Skip to content

Commit 88b8976

Browse files
committed
Learn Editor: Update indicator-file.md
1 parent 1e49748 commit 88b8976

File tree

1 file changed

+14
-2
lines changed

1 file changed

+14
-2
lines changed

defender-endpoint/indicator-file.md

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,8 @@ There are three ways you can create indicators for files:
4848

4949
Understand the following prerequisites before you create indicators for files:
5050

51+
### Windows prerequisites
52+
5153
- This feature is available if your organization uses [Microsoft Defender Antivirus](microsoft-defender-antivirus-windows.md) (in active mode)
5254
- [Behavior Monitoring is enabled](behavior-monitor.md)
5355

@@ -59,10 +61,20 @@ Understand the following prerequisites before you create indicators for files:
5961

6062
- This feature is supported on devices running Windows 10, version 1703 or later, Windows 11, Windows Server 2012 R2, Windows Server 2016 or later, Windows Server 2019, or Windows Server 2022.
6163

62-
- In `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\MpEngine\`, the file hash computation feature should be set to **Enabled**
63-
64+
- File hash computation is enabled, by setting `Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\MpEngine\` to **Enabled**
65+
6466
- To start blocking files, [turn on the "block or allow" feature](advanced-features.md) in Settings (in the [Microsoft Defender portal](https://security.microsoft.com), go to **Settings** > **Endpoints** > **General** > **Advanced features** > **Allow or block file**).
6567

68+
### macOS prerequisites
69+
70+
- [File hash computation is enabled](https://learn.microsoft.com/en-us/defender-endpoint/mac-resources#configuring-from-the-command-line) by running `mdatp config enable-file-hash-computation --value enabled`
71+
72+
### linux prerequisites
73+
74+
- Available in Defender for Endpoint version 101.85.27 or later.
75+
76+
- [File hash computation is enabled] from the portal or in the managed JSON (https://learn.microsoft.com/en-us/defender-endpoint/linux-preferences#configure-file-hash-computation-feature)
77+
6678
This feature is designed to prevent suspected malware (or potentially malicious files) from being downloaded from the web.
6779

6880
> [!NOTE]

0 commit comments

Comments
 (0)