Skip to content

Commit 855c828

Browse files
denisebmsftdenisebmsft
authored
Merge branch 'main' into docs-editor/fixed-reported-inaccuracies-1729590942
2 parents 8a88223 + ab26ee9 commit 855c828

11 files changed

+1201
-266
lines changed

‎.openpublishing.publish.config.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,7 @@
150150
"targets": {},
151151
"redirection_files": [
152152
".openpublishing.redirection.defender.json",
153+
".openpublishing.redirection.defender-cloud-apps.json",
153154
".openpublishing.redirection.defender-xdr.json"
154155
]
155156
}

‎.openpublishing.redirection.defender-cloud-apps.json‎

Lines changed: 999 additions & 0 deletions
Large diffs are not rendered by default.

‎.openpublishing.redirection.defender.json‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,11 @@
109109
"source_path": "defender-endpoint/defender-endpoint-demonstration-amsi.md",
110110
"redirect_url": "/defender-endpoint/mde-demonstration-amsi",
111111
"redirect_document_id": true
112+
},
113+
{
114+
"source_path": "defender-endpoint/techniques-device-timeline.md",
115+
"redirect_url": "/defender-endpoint/device-timeline-event-flag#techniques-in-the-device-timeline",
116+
"redirect_document_id": true
112117
}
113118
]
114119
}

‎defender-endpoint/indicator-ip-domain.md‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ ms.collection:
1515
ms.topic: conceptual
1616
ms.subservice:
1717
search.appverid: met150
18-
ms.date: 10/18/2024
18+
ms.date: 10/23/2024
1919
---
2020

2121
# Create indicators for IPs and URLs/domains
@@ -103,6 +103,9 @@ For processes other than Microsoft Edge and Internet Explorer, web protection sc
103103
- If there are conflicting URL indicator policies, the longer path is applied. For example, the URL indicator policy `https://support.microsoft.com/office` takes precedence over the URL indicator policy `https://support.microsoft.com`.
104104
- In the case of URL indicator policy conflicts, the longer path may not be applied due to redirection. In such cases, register a non-redirected URL.
105105

106+
> [!NOTE]
107+
> Custom Indicators of Compromise and Web Content Filtering features are currently not supported in Application Guard sessions of Microsoft Edge. These containerized browser sessions can only enforce web threat blocks via the built-in SmartScreen protection. They cannot enforce any enterprise web protection policies.
108+
106109
## Network protection and the TCP three-way handshake
107110

108111
With network protection, the determination of whether to allow or block access to a site is made after the completion of the [three-way handshake via TCP/IP](/troubleshoot/windows-server/networking/three-way-handshake-via-tcpip). Thus, when a site is blocked by network protection, you might see an action type of `ConnectionSuccess` under `NetworkConnectionEvents` in the Microsoft Defender portal, even though the site was blocked. `NetworkConnectionEvents` are reported from the TCP layer, and not from network protection. After the three-way handshake has completed, access to the site is allowed or blocked by network protection.
@@ -142,15 +145,15 @@ In the case where multiple different action types are set on the same indicator
142145
2. Warn
143146
3. Block
144147

145-
_Allow_ overrides _warn_ which overrides _block_: Allow > Warn > Block. Therefore, in the above example, `Microsoft.com` would be allowed.
148+
"Allow" overrides "warn," which overrides "block", as follows: `Allow` > `Warn` > `Block`. Therefore, in the previous example, `Microsoft.com` would be allowed.
146149

147150
### Defender for Cloud Apps Indicators
148151

149152
If your organization has enabled integration between Defender for Endpoint and Defender for Cloud Apps, block indicators will be created in Defender for Endpoint for all unsanctioned cloud applications. If an application is put in monitor mode, warn indicators (bypassable block) will be created for the URLs associated with the application. Allow indicators cannot be created for sanctioned applications at this time. Indicators created by Defender for Cloud Apps follow the same policy conflict handling described in the previous section.
150153

151154
## Policy precedence
152155

153-
Microsoft Defender for Endpoint policy has precedence over Microsoft Defender Antivirus policy. In situations when Defender for Endpoint is set to **Allow**, but Microsoft Defender Antivirus is set to **Block**, the policy will default to **Allow**.
156+
Microsoft Defender for Endpoint policy has precedence over Microsoft Defender Antivirus policy. In situations when Defender for Endpoint is set to `Allow`, but Microsoft Defender Antivirus is set to `Block`, the policy defaults to `Allow`.
154157

155158
### Precedence for multiple active policies
156159

‎defender-endpoint/mac-schedule-scan.md‎

Lines changed: 104 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,12 @@
22
title: How to schedule scans with Microsoft Defender for Endpoint on macOS
33
description: Learn how to schedule an automatic scanning time for Microsoft Defender for Endpoint in macOS to better protect your organization's assets.
44
ms.service: defender-endpoint
5-
author: YongRhee-MSFT
6-
ms.author: yongrhee
5+
author: denisebmsft
6+
ms.author: deniseb
77
manager: deniseb
8+
ms.reviewer: yonghree
89
ms.localizationpriority: medium
9-
ms.date: 05/06/2024
10+
ms.date: 10/23/2024
1011
audience: ITPro
1112
ms.collection:
1213
- m365-security
@@ -28,21 +29,21 @@ search.appverid: met150
2829

2930
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-exposedapis-abovefoldlink)
3031
31-
## Schedule a scan *built-in to* Microsoft Defender for Endpoint on macOS
32+
## Schedule a scan built into Microsoft Defender for Endpoint on macOS
3233

3334
While you can start a threat scan at any time with Microsoft Defender for Endpoint, your enterprise might benefit from scheduled or timed scans. For example, you can schedule a scan to run at the beginning of every workday or week.
3435

35-
There are three types of scheduled scans that are configurable: hourly, daily, and weekly scans. Hourly and daily scheduled scans are always run as quick scans, weekly scans can be configured to be either quick or full scans. It is possible to have all three types of scheduled scans at the same time. See the samples below.
36+
There are three types of scheduled scans that are configurable: hourly, daily, and weekly scans. Hourly and daily scheduled scans are always run as quick scans, weekly scans can be configured to be either quick or full scans. It's possible to have all three types of scheduled scans at the same time. See the samples in this article.
3637

3738
**Prerequisites**:
3839

3940
- Platform Update version: [101.23122.0005](mac-whatsnew.md#jan-2024-build-101231220005---release-version-2012312250) or newer
4041

41-
## Schedule a scan with *Microsoft Defender for Endpoint on macOS*
42+
## Schedule a scan with Microsoft Defender for Endpoint on macOS
4243

4344
You can create a scheduled scan for your macOS, which is built in to *Microsoft Defender for Endpoint on macOS*.
4445

45-
For more information on the _.plist_ file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
46+
For more information on the `.plist` file format used here, see [About Information Property List Files](https://developer.apple.com/library/archive/documentation/General/Reference/InfoPlistKeyReference/Articles/AboutInformationPropertyListFiles.html) at the official Apple developer website.
4647

4748
The following sample shows the daily and/or weekly configuration for the scheduled scan on macOS.
4849

@@ -51,106 +52,107 @@ The following sample shows the daily and/or weekly configuration for the schedul
5152
5253
| Parameter | The acceptable values for this parameter are: |
5354
| --- | --- |
54-
| scheduledScan | enabled or disabled |
55-
| scanType | quick or full |
56-
| ignoreExclusions | true or false |
57-
| lowPriorityScheduledScan | true or false |
58-
| dayOfWeek | The range is between 0 and 8. <br>- 0: Everyday <br>- 1: Sunday <br>- 2: Monday <br>- 3: Tuesday <br>- 4: Wednesday <br>- 5: Thursday <br>- 6: Friday <br>- 7: Saturday <br>- 8: Never |
59-
| timeOfDay | Specifies the time of day, as the number of _minutes after midnight_, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
60-
| interval | 0 (never), every 1 (hour) to 24 (hours, 1 scan per day) |
61-
| randomizeScanStartTime | Only applicable for daily quick scans or weekly quick/full scans. Randomize the start time of the scan by up to specified number of hours. <br> For example, if a scan is scheduled for 2 p.m and randomizeScanStartTime is set to 2, the scan commences at a random time between 2 p.m and 4 p.m. |
55+
| `scheduledScan` | `enabled` or `disabled` |
56+
| `scanType` | `quick` or `full` |
57+
| `ignoreExclusions` | `true` or `false` |
58+
| lowPriorityScheduledScan | `true` or `false` |
59+
| `dayOfWeek` | The range is between `0` and `8`. <br>- `0`: Everyday <br>- `1`: Sunday <br>- `2`: Monday <br>- `3`: Tuesday <br>- `4`: Wednesday <br>- `5`: Thursday <br>- `6`: Friday <br>- `7`: Saturday <br>- `8`: Never |
60+
| `timeOfDay` | Specifies the time of day, as the number of `minutes after midnight`, to perform a scheduled scan. The time refers to the local time on the computer. If you don't specify a value for this parameter, a scheduled scan runs at a default time of two hours after midnight. |
61+
| `interval` | `0` (never), `every 1` (hour) to `every 24` (hours, one scan per day) |
62+
| `randomizeScanStartTime` | Only applicable for daily quick scans or weekly quick/full scans. Randomize the start time of the scan by up to specified number of hours. <br> For example, if a scan is scheduled for 2 p.m and `randomizeScanStartTime` is set to 2, the scan commences at a random time between 2 p.m and 4 p.m. |
6263

63-
Your scheduled scan runs at the date, time, and frequency you defined in your _plist_.
64+
Your scheduled scan runs at the date, time, and frequency you defined in your `plist`.
6465

65-
### Example 1: Schedule a daily quick scan and weekly full scan using a _plist_
66+
### Example 1: Schedule a daily quick scan and weekly full scan using a plist
6667

67-
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.).<br>
68-
The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.).
69-
And it's set to ignore exclusions and run a low priority scan.
68+
In the following example, the daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.). The weekly configuration is set to run a full scan on Wednesday at 880 minutes after midnight (2:40 p.m.). And it's set to ignore exclusions and run a low-priority scan.
7069

71-
The following code shows the schema you need to use to schedule scans according to the requirements above.
70+
The following code shows the schema you need to use to schedule scans according to the requirements mentioned earlier.
7271

7372
1. Open a text editor and use this example as a guide for your own scheduled scan file.
7473

75-
#### For Intune:
74+
#### For Intune
7675

7776
``` XML
7877
<?xml version="1.0" encoding="UTF-8"?>
7978
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
8079
<plist version="1.0">
8180
<dict>
82-
<key>PayloadUUID</key>
83-
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
84-
<key>PayloadType</key>
85-
<string>Configuration</string>
86-
<key>PayloadOrganization</key>
87-
<string>Microsoft</string>
88-
<key>PayloadIdentifier</key>
89-
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
90-
<key>PayloadDisplayName</key>
91-
<string>Microsoft Defender for Endpoint settings</string>
92-
<key>PayloadDescription</key>
93-
<string>Microsoft Defender for Endpoint configuration settings</string>
94-
<key>PayloadVersion</key>
95-
<integer>1</integer>
96-
<key>PayloadEnabled</key>
97-
<true/>
98-
<key>PayloadRemovalDisallowed</key>
99-
<true/>
100-
<key>PayloadScope</key>
101-
<string>System</string>
102-
<key>PayloadContent</key>
103-
<array>
104-
<dict>
105-
<key>PayloadUUID</key>
106-
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
107-
<key>PayloadType</key>
108-
<string>com.microsoft.wdav</string>
109-
<key>PayloadOrganization</key>
110-
<string>Microsoft</string>
111-
<key>PayloadIdentifier</key>
112-
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
113-
<key>PayloadDisplayName</key>
114-
<string>Microsoft Defender for Endpoint configuration settings</string>
115-
<key>PayloadDescription</key>
116-
<string/>
117-
<key>PayloadVersion</key>
118-
<integer>1</integer>
119-
<key>PayloadEnabled</key>
120-
<true/>
121-
<key>features</key>
122-
<dict>
123-
<key>scheduledScan</key>
124-
<string>enabled</string>
125-
</dict>
126-
<key>scheduledScan</key>
127-
<dict>
128-
<key>ignoreExclusions</key>
129-
<true/>
130-
<key>lowPriorityScheduledScan</key>
131-
<true/>
132-
<key>dailyConfiguration</key>
133-
<dict>
134-
<key>timeOfDay</key>
135-
<integer>885</integer>
136-
</dict>
137-
<key>weeklyConfiguration</key>
138-
<dict>
139-
<key>dayOfWeek</key>
140-
<integer>4</integer>
141-
<key>timeOfDay</key>
142-
<integer>880</integer>
143-
<key>scanType</key>
144-
<string>full</string>
145-
</dict>
146-
</dict>
81+
<key>PayloadUUID</key>
82+
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
83+
<key>PayloadType</key>
84+
<string>Configuration</string>
85+
<key>PayloadOrganization</key>
86+
<string>Microsoft</string>
87+
<key>PayloadIdentifier</key>
88+
<string>C4E6A782-0C8D-44AB-A025-EB893987A295</string>
89+
<key>PayloadDisplayName</key>
90+
<string>Microsoft Defender for Endpoint settings</string>
91+
<key>PayloadDescription</key>
92+
<string>Microsoft Defender for Endpoint configuration settings</string>
93+
<key>PayloadVersion</key>
94+
<integer>1</integer>
95+
<key>PayloadEnabled</key>
96+
<true/>
97+
<key>PayloadRemovalDisallowed</key>
98+
<true/>
99+
<key>PayloadScope</key>
100+
<string>System</string>
101+
<key>PayloadContent</key>
102+
<array>
103+
<dict>
104+
<key>PayloadUUID</key>
105+
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
106+
<key>PayloadType</key>
107+
<string>com.microsoft.wdav</string>
108+
<key>PayloadOrganization</key>
109+
<string>Microsoft</string>
110+
<key>PayloadIdentifier</key>
111+
<string>99DBC2BC-3B3A-46A2-A413-C8F9BB9A7295</string>
112+
<key>PayloadDisplayName</key>
113+
<string>Microsoft Defender for Endpoint configuration settings</string>
114+
<key>PayloadDescription</key>
115+
<string/>
116+
<key>PayloadVersion</key>
117+
<integer>1</integer>
118+
<key>PayloadEnabled</key>
119+
<true/>
120+
<key>features</key>
121+
<dict>
122+
<key>scheduledScan</key>
123+
<string>enabled</string>
124+
</dict>
125+
<key>scheduledScan</key>
126+
<dict>
127+
<key>ignoreExclusions</key>
128+
<true/>
129+
<key>lowPriorityScheduledScan</key>
130+
<true/>
131+
<key>dailyConfiguration</key>
132+
<dict>
133+
<key>timeOfDay</key>
134+
<integer>880</integer>
135+
</dict>
136+
<key>weeklyConfiguration</key>
137+
<dict>
138+
<key>dayOfWeek</key>
139+
<integer>4</integer>
140+
<key>timeOfDay</key>
141+
<integer>885</integer>
142+
<key>scanType</key>
143+
<string>full</string>
144+
</dict>
145+
</dict>
146+
</dict>
147+
</array>
147148
</dict>
148-
</plist>
149+
</plist>
149150
```
150151

151-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
152+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
153+
154+
#### For JamF and other 3rd-party MDMs
152155

153-
#### For JamF and other 3rd-party MDMs:
154156
``` XML
155157
<?xml version="1.0" encoding="UTF-8"?>
156158
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -186,7 +188,8 @@ The following code shows the schema you need to use to schedule scans according
186188
</plist>
187189
```
188190

189-
2. Save the file as _com.microsoft.wdav.plist_.
191+
2. Save the file as `com.microsoft.wdav.plist`.
192+
190193
3. Check that the scheduled scan is configured via a "Set Preference"
191194

192195
```
@@ -195,7 +198,7 @@ The following code shows the schema you need to use to schedule scans according
195198
196199
In the results, you should be able to see [managed].
197200
198-
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a _plist_
201+
### Example 2: Schedule an hourly quick scan, a daily quick scan, and weekly full scan using a plist
199202
200203
In the following example, an hourly quick scan will run every 6 hours, a daily quick scan configuration is set to run at 885 minutes after midnight (2:45 p.m.), and a weekly full scan will run on Wednesdays at 880 minutes after midnight (2:40 p.m).
201204
@@ -277,9 +280,11 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
277280
</dict>
278281
</plist>
279282
```
280-
2. Save the file as _com.microsoft.wdav.mobileconfig_.
281283

282-
#### For JamF and other 3rd-party MDMs:
284+
2. Save the file as `com.microsoft.wdav.mobileconfig`.
285+
286+
#### For JamF and other 3rd-party MDMs
287+
283288
1. Open a text editor and use this example.
284289

285290
```XML
@@ -319,7 +324,7 @@ In the following example, an hourly quick scan will run every 6 hours, a daily q
319324
</plist>
320325
```
321326

322-
2. Save the file as _com.microsoft.wdav.plist_.
327+
2. Save the file as `com.microsoft.wdav.plist`.
323328

324329
3. Check that the scheduled scan is configured via a "Set Preference"
325330

@@ -335,29 +340,29 @@ To enable scheduled scan feature:
335340
336341
|Version|Command|
337342
|---|---|
338-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan settings feature --value enabled` |
343+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan settings feature --value enabled` |
339344
340345
To schedule hourly quick scans:
341346
342347
|Version|Command|
343348
|---|---|
344-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
349+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan hourly-interval --value \<arg\>` |
345350
346351
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic1.png" alt-text="Screenshot of schedule hourly scan.":::
347352
348353
To schedule daily quick scans:
349354
350355
|Version|Command|
351356
|---|---|
352-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
357+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan quick-scan time-of-day --value \<arg\>` |
353358
354359
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic2.png" alt-text="Screenshot of schedule daily quick scan.":::
355360
356361
To schedule weekly scans:
357362
358363
|Version|Command|
359364
|---|---|
360-
| Version 101.23122.\* or higher | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
365+
| Version 101.23122.x or later | `sudo mdatp config scheduled-scan weekly-scan --day-of-week \<arg\> --time-of-day \<arg\>--scan-type \<arg\>` |
361366
362367
:::image type="content" source="media/schedule-scans-mac/schedule-scan-pic3.png" alt-text="Screenshot of schedule weekly scan.":::
363368

0 commit comments

Comments
 (0)