You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CloudAppSecurityDocs/troubleshooting-cloud-discovery.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
---
2
2
title: Troubleshooting cloud discovery errors
3
3
description: This article provides a list of cloud discovery frequent errors and resolution recommendations for each.
4
-
ms.date: 05/15/2024
4
+
ms.date: 02/19/2025
5
5
ms.topic: conceptual
6
6
---
7
7
# Troubleshooting cloud discovery errors
@@ -18,7 +18,7 @@ If you integrated Microsoft Defender for Endpoint with Defender for Cloud Apps,
18
18
19
19
|Issue|Resolution|
20
20
|----|----|
21
-
|**Defender-managed endpoints** reports do not appear in the list|Make sure the devices you're connecting to are Windows 10 version 1809 or later, and that you waited the necessary two hours that it takes before your data is accessible.|
21
+
|**Defender-managed endpoints** reports don't appear in the list|Make sure the devices you're connecting to are Windows 10 version 1809 or later, and that you waited the necessary two hours that it takes before your data is accessible.|
22
22
|**Discovery reports are empty**|If the endpoint device is behind a forward proxy, you can send logs from your forward proxy using a log collector|
23
23
24
24
## Log parsing errors
@@ -39,11 +39,11 @@ You can track the processing of cloud discovery logs using the governance log. T
39
39
40
40
|Issue|Resolution|
41
41
|----|----|
42
-
|Couldn't connect to the log collector over FTP| 1. Verify that you're using FTP credentials and not SSH credentials. <br />2. Verify that the FTP client you are using is not set to SFTP. |
42
+
|Couldn't connect to the log collector over FTP| 1. Verify that you're using FTP credentials and not SSH credentials. <br />2. Verify that the FTP client you're using isn't set to SFTP (Secure File Transfer Protocol). |
43
43
|Failed updating collector configuration | 1. Verify that you entered the latest access token. <br />2. Verify in your firewall that the log collector is allowed to initiate outbound traffic on port 443.|
44
-
|Logs sent to the collector do not appear in the portal | 1. Check to see if there are failed parsing tasks in the Governance log. <br /> If so, troubleshoot the error with the Log Parsing error table above.<br /> 2. If not, check the data sources and Log collector configuration in the portal. <br /> a. In the Data source page, verify that the name of data source is **NSS** and that it is configured correctly. <br /> b. In the Log collectors page, verify that the data source is linked to the right log collector. <br /> 3. Check the local configuration of the on-premises log collector machine. <br /> a. Log in to the log collector over SSH and run the collector_config utility.<br/> b. Confirm that your firewall or proxy is sending logs to the log collector using the protocol you defined (Syslog/TCP, Syslog/UDP or FTP) and that it's sending them to the correct port and directory.<br /> c. Run netstat on the machine and verify that it receives incoming connections from your firewall or proxy <br /> 4. Verify that the log collector is allowed to initiate outbound traffic on port 443. |
45
-
|Log collector status: Created | The log collector deployment was not completed. Complete the on-premises deployment steps according to the deployment guide.|
46
-
|Log collector status: Disconnected |No data received in the last 24 hours from any of the linked data sources. |
44
+
|Logs sent to the collector don't appear in the portal | 1. Check to see if there are failed parsing tasks in the Governance log. <br /> If so, troubleshoot the error with the Log Parsing error table above.<br /> 2. If not, check the data sources and Log collector configuration in the portal. <br /> a. In the Data source page, verify that the name of data source is **NSS** and that it's configured correctly. <br /> b. In the Log collectors page, verify that the data source is linked to the right log collector. <br /> 3. Check the local configuration of the on-premises log collector machine. <br /> a. Log in to the log collector over SSH and run the collector_config utility.<br/> b. Confirm that your firewall or proxy is sending logs to the log collector using the protocol you defined (Syslog/TCP, Syslog/UDP, or FTP) and that it's sending them to the correct port and directory.<br /> c. Run netstat on the machine and verify that it receives incoming connections from your firewall or proxy <br /> 4. Verify that the log collector is allowed to initiate outbound traffic on port 443. |
45
+
|Log collector status: Created | The log collector deployment wasn't completed. Complete the on-premises deployment steps according to the deployment guide.|
46
+
|Log collector status: Disconnected |If you see this issue, it means no data has been received in the last 24 hours from any of the linked data sources. Contact Microsoft Defender for Cloud Apps support and provide the log files for investigation. Our team analyzes the logs to identify when the last sync occurred and what caused the disconnection. |
47
47
|Failed pulling latest collector image| If you get this error during Docker deployment, it could be that you don't have enough memory on the host. To check this, run this command on the host: `docker pull mcr.microsoft.com/mcas/logcollector`. If it returns this error: `failed to register layer: Error processing tar file(exist status 1): write /opt/jdk/jdk1.8.0_152/src.zip: no space left on device` contact your host machine administrator to provide more space.|
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-datasecuritybehaviors-table.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -47,12 +47,12 @@ For information on other tables in the advanced hunting schema, [see the advance
47
47
|-------------|-----------|-------------|
48
48
|`Timestamp`|`datetime`| Date and time when the record was generated or updated |
49
49
|`BehaviorId`|`string`| Unique identifier for the behavior |
50
-
|`ActionType`|`string`|Type of behavior. Refer to the catalog of behaviors detected by Microsoft Purview Insider Risk Management |
50
+
|`ActionType`|`string`|Type of behavior. Refer to the catalog of behaviors detected by Microsoft Purview Insider Risk Management.|
51
51
|`StartTime`|`datetime`|Date and time of the first activity related to the behavior|
52
52
|`EndTime`|`datetime`| Date and time of the last activity related to the behavior|
53
53
|`AttackTechniques`|`string`| MITRE ATT&CK techniques associated with the activity that triggered the behavior. Refer to subtechniques in the insider risk management behavior catalog.|
54
54
|`Categories`|`string`| Type of threat indicator or breach activity identified by the behavior|
55
-
|`ActivityType`|`enum`|Activity category based on categories in Microsoft Purview Insider Risk Management|
55
+
|`ActionCategory`|`enum`|Category of action that triggered the event |
56
56
|`Description`|`string`| Description of the behavior|
57
57
|`ServiceSource`|`string`| Product or service that identified the behavior|
58
58
|`DetectionSource`|`string`| Detection technology or sensor that identified the notable component or activity|
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-datasecurityevents-table.md
+5-4Lines changed: 5 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -50,7 +50,7 @@ For information on other tables in the advanced hunting schema, [see the advance
50
50
|`DlpPolicyMatchInfo`|`string`| Information around the list of data loss prevention (DLP) policies matching this event|
51
51
|`DlpPolicyEnforcementMode`|`int`| Indicates the Data Loss Prevention policy that was enforced; value can be: 0 (None), 1 (Audit), 2 (Warn), 3 (Warn and bypass), 4 (Block), 5 (Allow)|
52
52
|`DlpPolicyRuleMatchInfo`|`dynamic`| Details of the data loss prevention (DLP) rules that matched with this event; in JSON array format|
53
-
|`FileRenameInfo`|`string`| Details of the file (file name and extension) prior to this event|
53
+
|`FileRenameInfo`|`string`| Details of the file (file name and extension) before this event|
54
54
|`PhysicalAccessPointId`|`string`| Unique identifier for the physical access point|
55
55
|`PhysicalAccessPointName`|`string`| Name of the physical access point|
56
56
|`PhysicalAccessStatus`|`string`| Status of physical access, whether it succeeded or failed|
@@ -67,7 +67,7 @@ For information on other tables in the advanced hunting schema, [see the advance
67
67
|`Department`|`string`| Name of the department that the account user belongs to|
68
68
|`SourceCodeInfo`|`string`| Details of the source code repository involved in the event|
69
69
|`CcPolicyMatchInfo`|`dynamic`| Details of the Communications Compliance policy matches for this event; in JSON array format |
70
-
|`IPAddress`|`string`| IP addresses of the clients on which the activity was performed; can contain multiple Ips if related to Microsoft Defender for Cloud Apps alerts|
70
+
|`IPAddress`|`string`| IP addresses of the clients on which the activity was performed; can contain multiple IPs if related to Microsoft Defender for Cloud Apps alerts|
71
71
|`Timestamp`|`datetime`| Date and time when the event was recorded|
72
72
|`DeviceSourceLocationType`|`int`| Indicates the type of location where the endpoint signals originated from; values can be: 0 (Unknown), 1 (Local), 2 (Remote), 3 (Removable), 4 (Cloud), 5 (File share)|
73
73
|`DeviceDestinationLocationType`|`int`| Indicates the type of location where the endpoint signals connected to; values can be: 0 (Unknown), 1 (Local), 2 (Remote), 3 (Removable), 4 (Cloud), 5 (File share)|
@@ -82,8 +82,8 @@ For information on other tables in the advanced hunting schema, [see the advance
82
82
|`InternetMessageId`|`string`|Public-facing identifier for the email or Teams message that is set by the sending email system |
83
83
|`NetworkMessageId`|`guid`| Unique identifier for the email, generated by Microsoft 365 |
84
84
|`EmailSubject`|`string`| Subject of the email|
85
-
|`ObjectId`|`string`|Unique identifier of the object that the recorded action was applied to, in case of files it includes the extension|
86
-
|`ObjectName`|`string`| Name of the object that the recorded action was applied to, in case of files it includes the extension|
85
+
|`ObjectId`|`string`|Unique identifier of the object that the recorded action was applied to, in case of files, it includes the extension|
86
+
|`ObjectName`|`string`| Name of the object that the recorded action was applied to, in case of files, it includes the extension|
87
87
|`ObjectType`|`string`| Type of object, such as a file or a folder, that the recorded action was applied to|
88
88
|`ObjectSize`|`int`| Size of the object in bytes|
89
89
|`IsHidden`|`bool`| Indicates whether the user has marked the content as hidden (True) or not (False) |
@@ -102,6 +102,7 @@ For information on other tables in the advanced hunting schema, [see the advance
102
102
|`Workload`|`string`| The Microsoft 365 service where the event occurred|
103
103
|`IrmActionCategory`|`enum`| A unique enumeration value indicating the activity category in Microsoft Purview Insider Risk Management|
104
104
|`SequenceCorrelationId`|`string`|Details of the sequence activity|
105
+
|`CloudAppAlertId`|`string`| Unique identifier for the alert in Microsoft Defender for Cloud Apps |
When an automatic attack disruption triggers in Microsoft Defender XDR, the details about the risk and the containment status of compromised assets are available during and after the process. You can view the details on the incident page, which provides the full details of the attack and the up-to-date status of associated assets.
32
31
33
32
## Review the incident graph
@@ -58,16 +57,18 @@ You can use specific queries in [advanced hunting](advanced-hunting-overview.md)
58
57
Contain actions triggered by attack disruption are found in the [DeviceEvents table](advanced-hunting-deviceevents-table.md) in advanced hunting. Use the following queries to hunt for these specific contain actions:
Microsoft Defender XDR correlates millions of individual signals to identify active ransomware campaigns or other sophisticated attacks in the environment with high confidence. While an attack is in progress, Defender XDR disrupts the attack by automatically containing compromised assets that the attacker is using through automatic attack disruption.
33
31
34
32
Automatic attack disruption limits lateral movement early on and reduces the overall impact of an attack, from associated costs to loss of productivity. At the same time, it leaves security operations teams in complete control of investigating, remediating, and bringing assets back online.
@@ -105,7 +103,7 @@ The Defender XDR user experience now includes additional visual cues to ensure v
105
103
106
104
- A tag titled *Attack Disruption* appears next to affected incidents
107
105
108
-
1. On the incident page:
106
+
2. On the incident page:
109
107
110
108
- A tag titled *Attack Disruption*
111
109
- A yellow banner at the top of the page that highlights the automatic action taken
@@ -121,7 +119,7 @@ For more information, see [view attack disruption details and results](autoad-re
121
119
122
120
## Next steps
123
121
124
-
-[Configuring automatic attack disruption in Microsoft Defender XDR](configure-attack-disruption.md)
Copy file name to clipboardExpand all lines: defender-xdr/configure-deception.md
+5-6Lines changed: 5 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Configure the deception capability in Microsoft Defender XDR
3
-
description: Learn how to create, edit, and delete deception rules in Microsoft Defender XDR.
3
+
description: Learn how to create, edit, and delete deception rules in the Microsoft Defender portal.
4
4
ms.service: defender-xdr
5
5
f1.keywords:
6
6
- NOCSH
@@ -12,21 +12,20 @@ audience: ITPro
12
12
ms.collection:
13
13
- m365-security
14
14
- tier1
15
-
ms.topic: conceptual
15
+
ms.topic: how-to
16
16
search.appverid:
17
17
- MOE150
18
18
- MET150
19
19
ms.date: 01/12/2024
20
+
appliesto:
21
+
- Microsoft Defender XDR
22
+
#customer intent: As a security analyst, I want to learn how to configure the deception capability so that I can protect my organization from high-impact attacks that use human-operated lateral movement.
20
23
---
21
24
22
25
# Configure the deception capability in Microsoft Defender XDR
> The built-in [deception](deception-overview.md) capability in Microsoft Defender XDR covers all Windows clients onboarded to Microsoft Defender for Endpoint. Learn how to onboard clients to Defender for Endpoint in [Onboard to Microsoft Defender for Endpoint](/defender-endpoint/onboarding).
Copy file name to clipboardExpand all lines: defender-xdr/custom-detection-rules.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -123,11 +123,11 @@ With the query in the query editor, select **Create detection rule** and specify
123
123
124
124
-**Detection name** - Name of the detection rule; should be unique
125
125
-**Frequency** -Interval for running the query and taking action. [See more guidance in the rule frequency section](#rule-frequency)
126
-
-**Alert title** - Title displayed with alerts triggered by the rule; should be unique.
126
+
-**Alert title** - Title displayed with alerts triggered by the rule; should be unique and in plaintext. Strings are sanitized for security purposes so HTML, Makrdown, and other code won't work.
127
127
-**Severity** - Potential risk of the component or activity identified by the rule.
128
128
-**Category** - Threat component or activity identified by the rule.
129
129
-**MITRE ATT&CK techniques** - One or more attack techniques identified by the rule as documented in the [MITRE ATT&CK framework](https://attack.mitre.org/). This section is hidden for certain alert categories, including malware, ransomware, suspicious activity, and unwanted software.
130
-
-**Description** - More information about the component or activity identified by the rule.
130
+
-**Description** - More information about the component or activity identified by the rule. Strings are sanitized for security purposes so HTML, Makrdown, and other code won't work.
131
131
-**Recommended actions** - Additional actions that responders might take in response to an alert.
0 commit comments