen |
126-
| malicious | Untrusted | SmartScreen |
127-
| by your IT admin | CustomBlockList | |
128-
| by your IT admin | CustomPolicy | |
126+
| `phishing` | Phishing | `SmartScreen` |
127+
| `malicious` | Malicious | `SmartScreen` |
128+
| `command and control` | C2 | `SmartScreen` |
129+
| `command and control` | COCO | `SmartScreen` |
130+
| `malicious` | Untrusted | `SmartScreen` |
131+
| `by your IT admin` | `CustomBlockList` | |
132+
| `by your IT admin` | `CustomPolicy` | |
129133

130134
> [!NOTE]
131135
> **customAllowList** does not generate notifications on endpoints.
@@ -224,11 +228,11 @@ The Response category tells you what caused the event, as in this example:
224228

225229
| ResponseCategory | Feature responsible for the event |
226230
|:---|:---|
227-
| CustomPolicy | WCF |
228-
| CustomBlockList | Custom indicators |
229-
| CasbPolicy | Defender for Cloud Apps |
230-
| Malicious | Web threats |
231-
| Phishing | Web threats |
231+
| `CustomPolicy` | WCF |
232+
| `CustomBlockList` | Custom indicators |
233+
| `CasbPolicy` | Defender for Cloud Apps |
234+
| `Malicious` | Web threats |
235+
| `Phishing` | Web threats |
232236

233237
For more information, see [Troubleshoot endpoint blocks](web-protection-overview.md#troubleshoot-endpoint-blocks).
234238

@@ -247,12 +251,12 @@ You can use the resulting list of URLs and IPs to determine what would be blocke
247251

248252
Once you've created an indicator, you can look at resolving the underlying issue as follows:
249253

250-
- SmartScreen – request review
251-
- Indicator – modify existing indicator
252-
- MCA – review unsanctioned app
253-
- WCF – request recategorization
254+
- **SmartScreen**: request review
255+
- **Indicator**: modify existing indicator
256+
- **MCA**: review unsanctioned app
257+
- **WCF**: request recategorization
254258

255-
Using this data you can make an informed decision on enabling Network protection in Block mode. See [Order of precedence for Network protection blocks](web-protection-overview.md#order-of-precedence).
259+
Using this data you can make an informed decision on enabling network protection in Block mode. See [Order of precedence for Network protection blocks](web-protection-overview.md#order-of-precedence).
256260

257261
> [!NOTE]
258262
> As this is a per-device setting, if there are devices that cannot move to Block mode you can simply leave them on audit until you can rectify the challenge and you will still receive the auditing events.
@@ -339,8 +343,8 @@ For Windows Server 2012 R2 and Windows Server 2016 using the [modern unified sol
339343
- `Set-MpPreference -AllowNetworkProtectionDownLevel 1`
340344
- `Set-MpPreference -AllowDatagramProcessingOnWinServer 1`
341345

342-
> [!NOTE]
343-
> In some cases, depending on your infrastructure, volume of traffic, and other conditions, `Set-MpPreference -AllowDatagramProcessingOnWinServer 1` can have an effect on network performance.
346+
> [!NOTE]
347+
> In some cases, depending on your infrastructure, volume of traffic, and other conditions, `Set-MpPreference -AllowDatagramProcessingOnWinServer 1` can have an effect on network performance.
344348
345349
### Network protection for Windows Servers
346350

@@ -350,7 +354,7 @@ Following is information specific to Windows Servers.
350354

351355
Verify whether network protection is enabled on a local device by using Registry Editor.
352356

353-
1. Select the **Start** button in the task bar and type **regedit** to open the Registry Editor.
357+
1. Select the **Start** button in the task bar and type `regedit` to open Registry Editor.
354358

355359
2. Select **HKEY_LOCAL_MACHINE** from the side menu.
356360

@@ -419,6 +423,7 @@ The most generic method to disable QUIC is to disable that feature in Windows Fi
419423

420424

421425
```powershell
426+
422427
Copy
423428
$ruleParams = @{
424429
DisplayName = "Block QUIC"
@@ -429,6 +434,7 @@ $ruleParams = @{
429434
RemotePort = 443
430435
}
431436
New-NetFirewallRule @ruleParams
437+
432438
```
433439

434440
### Disable QUIC in a web browser

0 commit comments

Comments
 (0)