Skip to content

Commit 6f78d39

Browse files
committed
Update tvm-block-vuln-apps.md
1 parent 1fe5819 commit 6f78d39

File tree

1 file changed

+7
-7
lines changed

1 file changed

+7
-7
lines changed

defender-vulnerability-management/tvm-block-vuln-apps.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -26,18 +26,18 @@ ms.date: 12/05/2024
2626

2727
Remediating vulnerabilities takes time and can be dependent on the responsibilities and resources of the IT team. Security administrators can temporarily reduce the risk of a vulnerability by taking immediate action to block all currently known vulnerable versions of an application until the remediation request is completed. The block option gives your IT teams time to patch an application without worrying your security administrators that the vulnerabilities will be exploited.
2828

29-
While taking the remediation steps suggested by a security recommendation, security administartors can perform a mitigation action and block vulnerable versions of an application. File indicators of compromise (IOC)s are created for each of the executable files that belong to vulnerable versions of that application. Microsoft Defender Antivirus then enforces blocks on the devices that are in the specified scope.
29+
While taking the remediation steps suggested by a security recommendation, security administrators can perform a mitigation action and block vulnerable versions of an application. File indicators of compromise (IOC)s are created for each of the executable files that belong to vulnerable versions of that application. Microsoft Defender Antivirus then enforces blocks on the devices that are in the specified scope.
3030

3131
## Block or warn mitigation action
3232

3333
The **block action** is intended to block all installed vulnerable versions of the application in your organization from running. For example, if there's an active zero-day vulnerability you can block your users from running the affected software while you determine work-around options.
3434

3535
The **warn action** is intended to send a warning to your users when they open vulnerable versions of the application. Users can choose to bypass the warning and access the application for subsequent launches.
3636

37-
For both actions, you can customize the message the users see. For example, you can encourage them to install the latest version. Additionally, you can provide a custom URL the users navigate to when they select the notification. The user must select the body of the toast notification in order to navigate to the custom URL. This can be used to provide additional details specific to the application management in your organization.
37+
For both actions, you can customize the message the users see. For example, you can encourage them to install the latest version. Additionally, you can provide a custom URL the users navigate to when they select the notification. The user must select the body of the toast notification in order to navigate to the custom URL. The notification can be used to provide additional details specific to the application management in your organization.
3838

3939
> [!NOTE]
40-
> The block and warn actions are typically enforced within a couple of minutes but can take up to 3 hours.
40+
> The block and warn actions are typically enforced within a few minutes but can take up to three hours.
4141
4242
## Minimum requirements
4343

@@ -47,10 +47,10 @@ For both actions, you can customize the message the users see. For example, you
4747

4848
## Version requirements
4949

50-
- The Antimalware client version must be 4.18.1901.x or later.
51-
- The Engine version must be 1.1.16200.x or later.
52-
- Supported on Windows 10 devices, version 1809 or later, with the latest windows updates installed.
53-
- Supports Windows Server versions 2022, 2019, 2016, 2012 R2, and 2008 R2 SP1.
50+
- The Antimalware client version must be `4.18.1901.x` or later.
51+
- The Engine version must be `1.1.16200.x` or later.
52+
- Windows client devices must be running Windows 11 or Windows 10, version 1809 or later, with the latest windows updates installed.
53+
- Servers must be running Windows Server 2022, 2019, 2016, 2012 R2, and 2008 R2 SP1. Support for Windows Server 2025 is rolling out, beginning in February 2025 and over the next several weeks.
5454

5555
## How to block vulnerable applications
5656

0 commit comments

Comments
 (0)