Merge pull request #2647 from MicrosoftDocs/main

denisebmsft · web-flow · commit 6f526932db66 · 2025-02-04T08:26:44.000-08:00
pushing updates live per PM request
diff --git a/.openpublishing.redirection.defender-endpoint.json b/.openpublishing.redirection.defender-endpoint.json
@@ -79,6 +79,11 @@
       "source_path": "defender-endpoint/pilot-deploy-defender-endpoint.md",
       "redirect_url": "/defender-xdr/pilot-deploy-defender-endpoint",
       "redirect_document_id": false
-    }
+    },
+    {
+      "source_path": "defender-endpoint/monthly-security-summary-report.md",
+      "redirect_url": "/defender-endpoint/threat-protection-reports#monthly-security-summary",
+      "redirect_document_id": true
+    }    
   ]
 }
diff --git a/defender-endpoint/TOC.yml b/defender-endpoint/TOC.yml
@@ -605,9 +605,6 @@
       - name: Manage device group and tags
         href: machine-tags.md
 
-    - name: Host firewall reporting in Microsoft Defender for Endpoint
-      href: host-firewall-reporting.md
-
     - name: Tamper resiliency
       href: tamper-resiliency.md
 
@@ -633,8 +630,6 @@
             href: attack-surface-reduction-rules-deployment-operationalize.md
         - name: Attack surface reduction rules reference
           href: attack-surface-reduction-rules-reference.md
-        - name: Attack surface reduction rules report
-          href: attack-surface-reduction-rules-report.md
         - name: Troubleshoot attack surface reduction rules
           href: troubleshoot-asr-rules.md
         - name: Enable ASR rules alternate configuration methods
@@ -665,8 +660,6 @@
           href: device-control-deploy-manage-gpo.md
         - name: Device control frequently asked questions
           href: device-control-faq.md
-        - name: Device control reports
-          href: device-control-report.md
       - name: Exploit protection
         items:
         - name: Protect devices from exploits
@@ -703,8 +696,6 @@
           items:
           - name: Web threat protection overview
             href: web-threat-protection.md
-          - name: Monitor web security
-            href: web-protection-monitoring.md
           - name: Respond to web threats
             href: web-protection-response.md
         - name: Web content filtering
@@ -910,13 +901,6 @@
 
       - name: Diagnostics for Microsoft Defender Antivirus
         items:
-        - name: Device health reports
-          href: device-health-reports.md
-          items:
-          - name: Microsoft Defender Antivirus health report
-            href: device-health-microsoft-defender-antivirus-health.md
-          - name: Sensor health and OS report
-            href: device-health-sensor-health-os.md
         - name: Microsoft Defender Core service overview
           href: microsoft-defender-core-service-overview.md
         - name: Microsoft Defender Core service configurations and experimentation 
@@ -1121,14 +1105,27 @@
     items:
     - name: Reports
       items:
-        - name: Monthly security summary
-          href: monthly-security-summary-report.md
-        - name: Create custom reports using Power BI
-          href: api/api-power-bi.md
-        - name: Threat protection reports
+        - name: Microsoft Defender for Endpoint reports
           href: threat-protection-reports.md
+        - name: Device health reports
+          href: device-health-reports.md
+          items:
+          - name: Microsoft Defender Antivirus health report
+            href: device-health-microsoft-defender-antivirus-health.md
+          - name: Sensor health and OS report
+            href: device-health-sensor-health-os.md
+        - name: Host firewall reporting
+          href: host-firewall-reporting.md
+        - name: Web protection and monitoring reports
+          href: web-protection-monitoring.md
+        - name: Device control reports
+          href: device-control-report.md
+        - name: Attack surface reduction rules report
+          href: attack-surface-reduction-rules-report.md                                                    
         - name: Aggregated reports
-          href: aggregated-reporting.md                 
+          href: aggregated-reporting.md
+        - name: Create custom reports using Power BI
+          href: api/api-power-bi.md                         
     - name: Configure integration with other Microsoft solutions
       items:
       - name: Configure conditional access
diff --git a/defender-endpoint/api/export-firmware-hardware-assessment.md b/defender-endpoint/api/export-firmware-hardware-assessment.md
@@ -162,7 +162,7 @@ GET /api/machines/HardwareFirmwareInventoryExport
 > [!NOTE]
 >
 > - The files are GZIP compressed & in multiline JSON format.
-> - The download URLs are valid for 6 hours.
+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
 > - To maximize download speeds, make sure you are downloading the data from the same Azure region where your data resides.
 > - Each record is approximately 1KB of data. You should take this into account when choosing the pageSize parameter that works for you.
 > - Some additional columns might be returned in the response. These columns are temporary and might be removed. Only use the documented columns.
diff --git a/defender-endpoint/api/export-security-baseline-assessment.md b/defender-endpoint/api/export-security-baseline-assessment.md
@@ -167,7 +167,7 @@ GET /api/machines/BaselineComplianceAssessmentExport
 > [!NOTE]
 > 
 > - The files are GZIP compressed & in multiline JSON format.
-> - The download URLs are valid for 6 hours.
+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
 > - To maximize download speeds, make sure you are downloading the data from the same Azure region where your data resides.
 > - Some additional columns might be returned in the response. These columns are temporary and might be removed. Only use the documented columns.
 
diff --git a/defender-endpoint/api/get-assessment-browser-extensions.md b/defender-endpoint/api/get-assessment-browser-extensions.md
@@ -191,7 +191,7 @@ GET /api/machines/browserextensionsinventoryExport
 > [!NOTE]
 >
 > - The files are GZIP compressed & in multiline JSON format.
-> - The download URLs are valid for 6 hours.
+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
 > - For maximum download speed of your data, you can make sure you're downloading from the same Azure region that your data resides.
 
 <br>
@@ -200,7 +200,7 @@ GET /api/machines/browserextensionsinventoryExport
 
 Property (ID)|Data type|Description|Example of a returned value
 :---|:---|:---|:---
-Export files|array\[string\]|A list of download URLs for files holding the current snapshot of the organization|"[Https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]
+Export files|array[string]|A list of download URLs for files holding the current snapshot of the organization|"[Https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]
 GeneratedTime|string|The time that the export was generated.|2021-05-20T08:00:00Z
 
 ### 2.6 Examples
diff --git a/defender-endpoint/api/get-assessment-information-gathering.md b/defender-endpoint/api/get-assessment-information-gathering.md
@@ -78,7 +78,7 @@ GET /api/Machines/InfoGatheringExport
 > [!NOTE]
 > 
 > - The files are GZIP compressed & in multiline JSON format.
-> - The download URLs are valid for 6 hours.
+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
 > - To maximize download speeds, make sure you are downloading the data from the same Azure region where your data resides.
 > - Some additional columns might be returned in the response. These columns are temporary and might be removed. Only use the documented columns.
 
diff --git a/defender-endpoint/api/get-assessment-non-cpe-software-inventory.md b/defender-endpoint/api/get-assessment-non-cpe-software-inventory.md
@@ -189,7 +189,7 @@ GET /api/machines/SoftwareInventoryNonCpeExport
 > [!NOTE]
 >
 > - The files are GZIP compressed & in multiline JSON format.
-> - The download URLs are valid for 6 hours.
+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
 > - For maximum download speed of your data, you can make sure you're downloading from the same Azure region that your data resides.
 
 <br>
@@ -198,7 +198,7 @@ GET /api/machines/SoftwareInventoryNonCpeExport
 
 Property (ID)|Data type|Description|Example of a returned value
 :---|:---|:---|:---
-Export files|array\[string\]|A list of download URLs for files holding the current snapshot of the organization|"[Https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]
+Export files|array[string]|A list of download URLs for files holding the current snapshot of the organization|"[Https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]
 GeneratedTime|string|The time that the export was generated.|2021-05-20T08:00:00Z
 |
 
diff --git a/defender-endpoint/api/get-assessment-secure-config.md b/defender-endpoint/api/get-assessment-secure-config.md
@@ -247,7 +247,7 @@ GET /api/machines/SecureConfigurationsAssessmentExport
 > [!NOTE]
 >
 > - The files are GZIP compressed & in multiline JSON format.
-> - The download URLs are valid for 6 hours.
+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
 > - For maximum download speed of your data, you can make sure you are downloading from the same Azure region in which your data resides.
 
 
diff --git a/defender-endpoint/api/get-assessment-software-inventory.md b/defender-endpoint/api/get-assessment-software-inventory.md
@@ -245,7 +245,7 @@ GET /api/machines/SoftwareInventoryExport
 > [!NOTE]
 >
 > - The files are GZIP compressed & in multiline JSON format.
-> - The download URLs are valid for 6 hours.
+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
 > - For maximum download speed of your data, you can make sure you're downloading from the same Azure region that your data resides.
 
 <br>
@@ -254,7 +254,7 @@ GET /api/machines/SoftwareInventoryExport
 
 Property (ID)|Data type|Description|Example of a returned value
 :---|:---|:---|:---
-Export files|array\[string\]|A list of download URLs for files holding the current snapshot of the organization|"[Https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]
+Export files|array[string]|A list of download URLs for files holding the current snapshot of the organization|"[Https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]
 GeneratedTime|string|The time that the export was generated.|2021-05-20T08:00:00Z
 |
 
diff --git a/defender-endpoint/api/get-assessment-software-vulnerabilities.md b/defender-endpoint/api/get-assessment-software-vulnerabilities.md
@@ -100,7 +100,7 @@ CveId|String|Unique identifier assigned to the security vulnerability under the
 CvssScore|String|The CVSS score of the CVE.|6.2
 DeviceId|String|Unique identifier for the device in the service.|9eaf3a8b5962e0e6b1af9ec756664a9b823df2d1
 DeviceName|String|Fully qualified domain name (FQDN) of the device.|johnlaptop.europe.contoso.com
-DiskPaths|Array\[string\]|Disk evidence that the product is installed on the device.|["C:\Program Files (x86)\Microsoft\Silverlight\Application\silverlight.exe"]
+DiskPaths|Array[string]|Disk evidence that the product is installed on the device.|["C:\Program Files (x86)\Microsoft\Silverlight\Application\silverlight.exe"]
 ExploitabilityLevel|String|The exploitability level of this vulnerability (NoExploit, ExploitIsPublic, ExploitIsVerified, ExploitIsInKit)|ExploitIsInKit
 FirstSeenTimestamp|String|First time this product CVE was seen on the device.|2020-11-03 10:13:34.8476880
 ID|String|Unique identifier for the record.|123ABG55_573AG&mnp!
@@ -110,7 +110,7 @@ RbacGroupName|String|The role-based access control (RBAC) group. If this device
 RecommendationReference|String|A reference to the recommendation ID related to this software.|va-_-microsoft-_-silverlight
 RecommendedSecurityUpdate (optional)|String|Name or description of the security update provided by the software vendor to address the vulnerability.|April 2020 Security Updates
 RecommendedSecurityUpdateId (optional)|String|Identifier of the applicable security updates or identifier for the corresponding guidance or knowledge base (KB) articles|4550961
-RegistryPaths|Array\[string\]|Registry evidence that the product is installed in the device.|["HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MicrosoftSilverlight"]
+RegistryPaths|Array[string]|Registry evidence that the product is installed in the device.|["HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MicrosoftSilverlight"]
 SecurityUpdateAvailable|Boolean|Indicates whether a security update is available for the software.| Possible values are true or false.
 SoftwareName|String|Name of the software product.|Chrome
 SoftwareVendor|String|Name of the software vendor.|Google
@@ -297,7 +297,7 @@ GET /api/machines/SoftwareVulnerabilitiesExport
 > [!NOTE]
 >
 > - The files are GZIP compressed & in multiline JSON format.
-> - The download URLs are valid for 6 hours.
+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
 > - For maximum download speed of your data, you can make sure you're downloading from the same Azure region that your data resides.
 >
 > - Each record is 1KB of data. You should take this into account when choosing the correct pageSize parameter for you.
@@ -309,7 +309,7 @@ GET /api/machines/SoftwareVulnerabilitiesExport
 
 Property (ID)|Data type|Description|Example of a returned value
 :---|:---|:---|:---
-Export files|array\[string\]|A list of download URLs for files holding the current snapshot of the organization.|["https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]
+Export files|array[string]|A list of download URLs for files holding the current snapshot of the organization.|["https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]
 GeneratedTime|String|The time that the export was generated.|2021-05-20T08:00:00Z
 |
 
diff --git a/defender-endpoint/exploit-protection-reference.md b/defender-endpoint/exploit-protection-reference.md
@@ -439,7 +439,7 @@ Hardware-enforced stack protection offers robust protection against ROP exploits
 
 Hardware-enforced stack protection only works on chipsets with support for hardware shadow stacks, Intel's Control-flow Enforcement Technology (CET) or AMD shadow stacks.
 
-If you're running applications based on the .Net Framework, hardware-enforced stack protection is compatible with .Net Framework 7 (opt-in), .Net Framework 9.0, or newer.  If you're using an application with an older version (earlier than .Net Framework 7), expect stability issues (crashes or hangs) and/or performance issues (high cpu or memory leaks).
+If you're running applications based on the .Net Framework, hardware-enforced stack protection is compatible with .Net Framework 7 (opt-in), or newer.  If you're using an application with an older version (earlier than .Net Framework 7), expect stability issues (crashes or hangs) and/or performance issues (high cpu or memory leaks). These stability issues could also occur when either in audit mode and/or when targeting only compatible modules.
 
 ### Configuration options
 
diff --git a/defender-endpoint/linux-support-perf.md b/defender-endpoint/linux-support-perf.md
diff --git a/defender-endpoint/mde-linux-deployment-on-sap.md b/defender-endpoint/mde-linux-deployment-on-sap.md
diff --git a/defender-endpoint/microsoft-defender-endpoint-linux.md b/defender-endpoint/microsoft-defender-endpoint-linux.md
diff --git a/defender-endpoint/monthly-security-summary-report.md b/defender-endpoint/monthly-security-summary-report.md
diff --git a/defender-endpoint/threat-protection-reports.md b/defender-endpoint/threat-protection-reports.md

Original file line number	Diff line number	Diff line change
`@@ -79,6 +79,11 @@`
`79`	`79`	`"source_path": "defender-endpoint/pilot-deploy-defender-endpoint.md",`
`80`	`80`	`"redirect_url": "/defender-xdr/pilot-deploy-defender-endpoint",`
`81`	`81`	`"redirect_document_id": false`
`82`		`- }`
	`82`	`+ },`
	`83`	`+ {`
	`84`	`+ "source_path": "defender-endpoint/monthly-security-summary-report.md",`
	`85`	`+ "redirect_url": "/defender-endpoint/threat-protection-reports#monthly-security-summary",`
	`86`	`+ "redirect_document_id": true`
	`87`	`+ }`
`83`	`88`	`]`
`84`	`89`	`}`
Original file line number	Diff line number	Diff line change
`@@ -162,7 +162,7 @@ GET /api/machines/HardwareFirmwareInventoryExport`
`162`	`162`	`> [!NOTE]`
`163`	`163`	`>`
`164`	`164`	`> - The files are GZIP compressed & in multiline JSON format.`
`165`		`-> - The download URLs are valid for 6 hours.`
	`165`	+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
`166`	`166`	`> - To maximize download speeds, make sure you are downloading the data from the same Azure region where your data resides.`
`167`	`167`	`> - Each record is approximately 1KB of data. You should take this into account when choosing the pageSize parameter that works for you.`
`168`	`168`	`> - Some additional columns might be returned in the response. These columns are temporary and might be removed. Only use the documented columns.`
Original file line number	Diff line number	Diff line change
`@@ -167,7 +167,7 @@ GET /api/machines/BaselineComplianceAssessmentExport`
`167`	`167`	`> [!NOTE]`
`168`	`168`	`>`
`169`	`169`	`> - The files are GZIP compressed & in multiline JSON format.`
`170`		`-> - The download URLs are valid for 6 hours.`
	`170`	+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
`171`	`171`	`> - To maximize download speeds, make sure you are downloading the data from the same Azure region where your data resides.`
`172`	`172`	`> - Some additional columns might be returned in the response. These columns are temporary and might be removed. Only use the documented columns.`
`173`	`173`
Original file line number	Diff line number	Diff line change
`@@ -78,7 +78,7 @@ GET /api/Machines/InfoGatheringExport`
`78`	`78`	`> [!NOTE]`
`79`	`79`	`>`
`80`	`80`	`> - The files are GZIP compressed & in multiline JSON format.`
`81`		`-> - The download URLs are valid for 6 hours.`
	`81`	+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
`82`	`82`	`> - To maximize download speeds, make sure you are downloading the data from the same Azure region where your data resides.`
`83`	`83`	`> - Some additional columns might be returned in the response. These columns are temporary and might be removed. Only use the documented columns.`
`84`	`84`
Original file line number	Diff line number	Diff line change
`@@ -189,7 +189,7 @@ GET /api/machines/SoftwareInventoryNonCpeExport`
`189`	`189`	`> [!NOTE]`
`190`	`190`	`>`
`191`	`191`	`> - The files are GZIP compressed & in multiline JSON format.`
`192`		`-> - The download URLs are valid for 6 hours.`
	`192`	+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
`193`	`193`	`> - For maximum download speed of your data, you can make sure you're downloading from the same Azure region that your data resides.`
`194`	`194`
`195`	`195`	`<br>`
`@@ -198,7 +198,7 @@ GET /api/machines/SoftwareInventoryNonCpeExport`
`198`	`198`
`199`	`199`	`Property (ID)\|Data type\|Description\|Example of a returned value`
`200`	`200`	`:---\|:---\|:---\|:---`
`201`		`-Export files\|array\[string\]\|A list of download URLs for files holding the current snapshot of the organization\|"[Https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]`
	`201`	`+Export files\|array[string]\|A list of download URLs for files holding the current snapshot of the organization\|"[Https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]`
`202`	`202`	`GeneratedTime\|string\|The time that the export was generated.\|2021-05-20T08:00:00Z`
`203`	`203`	`\|`
`204`	`204`
Original file line number	Diff line number	Diff line change
`@@ -247,7 +247,7 @@ GET /api/machines/SecureConfigurationsAssessmentExport`
`247`	`247`	`> [!NOTE]`
`248`	`248`	`>`
`249`	`249`	`> - The files are GZIP compressed & in multiline JSON format.`
`250`		`-> - The download URLs are valid for 6 hours.`
	`250`	+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
`251`	`251`	`> - For maximum download speed of your data, you can make sure you are downloading from the same Azure region in which your data resides.`
`252`	`252`
`253`	`253`
Original file line number	Diff line number	Diff line change
`@@ -245,7 +245,7 @@ GET /api/machines/SoftwareInventoryExport`
`245`	`245`	`> [!NOTE]`
`246`	`246`	`>`
`247`	`247`	`> - The files are GZIP compressed & in multiline JSON format.`
`248`		`-> - The download URLs are valid for 6 hours.`
	`248`	+> - The download URLs are valid for 1 hour unless the `sasValidHours` parameter is used.
`249`	`249`	`> - For maximum download speed of your data, you can make sure you're downloading from the same Azure region that your data resides.`
`250`	`250`
`251`	`251`	`<br>`
`@@ -254,7 +254,7 @@ GET /api/machines/SoftwareInventoryExport`
`254`	`254`
`255`	`255`	`Property (ID)\|Data type\|Description\|Example of a returned value`
`256`	`256`	`:---\|:---\|:---\|:---`
`257`		`-Export files\|array\[string\]\|A list of download URLs for files holding the current snapshot of the organization\|"[Https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]`
	`257`	`+Export files\|array[string]\|A list of download URLs for files holding the current snapshot of the organization\|"[Https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...1", "https://tvmexportstrstgeus.blob.core.windows.net/tvm-export...2"]`
`258`	`258`	`GeneratedTime\|string\|The time that the export was generated.\|2021-05-20T08:00:00Z`
`259`	`259`	`\|`
`260`	`260`