Skip to content

Commit 6543dbc

Browse files
vpattnaivpattnai
authored
Merge branch 'main' into dex-subservice
2 parents a2eb5f0 + 3860f6c commit 6543dbc

File tree

6 files changed

+138
-15
lines changed

6 files changed

+138
-15
lines changed

‎defender-xdr/deception-overview.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,20 @@ title: Manage the deception capability in Microsoft Defender XDR
33
description: Detect human-operated attacks with lateral movement in the early stages using high confidence signals from the deception feature in Microsoft Defender XDR.
44
ms.service: defender-xdr
55
f1.keywords:
6-
- NOCSH
6+
- NOCSH
77
ms.author: diannegali
88
author: diannegali
99
ms.localizationpriority: medium
1010
manager: dansimp
1111
audience: ITPro
1212
ms.collection:
13-
- m365-security
14-
- tier1
13+
- m365-security
14+
- tier1
1515
ms.topic: conceptual
1616
search.appverid:
17-
- MOE150
18-
- MET150
19-
ms.date: 08/08/2024
17+
- MOE150
18+
- MET150
19+
ms.date: 08/14/2024
2020
---
2121

2222
# Manage the deception capability in Microsoft Defender XDR
@@ -79,7 +79,7 @@ There are two types of lures available in the deception feature:
7979
8080
You can specify decoys, lures, and the scope in a deception rule. See [Configure the deception feature](configure-deception.md) to learn more about how to create and modify deception rules.
8181

82-
When an attacker uses a decoy or a lure on any Defender for Endpoint-onboarded client, the deception capability triggers an alert that indicates possible attacker activity, regardless of whether deception was deployed on the client or not.
82+
When an attacker uses a decoy on any Defender for Endpoint-onboarded client, the deception capability triggers an alert that indicates possible attacker activity, regardless of whether deception was deployed on the client or not.
8383

8484
## Identify incidents and alerts activated by deception
8585

‎exposure-management/TOC.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@
66
items:
77
- name: What is Microsoft Security Exposure Management?
88
href: microsoft-security-exposure-management.md
9+
- name: What's new
10+
href: whats-new.md
911
- name: Compare Secure Score and Security Exposure Management
1012
href: compare-secure-score-security-exposure-management.md
1113
- name: Get started

‎exposure-management/exposure-insights-overview.md‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -164,10 +164,7 @@ Events measure the score drop or worsening in the metric status. Events include:
164164

165165
- **Metric score drop events**: These events are issued with there's a decrease of at least 2% in metric score (exposure grew by 2%) since yesterday.
166166
- **Initiative score drop events**: These events are issued when there's a decrease of at least 2% in initiative score since yesterday.
167-
168-
169-
On the **Events** page for an initiative, you can view and filter events.
170-
167+
- **New Initiave event**: These events are issued when a new inititave is available in MSEM.
171168

172169
## Next steps
173170

‎exposure-management/get-started-exposure-management.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,4 +101,4 @@ You can hover over points on the timeline to see what the score of the key initi
101101

102102
- [Overview of attack paths](work-attack-paths-overview.md).
103103
- [Identify and manage critical assets](critical-asset-management.md).
104-
- [Improve security insights with exposure insights](exposure-insights-overview.md).
104+
- [Improve security insights with exposure insights](exposure-insights-overview.md).

‎exposure-management/index.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,9 @@ metadata:
1212
- m365-security
1313
- tier1
1414
ms.custom: intro-hub-or-landing
15-
author: siosulli
16-
ms.author: siosulli
17-
ms.date: 03/04/2024
15+
author: dlanger
16+
ms.author: dlanger
17+
ms.date: 06/19/2024
1818

1919

2020
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new
@@ -29,6 +29,8 @@ landingContent:
2929
links:
3030
- text: What is Microsoft Security Exposure Management?
3131
url: microsoft-security-exposure-management.md
32+
- text: What's new
33+
url: whats-new.md
3234

3335
# Card
3436
- title: Get started

‎exposure-management/whats-new.md‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
---
2+
title: Release notes
3+
description: This page is updated frequently with the latest updates in Microsoft Security Exposure Management.
4+
ms.author: dlanger
5+
author: dlanger
6+
manager: rayne-wiselman
7+
ms.topic: overview
8+
ms.service: exposure-management
9+
ms.date: 08/14/2024
10+
---
11+
12+
# What's new in Microsoft Security Exposure Management?
13+
14+
Microsoft Security Exposure Management (MSEM) is in active development and receives improvements on an ongoing basis. To stay up to date with the most recent developments, this page provides you with information about new features, bug fixes, and deprecated functionality.
15+
16+
<!-- Please don't adjust this next line without getting approval from the Defender for Cloud documentation team. It is necessary for proper RSS functionality. -->
17+
This page is updated frequently with the latest updates in Microsoft Security Exposure Management.
18+
19+
Learn more about MSEM by reading the blogs, [here](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/bg-p/MicrosoftSecurityandCompliance).
20+
21+
Security Exposure Management is currently in public preview.
22+
23+
> [!TIP]
24+
> Get notified when this page is updated by copying and pasting the following URL into your feed reader:
25+
>
26+
> `https://aka.ms/msem/rss`
27+
28+
## August 2024
29+
30+
### New predefined classifications
31+
32+
The following predefined **Identity** classification rules were added to the critical assets list:
33+
34+
| Classification | Description |
35+
| --------------------------------------------- | ------------------------------------------------------------ |
36+
| External Identity Provider Administrator | This rule applies to identities assigned with the Microsoft Entra "External Identity Provider Administrator" role. |
37+
| Domain Name Administrator | This rule applies to identities assigned with the Microsoft Entra "Domain Name Administrator" role. |
38+
| Permissions Management Administrator | This rule applies to identities assigned with the Microsoft Entra "Permissions Management Administrator" role. |
39+
| Billing Administrator | This rule applies to identities assigned with the Microsoft Entra "Billing Administrator" role. |
40+
| License Administrator | This rule applies to identities assigned with the Microsoft Entra "License Administrator" role. |
41+
| Teams Administrator | This rule applies to identities assigned with the Microsoft Entra "Teams Administrator" role. |
42+
| External ID User Flow Administrator | This rule applies to identities assigned with the Microsoft Entra "External ID User Flow Administrator" role. |
43+
| External ID User Flow Attribute Administrator | This rule applies to identities assigned with the Microsoft Entra "External ID User Flow Attribute Administrator" role. |
44+
| B2C IEF Policy Administrator | This rule applies to identities assigned with the Microsoft Entra "B2C IEF Policy Administrator" role. |
45+
| Compliance Data Administrator | This rule applies to identities assigned with the Microsoft Entra "Compliance Data Administrator" role. |
46+
| Authentication Policy Administrator | This rule applies to identities assigned with the Microsoft Entra "Authentication Policy Administrator" role. |
47+
| Knowledge Administrator | This rule applies to identities assigned with the Microsoft Entra "Knowledge Administrator" role. |
48+
| Knowledge Manager | This rule applies to identities assigned with the Microsoft Entra "Knowledge Manager" role. |
49+
| Attribute Definition Administrator | This rule applies to identities assigned with the Microsoft Entra "Attribute Definition Administrator" role. |
50+
| Attribute Assignment Administrator | This rule applies to identities assigned with the Microsoft Entra "Attribute Assignment Administrator" role. |
51+
| Identity Governance Administrator | This rule applies to identities assigned with the Microsoft Entra "Identity Governance Administrator" role. |
52+
| Cloud App Security Administrator | This rule applies to identities assigned with the Microsoft Entra "Cloud App Security Administrator" role. |
53+
| Windows 365 Administrator | This rule applies to identities assigned with the Microsoft Entra "Windows 365 Administrator" role. |
54+
| Yammer Administrator | This rule applies to identities assigned with the Microsoft Entra "Yammer Administrator" role. |
55+
| Authentication Extensibility Administrator | This rule applies to identities assigned with the Microsoft Entra "Authentication Extensibility Administrator" role. |
56+
| Lifecycle Workflows Administrator | This rule applies to identities assigned with the Microsoft Entra "Lifecycle Workflows Administrator" role. |
57+
58+
For more information, see, [Predefined classifications](predefined-classification-rules-and-levels.md)
59+
60+
### New Initiative Event
61+
62+
A new event type has been created to notify users when a new initiative is added to MSEM.
63+
64+
For more information, see, [Overview - Exposure insights](exposure-insights-overview.md)
65+
66+
### News from the Research Team
67+
68+
Read more about what the research team has been up to in this blog - [Bridging the On-premises to Cloud Security Gap: Cloud Credentials Detection](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/bridging-the-on-premises-to-cloud-security-gap-cloud-credentials/ba-p/4211794)
69+
70+
## July 2024
71+
72+
### New predefined classifications
73+
74+
The following predefined classification rules were added to the critical assets list:
75+
76+
| Classification | Description |
77+
| ------------------------------------------------------------ | ------------------------------------------------------------ |
78+
| **Exchange** | This rule applies to devices identified as operational Exchange servers within a domain. These servers might hold sensitive data of the organization. |
79+
| **VMware ESXi** | This rule applies to devices identified as operational ESXi servers. These devices might hold other sensitive or critical devices. |
80+
| **VMware vCenter** | This rule applies to devices identified as operational VMware vCenter and frequently used by admins to manage the virtual infrastructure. |
81+
| **Identity with Privileged Azure Role** | This rule applies to identities assigned with a Privileged Azure role, over a potentially business-critical scope. |
82+
| **Exchange Administrator** | This rule applies to identities assigned with the Microsoft Entra "Exchange Administrator" role. |
83+
| **SharePoint Administrator** | This rule applies to identities assigned with the Microsoft Entra "SharePoint Administrator" role. |
84+
| **Compliance Administrator** | This rule applies to identities assigned with the Microsoft Entra "Compliance Administrator" role. |
85+
| **Groups Administrator** | This rule applies to identities assigned with the Microsoft Entra "Groups Administrator" role. |
86+
| **Confidential Azure Virtual Machine** | This rule applies to Azure confidential Virtual Machines. |
87+
| **Locked Azure Virtual Machine** | This rule applies to Azure virtual machines that are safeguarded by a lock. |
88+
| **Azure Virtual Machine with High Availability and Performance** | This rule applies to Azure Virtual Machines that use premium Azure storage and are configured with an availability set. |
89+
| **Immutable Azure Storage** | This rule applies to Azure storage accounts that have immutability support enabled. |
90+
| **Immutable and Locked Azure Storage** | This rule applies to Azure storage accounts that have immutability support enabled with a locked policy in place. |
91+
| **Azure Virtual Machine has a Critical Signed-in user** | This rule applies to Azure Virtual Machines with a Critical user signed in protected by Defender for Endpoint with high or very high-criticality users signed in. |
92+
| **Azure Key Vaults with Many Connected Identities** | This rule applies to Azure Key Vaults with high access compared to others, indicating critical workload usage. |
93+
94+
For more information, see, [Predefined classifications](predefined-classification-rules-and-levels.md)
95+
96+
## May 2024
97+
98+
### Integration with Threat Analytics
99+
100+
- New integration with Threat Analytics to enhance the set of domain security initiatives with threat-based security initiatives. These initiatives focus on specific attack techniques and active threat actors, as seen and analyzed by expert Microsoft security researchers.
101+
102+
- **Blog** - [Respond to trending threats and adopt zero-trust with Exposure Management](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/respond-to-trending-threats-and-adopt-zero-trust-with-exposure/ba-p/4130133)
103+
104+
For more information, see, [Review security initiatives](initiatives.md)
105+
106+
### New Exposure Management Tables
107+
108+
- MSEM released two new powerful tables within Advanced Hunting: *ExposureGraphNodes* and *ExposureGraphEdges*.
109+
110+
- **Blog** - [Microsoft Security Exposure Management Graph: unveiling the power](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/microsoft-security-exposure-management-graph-unveiling-the-power/ba-p/4148546)
111+
112+
For more information, see, [Query the enterprise exposure graph](query-enterprise-exposure-graph.md)
113+
114+
## April 2024
115+
116+
### Critical Asset Protection
117+
118+
- Microsoft Security Exposure Management introduces a contextual risk-based approach, allowing organizations to identify and prioritize critical assets effectively. By assessing potential exposures in real time, security teams gain clarity and focus on safeguarding their digital assets.
119+
120+
- **Blog** - [Critical Asset Protection with Microsoft Security Exposure Management](https://techcommunity.microsoft.com/t5/security-compliance-and-identity/critical-asset-protection-with-microsoft-security-exposure/ba-p/4122645)
121+
122+
For more information, see, [Overview of critical asset management](critical-asset-management.md)

0 commit comments

Comments
 (0)