Skip to content

Commit 9b4f3fc

Browse files
authored
Merge pull request #5239 from rlitinsky/patch-81
Update prerequisites-sensor-version-3.md
2 parents e2c30dc + fbed0fe commit 9b4f3fc

File tree

1 file changed

+10
-4
lines changed

1 file changed

+10
-4
lines changed

defender-for-identity/deploy/prerequisites-sensor-version-3.md

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,13 +70,13 @@ Applying the **Unified Sensor RPC Audit** tag enables a new, tested capability o
7070
**Steps to apply the configuration:**
7171

7272
1. In the **Microsoft Defender portal**, navigate to: **System > Settings > Microsoft Defender XDR > Asset Rule Management**.
73-
1. Create a new rule.
73+
1. Select **Create a new rule**
7474

7575
![Screenshot that shows how to add a new rule.](media/prerequisites-sensor-version-3/new-rule.png)
7676

7777
3. In the side panel:
7878

79-
1. Select a **name** for the rule.
79+
1. Enter a **Rule name** and **Description**.
8080

8181
1. Set **rule conditions** using `Device name`, `Domain`, or `Device tag` to target the desired machines.
8282

@@ -88,9 +88,15 @@ Applying the **Unified Sensor RPC Audit** tag enables a new, tested capability o
8888

8989
![Screenshot that shows the config tag.](media/prerequisites-sensor-version-3/tag.png)
9090

91-
5. Click **Submit** to save the rule.
91+
5. Select **Next** to review and finish creating the rule and then select **Submit**.
9292

93-
Offboarding a device from this configuration can be done by **deleting the asset rule** or **modifying the rule conditions** so the device no longer matches.
93+
### Updating rules
94+
Offboarding a device from this configuration can be done **only** from **deleting the asset rule** or **modifying the rule conditions** so the device no longer matches.
95+
96+
>[!NOTE]
97+
> It may take up to 1 hour for changes to be reflected in the portal.
98+
99+
Learn more about Asset Management Rule [here](/defender-xdr/configure-asset-rules)
94100

95101
## Configure Windows auditing
96102

0 commit comments

Comments
 (0)