You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/indicators-overview.md
+2-3Lines changed: 2 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -159,10 +159,9 @@ The IoC API schema and the threat IDs in Advanced Hunting are updated to align w
159
159
160
160
Microsoft Store apps cannot be blocked by Microsoft Defender because they're signed by Microsoft.
161
161
162
-
Customers might experience issues with alerts for IoCs. The following scenarios are situations where alerts aren't created or are created with inaccurate information. Each issue is investigated by our engineering team.
162
+
Customers might experience issues with alerts for IoCs. The following scenarios are situations where alerts aren't created or are created with inaccurate information.
163
163
164
-
-**Block indicators**: Generic alerts with informational severity only are created. Custom alerts (that is, custom title and severity) aren't fired in these cases.
165
-
-**Warn indicators**: Generic alerts and custom alerts are possible in this scenario; however, the results aren't deterministic due to an issue with the alert detection logic. In some cases, customers might see a generic alert, whereas a custom alert might show in other cases.
164
+
-**Block and Warn indicators**: Generic alerts with informational severity only are created. Custom alerts (that is, custom title and severity) aren't fired in these cases.
166
165
-**Allow**: No alerts are generated (by design).
167
166
-**Audit**: Alerts are generated based on the severity provided by the customer (by design).
168
167
- In some cases, alerts coming from EDR detections might take precedence over alerts stemming from antivirus blocks, in which case an information alert is generated.
- Vulnerability detection for Langflow, an open-source Python framework for building AI workflows and agents, has been enhanced with dynamic detection using advanced telemetry and Python package scanning. This includes the detection of CVE-2025-3248 with a CVSS score of 9.8, ensuring comprehensive vulnerability coverage.
59
+
60
+
- Client Analyzer is now bundled directly within the MDE package, eliminating the need for separate downloads. Both the binary and Python versions are included by default and can be found at /opt/microsoft/mdatp/tools/client_analyzer/. This ensures consistent availability across environments and streamlines troubleshooting for customers by making diagnostic tools readily accessible out-of-the-box.
- The `mdatp threat quarantine add` command now requires superuser (root) privileges.
75
93
- Custom definition path can now be updated without stopping Defender for Endpoint. Previously, this required stopping the service, but with this release onwards, updates to the definition path can be made dynamically, improving operational efficiency and reducing downtime.
76
94
- Running Defender for Endpoint on Linux alongside Fapolicyd is now supported on RHEL and Fedora-based distributions, enabling both antivirus (real-time protection) and EDR functionality to operate without conflict. For other fanotify-based tools, MDE can still be used safely by setting the antivirus enforcement level to passive, helping avoid system instability.
77
-
- Both the binary and Python versions of Client Analyzer are now included in the local package. There is no longer a need to download it separately, as it comes bundled by default. You can find it at the location `/opt/microsoft/mdatp/conf/client_analyzer/`.
Copy file name to clipboardExpand all lines: defender-endpoint/mac-install-manually.md
+4-3Lines changed: 4 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -44,9 +44,10 @@ Before you get started, see [the main Microsoft Defender for Endpoint on macOS p
44
44
45
45
> [!IMPORTANT]
46
46
> Manual installation of Microsoft Defender for Endpoint on macOS requires changes to the Privacy & Security Settings on macOS. Please consult Apple's documentation for details.
47
-
> [Change Privacy & Security settings on MacOS Sonoma 14](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/14.0/mac/14.0)
48
-
> [Change Privacy & Security settings on MacOS Sequoia 15](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/15.0/mac/15.0)
49
-
>
47
+
> -[Change Privacy & Security settings on MacOS Sonoma 14](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/14.0/mac/14.0)
48
+
> -[Change Privacy & Security settings on MacOS Sequoia 15](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/15.0/mac/15.0)
49
+
> -[Change Privacy & Security settings on MacOS Tahoe 26](https://support.apple.com/guide/mac-help/change-privacy-security-settings-on-mac-mchl211c911f/mac)
50
+
50
51
## Download installation and onboarding packages
51
52
52
53
Download the installation and onboarding packages from Microsoft Defender portal.
Copy file name to clipboardExpand all lines: defender-endpoint/mac-whatsnew.md
-8Lines changed: 0 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -59,14 +59,6 @@ To get the latest features, including preview capabilities (such as endpoint det
59
59
60
60
If an end user encounters a prompt for Defender for Endpoint on macOS processes such as `wdavdaemon_enterprise` or `Microsoft Defender Helper`, the end user can safely choose the **Deny** option. This selection doesn't affect Defender for Endpoint's functionality. Enterprises can also add *Microsoft Defender* to allow [incoming connections](https://support.apple.com/en-ca/guide/deployment/dep8d306275f/web). This issue is fixed in macOS Sequoia 15.2.
61
61
62
-
## Tahoe support
63
-
64
-
- Microsoft Defender for Endpoint supports version 26.0 or newer.
65
-
66
-
## Sequoia support
67
-
68
-
- Microsoft Defender for Endpoint supports version 15.0.1 or newer.
69
-
70
62
## macOS Deprecation
71
63
72
64
- Microsoft Defender for Endpoint no longer supports macOS 11 (Big Sur), 12 (Monterey) and 13 (Ventura)
Copy file name to clipboardExpand all lines: defender-endpoint/respond-machine-alerts.md
+7-6Lines changed: 7 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -103,19 +103,19 @@ Or, use this alternate procedure:
103
103
104
104
105
105
106
-
2. Add comments and then select **Confirm**.
106
+
1. Add comments and then select **Confirm**.
107
107
108
108
109
109
110
-
3. Select **Action center** from the response actions section of the device page.
110
+
1. Select **Action center** from the response actions section of the device page.
111
111
112
112
113
113
114
-
4. Select **Package collection package available** to download the collection package.
114
+
1. Select **Package collection package available** to download the collection package.
115
115
116
116
117
-
118
-
> [!NOTE]
117
+
118
+
> [!NOTE]
119
119
> The collection of the investigation package may fail if a device has a low battery level or is on a metered connection.
120
120
121
121
### Investigation package contents for Windows devices
@@ -216,7 +216,8 @@ Depending on the severity of the attack and the sensitivity of the device, you m
216
216
- You can use the device isolation capability on all supported Microsoft Defender for Endpoint on Linux listed in [System requirements](mde-linux-prerequisites.md). Ensure that the following prerequisites are enabled:
217
217
-`iptables`
218
218
-`ip6tables`
219
-
- Linux kernel with `CONFIG_NETFILTER`, `CONFID_IP_NF_IPTABLES`, and `CONFIG_IP_NF_MATCH_OWNER`
219
+
- Linux kernel with `CONFIG_NETFILTER`, `CONFIG_IP_NF_IPTABLES`, and `CONFIG_IP_NF_MATCH_OWNER` for kernel version lower than 5.x and `CONFIG_NETFILTER_XT_MATCH_OWNER` from 5.x kernel.
220
+
220
221
- Selective isolation is available for devices running on Windows 11, Windows 10 version 1703 or later, Windows Server 2012 R2 and later, Azure Stack HCI OS, version 23H2 and later, and macOS. For more information about selective isolation, see [Isolation exclusions](./isolation-exclusions.md).
221
222
- When isolating a device, only certain processes and destinations are allowed. Therefore, devices that are behind a full VPN tunnel won't be able to reach the Microsoft Defender for Endpoint cloud service after the device is isolated. We recommend using a split-tunneling VPN for Microsoft Defender for Endpoint and Microsoft Defender Antivirus cloud-based protection-related traffic.
Copy file name to clipboardExpand all lines: defender-for-cloud-apps/troubleshooting-cloud-discovery.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -41,7 +41,7 @@ You can track the processing of cloud discovery logs using the governance log. T
41
41
|----|----|
42
42
|Couldn't connect to the log collector over FTP| 1. Verify that you're using FTP credentials and not SSH credentials. <br />2. Verify that the FTP client you're using isn't set to SFTP (Secure File Transfer Protocol). |
43
43
|Failed updating collector configuration | 1. Verify that you entered the latest access token. <br />2. Verify in your firewall that the log collector is allowed to initiate outbound traffic on port 443.|
44
-
|Logs sent to the collector don't appear in the portal | 1. Check to see if there are failed parsing tasks in the Governance log. <br /> If so, troubleshoot the error with the Log Parsing error table above.<br /> 2. If not, check the data sources and Log collector configuration in the portal. <br /> a. In the Data source page, verify that the name of data source is **NSS** and that it's configured correctly. <br /> b. In the Log collectors page, verify that the data source is linked to the right log collector. <br /> 3. Check the local configuration of the on-premises log collector machine. <br /> a. Log in to the log collector over SSH and run the collector_config utility.<br/> b. Confirm that your firewall or proxy is sending logs to the log collector using the protocol you defined (Syslog/TCP, Syslog/UDP, or FTP) and that it's sending them to the correct port and directory.<br /> c. Run netstat on the machine and verify that it receives incoming connections from your firewall or proxy <br /> 4. Verify that the log collector is allowed to initiate outbound traffic on port 443. |
44
+
|Logs sent to the collector don't appear in the portal | 1. Check to see if there are failed parsing tasks in the Governance log. <br /> If so, troubleshoot the error with the Log Parsing error table above.<br /> 2. If not, check the data sources and Log collector configuration in the portal. <br /> a. In the Log collectors page, verify that the data source is linked to the right log collector. <br /> 3. Check the local configuration of the on-premises log collector machine. <br /> a. Log in to the log collector over SSH and run the collector_config utility.<br/> b. Confirm that your firewall or proxy is sending logs to the log collector using the protocol you defined (Syslog/TCP, Syslog/UDP, or FTP) and that it's sending them to the correct port and directory.<br /> c. Run netstat on the machine and verify that it receives incoming connections from your firewall or proxy <br /> 4. Verify that the log collector is allowed to initiate outbound traffic on port 443. |
45
45
|Log collector status: Created | The log collector deployment wasn't completed. Complete the on-premises deployment steps according to the deployment guide.|
46
46
|Log collector status: Disconnected | If you see this issue, it means no data has been received in the last 24 hours from any of the linked data sources. Contact Microsoft Defender for Cloud Apps support and provide the log files for investigation. Our team analyzes the logs to identify when the last sync occurred and what caused the disconnection. |
47
47
|Failed pulling latest collector image| If you get this error during Docker deployment, it could be that you don't have enough memory on the host. To check this, run this command on the host: `docker pull mcr.microsoft.com/mcas/logcollector`. If it returns this error: `failed to register layer: Error processing tar file(exist status 1): write /opt/jdk/jdk1.8.0_152/src.zip: no space left on device` contact your host machine administrator to provide more space.|
Copy file name to clipboardExpand all lines: defender-for-identity/deploy/prerequisites-sensor-version-3.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,6 @@ For more information, see [Licensing and privacy FAQs](/defender-for-identity/te
34
34
- You must either be a [Security Administrator](/entra/identity/role-based-access-control/permissions-reference), or have the following [Unified RBAC](../role-groups.md#unified-role-based-access-control-rbac) permissions:
35
35
-`System settings (Read and manage)`
36
36
-`Security setting (All permissions)`
37
-
- We recommend using at least one Directory Service account, with read access to all objects in the monitored domains. For more information, see [Configure a Directory Service account for Microsoft Defender for Identity](directory-service-accounts.md).
38
37
39
38
## Sensor requirements and recommendations
40
39
@@ -49,6 +48,7 @@ The following table summarizes the server requirements and recommendations for t
49
48
|Connectivity|Requires a Microsoft Defender for Endpoint deployment. If Microsoft Defender for Endpoint is installed on the domain controller, there are no additional connectivity requirements. |
50
49
|Server time synchronization|The servers and domain controllers onto which the sensor is installed must have time synchronized to within five minutes of each other.|
51
50
|ExpressRoute|This version of the sensor doesn't support ExpressRoute. If your environment uses ExpressRoute, we recommend [deploying the Defender for Identity sensor v2.x](install-sensor.md).|
51
+
|Identity and response actions|The sensor doesn't require credentials to be provided in the portal. Even if credentials are entered, the sensor uses the **Local System identity** on the server to query Active Directory and perform response actions. If a **Group Managed Service Account (gMSA)** is configured for response actions, the response actions are disabled. |
0 commit comments