Merge branch 'main' into ASTQR-chrisda

chrisda · chrisda · commit b203c0ed5063 · 2024-08-14T09:46:17.000-07:00
diff --git a/defender-endpoint/android-configure-mam.md b/defender-endpoint/android-configure-mam.md
@@ -14,7 +14,7 @@ ms.collection:
 - mde-android
 ms.topic: conceptual
 ms.subservice: android
-ms.date: 07/25/2024
+ms.date: 08/08/2024
 ---
 
 # Configure Microsoft Defender for Endpoint on Android risk signals using App Protection Policies (MAM)
@@ -124,14 +124,14 @@ End users also need to take steps to install Microsoft Defender for Endpoint on
 
 1. Sign in to a managed application, for example, Outlook. The device is registered and the application protection policy is synchronized to the device. The application protection policy recognizes the device's health state.
 
-2. Select **Continue**. A screen is presented which recommends downloading and setting up of Microsoft Defender for Endpoint on Android app.
+2. Select **Continue**. A screen is presented which recommends downloading and setting up of the Microsoft Defender: Antivirus (Mobile) app.
 
 3. Select **Download**. You'll be redirected to the app store (Google play).
 
-4. Install the Microsoft Defender for Endpoint (Mobile) app and launch back Managed app onboarding screen.
-
-   :::image type="content" source="media/download-mde.png" alt-text="The illustrative pages that contain the procedure of downloading MDE and launching back the app-onboarding screen." lightbox="media/download-mde.png":::
+4. Install the Microsoft Defender: Antivirus (Mobile) app and go back to the managed app onboarding screen.
 
+    :::image type="content" source="media/mam-flow.png" alt-text="Shows the procedure of downloading Microsoft Defender: Antivirus (Mobile) app." lightbox="media/mam-flow.png":::
+   
 5. Click **Continue > Launch**. The Microsoft Defender for Endpoint app onboarding/activation flow is initiated. Follow the steps to complete onboarding. You'll automatically be redirected back to Managed app onboarding screen, which now indicates that the device is healthy.
 
 6. Select **Continue** to log into the managed application.
diff --git a/defender-endpoint/media/mam-flow.png b/defender-endpoint/media/mam-flow.png
diff --git a/defender-office-365/safe-links-about.md b/defender-office-365/safe-links-about.md
@@ -61,7 +61,7 @@ Safe Links protection by Safe Links policies is available in the following locat
   >
   > Safe Links supports only HTTP(S) and FTP formats.
   >
-  > Safe Links no longer wraps URLs pointing to SharePoint sites. SharePoint URLs are still processed by the Safe Links service. This change doesn't cause a degradation in the protection a tenant receives. It's intended to improve the performance of loading SharePoint URLs.
+  > Safe Links no longer wraps URLs pointing to SharePoint Online sites. SharePoint URLs are still processed by the Safe Links service. This change doesn't cause a degradation in the protection a tenant receives. It's intended to improve the performance of loading SharePoint URLs.
   >
   > Using another service to wrap links before Defender for Office 365 might prevent Safe Links from process links, including wrapping, detonating, or otherwise validating the "maliciousness" of the link.
 
diff --git a/defender-xdr/access-den-graph-api.md b/defender-xdr/access-den-graph-api.md
@@ -3,7 +3,7 @@ title: Accessing incident notifications and DENs using Graph security API
 ms.reviewer:
 description: The method to access Defender Experts Notifications using Graph security API
 ms.service: defender-experts
-ms.subservice: dex-xdr
+ms.subservice: dex-hunting
 ms.author: vpattnaik
 author: vpattnai
 ms.localizationpriority: medium
@@ -15,7 +15,7 @@ ms.collection:
   - essentials-overview
 ms.topic: conceptual
 search.appverid: met150
-ms.date: 04/29/2024
+ms.date: 08/14/2024
 ---
 
 # Access incident notifications using Graph API
diff --git a/defender-xdr/before-you-begin-defender-experts.md b/defender-xdr/before-you-begin-defender-experts.md
@@ -3,6 +3,7 @@ title: Key infrastructure requirements before enrolling in the Microsoft Defende
 ms.reviewer:
 description: This section outlines the key infrastructure requirements you must meet and important information on data access and compliance
 ms.service: defender-experts
+ms.subservice: dex-hunting
 ms.author: vpattnaik
 author: vpattnai
 ms.localizationpriority: medium
@@ -14,7 +15,7 @@ ms.collection:
   - tier1
 ms.topic: conceptual
 search.appverid: met150
-ms.date: 06/19/2024
+ms.date: 08/14/2024
 ---
 
 # Before you begin using Defender Experts for Hunting
diff --git a/defender-xdr/deception-overview.md b/defender-xdr/deception-overview.md
@@ -3,20 +3,20 @@ title: Manage the deception capability in Microsoft Defender XDR
 description: Detect human-operated attacks with lateral movement in the early stages using high confidence signals from the deception feature in Microsoft Defender XDR.
 ms.service: defender-xdr
 f1.keywords: 
-  - NOCSH
+- NOCSH
 ms.author: diannegali
 author: diannegali
 ms.localizationpriority: medium
 manager: dansimp
 audience: ITPro
 ms.collection: 
-  - m365-security
-  - tier1
+- m365-security
+- tier1
 ms.topic: conceptual
 search.appverid: 
-  - MOE150
-  - MET150
-ms.date: 08/08/2024
+- MOE150
+- MET150
+ms.date: 08/14/2024
 ---
 
 # Manage the deception capability in Microsoft Defender XDR
@@ -79,7 +79,7 @@ There are two types of lures available in the deception feature:
 
 You can specify decoys, lures, and the scope in a deception rule. See [Configure the deception feature](configure-deception.md) to learn more about how to create and modify deception rules.  
 
-When an attacker uses a decoy or a lure on any Defender for Endpoint-onboarded client, the deception capability triggers an alert that indicates possible attacker activity, regardless of whether deception was deployed on the client or not.
+When an attacker uses a decoy on any Defender for Endpoint-onboarded client, the deception capability triggers an alert that indicates possible attacker activity, regardless of whether deception was deployed on the client or not.
 
 ## Identify incidents and alerts activated by deception
 
diff --git a/defender-xdr/defender-experts-for-hunting.md b/defender-xdr/defender-experts-for-hunting.md
@@ -3,6 +3,7 @@ title: What is Microsoft Defender Experts for Hunting offering
 ms.reviewer:
 description: Microsoft  Defender Experts for Hunting is a proactive threat hunting service that goes beyond the endpoint to hunt across endpoints
 ms.service: defender-experts
+ms.subservice: dex-hunting
 ms.author: vpattnaik
 author: vpattnai
 ms.localizationpriority: medium
diff --git a/defender-xdr/defender-experts-report.md b/defender-xdr/defender-experts-report.md
@@ -4,7 +4,7 @@ ms.reviewer:
 description: The Defender Experts for Hunting service publishes reports to help you understand all the threats the hunting service surfaced in your environment
 search.appverid: met150
 ms.service: defender-experts
-ms.subservice: dex-xdr
+ms.subservice: dex-hunting
 f1.keywords:
 - NOCSH
 ms.author: vpattnaik
@@ -17,7 +17,7 @@ ms.collection:
 - tier1
 - essentials-manage
 ms.topic: conceptual
-ms.date: 10/17/2023
+ms.date: 08/14/2023
 ---
 
 # Understand the Defender Experts for Hunting report in Microsoft Defender XDR
diff --git a/defender-xdr/experts-on-demand.md b/defender-xdr/experts-on-demand.md
@@ -4,6 +4,7 @@ ms.reviewer:
 description: Select Ask Defender Experts directly inside the Microsoft Defender security portal to get swift and accurate responses to all your threat hunting questions.
 search.product: Windows 10
 ms.service: defender-experts
+ms.subservice: dex-hunting
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: security
@@ -18,7 +19,7 @@ ms.collection:
   - essentials-get-started
 ms.topic: conceptual
 search.appverid: met150
-ms.date: 04/18/2024
+ms.date: 08/14/2024
 ---
 
 # Collaborate with experts on demand
diff --git a/defender-xdr/microsoft-xdr-auditing.md b/defender-xdr/microsoft-xdr-auditing.md
@@ -11,7 +11,7 @@ ms.collection:
 - m365-security
 - tier3
 ms.topic: overview
-ms.date: 07/23/2024
+ms.date: 08/14/2024
 search.appverid: met150
 ---
 
@@ -24,7 +24,7 @@ search.appverid: met150
 - [Microsoft Defender for Endpoint Plan 2](/defender-endpoint/microsoft-defender-endpoint)
 - [Microsoft Defender XDR](microsoft-365-defender.md)
 
-The audit log can help you investigate specific activities across Microsoft 365 services. In the Microsoft Defender XDR portal, Microsoft Defender XDR and Microsoft Defender for Endpoint activities are audited. Some of the activities audited are:
+The audit log can help you investigate specific activities across Microsoft 365 services. In the Microsoft Defender portal, Microsoft Defender XDR and Microsoft Defender for Endpoint activities are audited. Some of the activities audited are:
 
 - Changes to data retention settings
 - Changes to advanced features
diff --git a/defender-xdr/onboarding-defender-experts-for-hunting.md b/defender-xdr/onboarding-defender-experts-for-hunting.md
@@ -3,6 +3,7 @@ title: How to subscribe to Microsoft Defender Experts for Hunting
 ms.reviewer:
 description: If you're new to Microsoft Defender XDR and Defender Experts for Hunting, this is how you onboard, receive, and set up Defender experts notifications.
 ms.service: defender-experts
+ms.subservice: dex-hunting
 ms.author: vpattnaik
 author: vpattnai
 ms.localizationpriority: medium
diff --git a/exposure-management/TOC.yml b/exposure-management/TOC.yml
@@ -6,6 +6,8 @@
       items:
       - name: What is Microsoft Security Exposure Management?
         href: microsoft-security-exposure-management.md
+      - name: What's new 
+        href: whats-new.md      
       - name: Compare Secure Score and Security Exposure Management
         href: compare-secure-score-security-exposure-management.md      
     - name: Get started
@@ -29,7 +31,9 @@
       - name: Overview
         href: critical-asset-management.md
       - name: Review and classify critical assets
-        href: classify-critical-assets.md  
+        href: classify-critical-assets.md
+      - name: Predefined classifications
+        href: predefined-classification-rules-and-levels.md
     - name: Work with attack paths
       items:      
         - name: Overview
diff --git a/exposure-management/exposure-insights-overview.md b/exposure-management/exposure-insights-overview.md
@@ -164,10 +164,7 @@ Events measure the score drop or worsening in the metric status. Events include:
 
 - **Metric score drop events**: These events are issued with there's a decrease of at least 2% in metric score (exposure grew by 2%) since yesterday.
 - **Initiative score drop events**: These events are issued when there's a decrease of at least 2% in initiative score since yesterday.
-
-
-On the **Events** page for an initiative, you can view and filter events.
-
+- **New Initiave event**: These events are issued when a new inititave is available in MSEM.
 
 ## Next steps
 
diff --git a/exposure-management/get-started-exposure-management.md b/exposure-management/get-started-exposure-management.md
@@ -101,4 +101,4 @@ You can hover over points on the timeline to see what the score of the key initi
 
 - [Overview of attack paths](work-attack-paths-overview.md).
 - [Identify and manage critical assets](critical-asset-management.md).
-- [Improve security insights with exposure insights](exposure-insights-overview.md).
+- [Improve security insights with exposure insights](exposure-insights-overview.md).
diff --git a/exposure-management/index.yml b/exposure-management/index.yml
@@ -12,9 +12,9 @@ metadata:
   - m365-security
   - tier1
   ms.custom: intro-hub-or-landing
-  author: siosulli
-  ms.author: siosulli
-  ms.date: 03/04/2024
+  author: dlanger
+  ms.author: dlanger
+  ms.date: 06/19/2024
 
 
 # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new
@@ -29,6 +29,8 @@ landingContent:
         links:
           - text: What is Microsoft Security Exposure Management?
             url: microsoft-security-exposure-management.md
+          - text: What's new
+            url: whats-new.md
 
   # Card
   - title: Get started
diff --git a/exposure-management/predefined-classification-rules-and-levels.md b/exposure-management/predefined-classification-rules-and-levels.md
diff --git a/exposure-management/whats-new.md b/exposure-management/whats-new.md

Original file line number	Diff line number	Diff line change
`@@ -61,7 +61,7 @@ Safe Links protection by Safe Links policies is available in the following locat`
`61`	`61`	`>`
`62`	`62`	`> Safe Links supports only HTTP(S) and FTP formats.`
`63`	`63`	`>`
`64`		`- > Safe Links no longer wraps URLs pointing to SharePoint sites. SharePoint URLs are still processed by the Safe Links service. This change doesn't cause a degradation in the protection a tenant receives. It's intended to improve the performance of loading SharePoint URLs.`
	`64`	`+ > Safe Links no longer wraps URLs pointing to SharePoint Online sites. SharePoint URLs are still processed by the Safe Links service. This change doesn't cause a degradation in the protection a tenant receives. It's intended to improve the performance of loading SharePoint URLs.`
`65`	`65`	`>`
`66`	`66`	`> Using another service to wrap links before Defender for Office 365 might prevent Safe Links from process links, including wrapping, detonating, or otherwise validating the "maliciousness" of the link.`
`67`	`67`