You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-[Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
26
25
-[Microsoft Defender for Endpoint Plan 2](microsoft-defender-endpoint.md)
27
26
-[Microsoft Defender XDR](/defender-xdr)
28
27
29
-
> [!IMPORTANT]
30
-
> The Microsoft Defender for Endpoint Threat Protection report page is now deprecated and is no longer available. Microsoft recommends that you transition to either the Defender XDR alerts or advanced hunting to understand endpoint threat protection details. See the following sections for more information.
28
+
This article provides an overview of the reports available to Microsoft Defender for Endpoint users. It offers information on various reports that can be used to collect data, summarize findings, and obtain recommended actions when applicable.
29
+
30
+
## Monthly security summary
31
+
32
+
The **monthly security summary** report helps organizations get a visual summary of key findings and overall preventative actions taken to enhance the organization's overall security posture completed in the last 30 or 90 days. It helps you identify areas of strength and improvement, track your progress over time, and prioritize your actions based on risk and impact.
33
+
34
+
To access this report, navigate to **Reports > Endpoints > Monthly Security Summary**. The monthly security summary report contains the following sections:
35
+
36
+
| Section | Description |
37
+
|---------|---------|
38
+
|[Microsoft Secure Score](/defender-xdr/microsoft-secure-score)| Microsoft Secure Score is a measurement of an organization's security posture and how well you have implemented security best practices and recommendations across the devices in your organization. The secure score card shows how the overall cybersecurity strength of an organization has improved in the past month and how it compares to other companies with similar number of managed devices. |
39
+
|Secure score compared to other organizations | This score is an evaluation of an organization's security score in relation to organizations of a similar size. It's a way to benchmark an organization's performance in implementing security measures compared to other organizations of an equivalent size. |
40
+
| Devices onboarded | The devices card provides information on the number of devices that were onboarded in the last month as well as devices still not onboarded. Onboarding devices are essential for enabling protection and detection capabilities. |
41
+
| Protection against specific threats | This card shows how effective your defenses are against common attack vectors such as phishing and ransomware. A higher number indicates better defense in place against phishing and ransomware. The report shows how many threats were blocked or mitigated in the last month and how your protection level has increased. |
42
+
| Web content monitoring and filtering | Shows the number of malicious URLs that were blocked by Microsoft Defender for Endpoint in the last month. The report also shows the categories of URLs that were blocked and the number of clicks for each category. |
43
+
| Suspicious or malicious activities | Track how many incidents and alerts were resolved in the past month using the incidents card. The card also shows all active incidents and alerts that require attention. You'll also be able to see a list of the top 10 severe incidents, their status, number of alerts, and the impacted devices and users. |
31
44
32
-
## Use the alert queue filter in Defender XDR
45
+
You can generate a PDF report of the summary, by selecting **Generate PDF report**. The generated report is a summary of the last 30 days.
33
46
34
-
Due to the deprecation of the Defender for Endpoint Threat protection report, you can use the Defender XDR alerts view, filtered against Defender for Endpoint, to see the current status of alerts for protected devices. For alert status, such as *unresolved*, you can filter against *New* and *In progress* items. [Learn more about Defender XDR Alerts](/defender-xdr/investigate-alerts).
47
+
## Threat protection report
35
48
36
-
## Use Advanced hunting queries
49
+
To gather data on Defender for Endpoint threat protection information, you can use the Microsoft Defender alerts queue or create advanced hunting queries. The following sections provide guidance on how to use these tools to find the information you need.
37
50
38
-
Due to the deprecation of the Defender for Endpoint Threat protection report, you can use Advanced hunting queries to find Defender for Endpoint threat protection information. Currently there's no alert status in Advanced hunting elements that maps to resolve/unresolve. [Learn more about Advanced hunting in Defender XDR](/defender-xdr/advanced-hunting-overview). See the following section for a sample advanced hunting query that shows endpoint related threat protection details.
51
+
### Use the alert queue filter in the Microsoft Defender portal
39
52
40
-
### Alert status
53
+
You can use the Microsoft Defender portal alerts view, filtered against Defender for Endpoint, to see the current status of alerts for protected devices. For alert status, such as *unresolved*, you can filter against *New* and *In progress* items. [Learn more about the alerts queue](/defender-xdr/investigate-alerts).
54
+
55
+
### Use advanced hunting queries
56
+
57
+
You can also use advanced hunting queries to find Defender for Endpoint threat protection information. [Learn more about advanced hunting in Defender XDR](/defender-xdr/advanced-hunting-overview). See the following section for a sample advanced hunting query that shows endpoint-related threat protection details.
58
+
59
+
#### Alert status
41
60
42
61
```kusto
43
62
// Severity
@@ -49,7 +68,7 @@ AlertInfo
49
68
// Detection source
50
69
AlertInfo
51
70
| where Timestamp > startofday(now()) // Today
52
-
| summarize count() by Severity
71
+
| summarize count() by DetectionSource
53
72
| render columnchart
54
73
55
74
// Detection category
@@ -59,14 +78,13 @@ AlertInfo
59
78
| render columnchart
60
79
```
61
80
62
-
63
-
### Alert trend
81
+
#### Alert trend
64
82
65
83
```kusto
66
84
// Severity
67
85
AlertInfo
68
86
| where Timestamp > ago(30d)
69
-
| summarize count() by DetectionSource , bin(Timestamp, 1d)
87
+
| summarize count() by Severity , bin(Timestamp, 1d)
70
88
| render timechart
71
89
72
90
// Detection source
@@ -82,7 +100,24 @@ AlertInfo
82
100
| render timechart
83
101
```
84
102
85
-
## Related articles
103
+
## Reports about Defender for Endpoint capabilities
104
+
105
+
The following reports provide in-depth information about events and actions related to Defender for Endpoint capabilities:
106
+
107
+
-[Device health reports](device-health-reports.md)
-[Device control report](device-control-report.md)
112
+
113
+
## Create custom reports using Power BI
114
+
115
+
You can also create customized reports using Power BI. To create your own report, see [Create custom reports using Power BI](/defender-endpoint/api/api-power-bi).
116
+
117
+
## Aggregated reporting
118
+
119
+
You can review all signals collected by Defender for Endpoint by turning on aggregated reporting.
120
+
121
+
To turn aggregated reporting on, go to **Settings > Endpoints > Advanced features**. Toggle on the **Aggregated reporting** feature. Learn more about [aggregated reporting in Defender for Endpoint](/defender-endpoint/aggregated-reporting).
86
122
87
-
-[Device health and compliance report](device-health-reports.md)
88
123
[!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)]
0 commit comments