Merge branch 'main' into WI91984-fix-generate-report-current-configurations-powershell

Author: garycentric

defender-endpoint/linux-whatsnew.md

@@ -6,7 +6,7 @@ ms.author: lwainstein
 author: lwainstein
 ms.reviewer: kumasumit, gopkr; mevasude
 ms.localizationpriority: medium
-ms.date: 08/19/2025
+ms.date: 11/04/2025
 manager: bagol
 audience: ITPro
 ms.collection:
@@ -42,6 +42,25 @@ This article is updated frequently to let you know what's new in the latest rele
 
 ## Releases for Defender for Endpoint on Linux
 
+### October-2025 Build: 101.25092.0001 | Release version: 30.125092.0001.0
+
+|Build:             |**101.25092.0001**    |
+|-------------------|----------------------|
+|Released:          |**November 05, 2025**|
+|Published:         |**November 05, 2025**|
+|Expiry:            |**July 10, 2026**|
+|Release version:   |**30.125092.0001.0**|
+|Engine version:    |**1.1.25090.6000**|
+|Signature version: |**1.439.558.0**|
+
+What's new
+
+- Added support for CentOS Stream 9, CentOS Stream 10 and RHEL 10.
+
+- Enhanced engine resiliency through automatic error recovery, preventing excessive logging and minimizing downtime to improve overall reliability.
+
+- Other quality and stability fixes.
+
 ### September-2025 Build: 101.25082.0003 | Release version: 30.125082.0003.0
 
 |Build:             |**101.25082.0003**    |

defender-endpoint/respond-machine-alerts.md

@@ -5,7 +5,7 @@ ms.service: defender-endpoint
 ms.author: painbar
 author: paulinbar
 ms.localizationpriority: medium
-ms.date: 09/01/2025
+ms.date: 11/05/2025
 manager: bagol
 audience: ITPro
 ms.collection:
@@ -19,6 +19,7 @@ appliesto:
   - Microsoft Defender for Business
 
 ---
+
 # Take response actions on a device
 
 
@@ -362,7 +363,9 @@ When an identity in your network might be compromised, you must prevent that ide
 > Blocking incoming communication with a "contained" user is supported on onboarded Microsoft Defender for Endpoint Windows 10 and 11 devices (Sense version 8740 and higher), Windows Server 2019+ devices, and Windows Servers 2012R2 and 2016 with the modern agent.
 
 > [!IMPORTANT]
-> Once a **Contain user** action is enforced on a domain controller, it starts a GPO update on the Default Domain Controller policy. A change of a GPO starts a sync across the domain controllers in your environment.  This is expected behavior, and if you monitor your environment for AD GPO changes, you may be notified of such changes. Undoing the **Contain user** action reverts the GPO changes to their previous state, which will then start another AD GPO synchronization in your environment. Learn more about [merging of security policies on domain controllers](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj966251(v=ws.11)#merging-of-security-policies-on-domain-controllers).
+> As part of the active protection provided by Microsoft Defender for Endpoint, a distributed mechanism can apply LSA Policy to prevent compromised users from accessing machines in your organization. Currently, when this policy is applied on Domain Controllers, it may cause Group Policy synchronization activity across domain controllers.
+>
+> We are gradually rolling out a new solution by integrating with new OS APIs. This deployment will be phased and thoroughly tested to ensure stability and security. During this rollout, LSA Policy enforcement on your servers will be temporarily removed to prevent potential GPO sync. This change will remain in effect until the rollout is complete.
 
 ### How to contain a user
 

unified-secops-platform/cases-overview.md

@@ -171,11 +171,11 @@ To add an attachment to a comment:
 1. Select the file you want to attach from your computer.
 1. Select **Send** to save the comment.
 
-  :::image type="content" source="media/cases-overview/attach-file-to-comment-send.png" alt-text="Screenshot showing the Send button to save the comment.":::
-
-- To attach a screenshot to your comment, paste it into the text editor.
-- To delete an attached file from the comment, select the bin icon while hovering over it.
+   :::image type="content" source="media/cases-overview/attach-file-to-comment-send.png" alt-text="Screenshot showing the Send button to save the comment.":::
 
+   - To attach a screenshot to your comment, paste it into the text editor.
+   - To delete an attached file from the comment, select the bin icon while hovering over it.
+    
 ### Delete Case (preview)
 
 To delete a case: