You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Defender Vulnerability Management delivers asset visibility, intelligent assessments, and built-in remediation tools for Windows, macOS, Linux, Android, iOS, and network devices. Using Microsoft threat intelligence, breach likelihood predictions, business contexts, and devices assessments, Defender Vulnerability Management rapidly and continuously prioritizes the biggest vulnerabilities on your most critical assets and provides security recommendations to mitigate risk.
29
29
30
-
Watch the following video to learn more about Defender Vulnerability Management.
> Did you know you can try all the features in Microsoft Defender Vulnerability Management for free? Find out how to [sign up for a free trial](defender-vulnerability-management-trial.md).
36
32
@@ -74,7 +70,23 @@ Enable security administrators and IT administrators to collaborate and seamless
74
70
-**Alternate mitigations** - Gain insights on other mitigations, such as configuration changes that can reduce risk associated with software vulnerabilities.
75
71
-**Real-time remediation status** - Real-time monitoring of the status and progress of remediation activities across the organization.
76
72
77
-
## Navigation pane
73
+
## Vulnerability management experience in Microsoft Defender portal
|[**Exposure management > Vulnerability management > Overview**](tvm-dashboard-insights.md)|Get a high-level view of your organization's vulnerability information, including the endpoints exposure score, top recommendations, events, vulnerable software, remediation activities, and more. |
82
+
|[**Exposure management > Recommendations**](tvm-security-recommendation.md)|See all Microsoft security recommendations in a single, streamlined experience. The **Vulnerabilities** section lists security recommendations and related threat information, where you can dive into recommendations related to specific vulnerabilities. |
83
+
|[**Exposure management > Vulnerability management > Remediation**](tvm-remediation.md)|See remediation activities you've created and recommendation exceptions.|
84
+
|[**Exposure management > Vulnerability management > Inventories**](tvm-software-inventory.md)|Discover and assess all your organization's assets in a single view.|
85
+
|[**Exposure management > Vulnerability management > Vulnerabilities**](tvm-weaknesses.md)|See the list of common vulnerabilities and exposures (CVEs) in your organization.|
86
+
|[**Exposure management > Vulnerability management > Overview > Top impactful events**](threat-and-vuln-mgt-event-timeline.md)|View events that may impact your organization's risk. You can also access the event timeline from the **Recommendations > Score history** section.|
87
+
|[**Exposure management > Vulnerability management > Baseline assessments**](tvm-security-baselines.md)|Monitor security baseline compliance and identify changes in real-time.|
88
+
89
+
# [Existing customers](#tab/existing-customers)
78
90
79
91
|Area|Description|
80
92
|---|---|
@@ -86,6 +98,8 @@ Enable security administrators and IT administrators to collaborate and seamless
86
98
|[**Event timeline**](threat-and-vuln-mgt-event-timeline.md)|View events that may impact your organization's risk.|
87
99
|[**Baselines assessment**](tvm-security-baselines.md)|Monitor security baseline compliance and identify changes in real-time.|
88
100
101
+
---
102
+
89
103
## APIs
90
104
91
105
Run vulnerability management related API calls to automate vulnerability management workflows. To get started, see [Supported Microsoft Defender for Endpoint APIs](/defender-endpoint/api/exposed-apis-list).
-[Microsoft Defender for Endpoint Plan 2](/defender-endpoint/microsoft-defender-endpoint)
27
-
-[Microsoft Defender XDR](/defender-xdr)
28
-
-[Microsoft Defender for Servers Plan 1 & 2](/azure/defender-for-cloud/plan-defender-for-servers-select-plan)
28
+
Security recommendations can help reduce your overall vulnerability exposure and your exposure score. A robust update process is key when it comes to addressing these recommendations in your organization. If an update hasn't completed for some devices due to a pending restart, the effect of addressing the security recommendation isn't reflected in your exposure score.
29
29
30
30
Security recommendations in Defender Vulnerability Management can help reduce your overall vulnerability exposure and your exposure score. A robust update process is key when it comes to addressing these recommendations in your organization. If an update hasn't completed for some devices due to a pending restart, the effect of addressing the security recommendation isn't reflected in your exposure score.
31
31
@@ -41,15 +41,15 @@ The **Pending restart** tag helps you identify devices in this state so you can
41
41
42
42
The device restart status is visible in the following experiences in the Microsoft Defender portal.
43
43
44
-
### Security recommendations page
44
+
### Recommendations page
45
45
46
-
On the security recommendations pages, filter by the **Pending restart** tag to only see security recommendations with devices pending a restart.
46
+
On the **Recommendations** page, filter by the **Pending restart** tag to only see security recommendations with devices pending a restart.
47
47
48
48
:::image type="content" alt-text="pending restart tag in the security recommendations page." source="/defender/media/defender-vulnerability-management/pending-restart.png" lightbox="/defender/media/defender-vulnerability-management/pending-restart.png":::
49
49
50
50
### Software page
51
51
52
-
On the software page filter by, the **Pending restart** tag to see missing KBs with devices that are pending a restart:
52
+
On the software page filter by the **Pending restart** tag to see missing KBs with devices that are pending a restart:
53
53
54
54
:::image type="content" alt-text="pending restart tag in the software page." source="/defender/media/defender-vulnerability-management/pending-restart-KB.png" lightbox="/defender/media/defender-vulnerability-management/pending-restart-KB.png":::
Copy file name to clipboardExpand all lines: defender-vulnerability-management/threat-and-vuln-mgt-event-timeline.md
+50-18Lines changed: 50 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,8 +2,8 @@
2
2
title: Event timeline
3
3
description: Event timeline is a risk news feed that helps you interpret how risk is introduced into the organization, and which mitigations happened to reduce it.
-[Microsoft Defender for Endpoint Plan 2](/defender-endpoint/microsoft-defender-endpoint)
27
-
-[Microsoft Defender XDR](/defender-xdr)
28
-
-[Microsoft Defender for Servers Plan 1 & 2](/azure/defender-for-cloud/plan-defender-for-servers-select-plan)
29
-
30
27
Event timeline is a risk news feed that helps you interpret how risk is introduced into the organization through new vulnerabilities or exploits. You can view events that may impact your organization's risk. For example, you can find new vulnerabilities that were introduced, vulnerabilities that became exploitable, exploit that was added to an exploit kit, and more.
31
28
32
29
Event timeline also tells the story of your [exposure score](tvm-exposure-score.md) and [Microsoft Secure Score for Devices](tvm-microsoft-secure-score-devices.md) so you can determine the cause of large changes. Events can impact your devices or your score for devices. Reduce you exposure by addressing what needs to be remediated based on the prioritized [security recommendations](tvm-security-recommendation.md).
@@ -36,22 +33,55 @@ Event timeline also tells the story of your [exposure score](tvm-exposure-score.
36
33
37
34
## Navigate to the Event timeline page
38
35
39
-
There are three entry points from the [Microsoft Defender Vulnerability Management dashboard](tvm-dashboard-insights.md):
-**Exposure management** > **Vulnerability management** > **Overview** page: In the **Top impactful events** card, select **View all events** at the bottom of the table.
43
+
- The card displays the three most impactful events in the last 7 days. Impactful events indicate whether the event affects a large number of devices, or if it's a critical vulnerability.
44
+
-**Exposure management** > **Recommendations** page: In the **Score history** card, select **View all events** at the bottom of the graph.
45
+
46
+
# [Existing customers](#tab/existing-customers)
47
+
48
+
There are three entry points from the **Endpoints** > **Vulnerability management** > **Dashboard** page to the event timeline:
40
49
41
50
-**Organization exposure score card**: Hover over the event dots in the "Exposure Score over time" graph and select "See all events from this day." The events represent software vulnerabilities.
42
51
-**Microsoft Secure Score for Devices**: Hover over the event dots in the "Your score for devices over time" graph and select "See all events from this day." The events represent new configuration assessments.
43
52
-**Top events card**: Select "Show more" at the bottom of the top events table. The card displays the three most impactful events in the last 7 days. Impactful events can include if the event affects a large number of devices, or if it is a critical vulnerability.
44
53
54
+
---
55
+
45
56
### Exposure score and Microsoft Secure Score for Devices graphs
46
57
47
-
In the Defender Vulnerability Management dashboard, hover over the Exposure score graph to view top software vulnerability events from that day that impacted your devices. Hover over the Microsoft Secure Score for Devices graph to view new security configuration assessments that affect your score.
If there are no events that affect your devices or your score for devices, then none will be shown.
62
+
In the Exposure management **Overview** page, hover over the **Score history** card under **Vulnerability management** to view top software vulnerability events from that day that impacted your devices.
64
+
Selecting **Show all events from this day** takes you to the Event timeline page with a custom date range for that day.
53
65
54
-
### Drill down to events from that day
66
+
:::image type="content" source="/defender/media/defender-vulnerability-management/score-history-timeline.png" alt-text="Score history card.":::
67
+
68
+
To change the date range, select the **Date events occurred** filter above the table, and in the **Filter** flyout pane, select a different date under **Date event occurred**.
69
+
70
+
71
+
72
+
In the Exposure management **Recommendations** page, hover over the **Score history** graph to view new security configuration assessments that affect your score.
73
+
74
+
If there are no events that affect your devices or your score for devices, no events are displayed.
In the Defender Vulnerability Management dashboard, hover over the **Exposure score** graph to view top software vulnerability events from that day that impacted your devices.
79
+
80
+
Hover over the **Microsoft Secure Score for Devices** graph to view new security configuration assessments that affect your score.
81
+
82
+
If there are no events that affect your devices or your score for devices, no events are displayed.
0 commit comments