You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/troubleshoot-microsoft-defender-antivirus-when-migrating.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -141,7 +141,7 @@ sections:
141
141
> [!WARNING]
142
142
> Solutions suggesting that you edit the Windows Defender start values for `wdboot`, `wdfilter`, `wdnisdrv`, `wdnissvc`, and `windefend` in `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services` are unsupported, and might force you to reimage your system.
143
143
144
-
Passive mode is available if you start using Microsoft Defender for Endpoint and a non-Microsoft antivirus together with Microsoft Defender Antivirus. Passive mode allows Microsoft Defender Antivirus to scan files and update itself, but it doesn't remediate threats in passive mode. In addition, behavior monitoring via [Real Time Protection](configure-real-time-protection-microsoft-defender-antivirus.md) isn't available in passive mode, unless [Endpoint data loss prevention (DLP)](/defender-endpoint/information-protection-in-windows-overview) is deployed.
144
+
Passive mode is available if you start using Microsoft Defender for Endpoint and a non-Microsoft antivirus together with Microsoft Defender Antivirus. Passive mode allows Microsoft Defender Antivirus to scan files and update itself, but it doesn't remediate threats in passive mode. In addition, behavior monitoring via [Real Time Protection](configure-real-time-protection-microsoft-defender-antivirus.md) isn't available in passive mode, unless [Endpoint data loss prevention (DLP)](/purview/endpoint-dlp-getting-started) is deployed.
145
145
146
146
Another feature, known as [limited periodic scanning](limited-periodic-scanning-microsoft-defender-antivirus.md), is available to end-users when Microsoft Defender Antivirus is set to turn off automatically. This feature allows Microsoft Defender Antivirus to scan files periodically alongside a non-Microsoft antivirus, using a limited number of detections.
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-security-copilot.md
+20-18Lines changed: 20 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -29,7 +29,7 @@ ms.date: 04/01/2024
29
29
30
30
## Copilot for Security in advanced hunting
31
31
32
-
[Microsoft Copilot for Security in Microsoft Defender](security-copilot-in-microsoft-365-defender.md) comes with a query assistant capability in advanced hunting.
32
+
[Microsoft Copilot for Security in Microsoft Defender](security-copilot-in-microsoft-365-defender.md) comes with a query assistant capability in advanced hunting.
33
33
34
34
Threat hunters or security analysts who are not yet familiar with or have yet to learn KQL can make a request or ask a question in natural language (for instance, *Get all alerts involving user admin123*). Copilot for Security then generates a KQL query that corresponds to the request using the advanced hunting data schema.
35
35
@@ -45,48 +45,50 @@ Users with access to Copilot for Security have access to this capability in adva
45
45
1. Open the **advanced hunting** page from the navigation bar in Microsoft Defender XDR. The Copilot for Security side pane for advanced hunting appears at the right hand side.
46
46
47
47
:::image type="content" source="/defender/media/advanced-hunting-security-copilot-pane.png" alt-text="Screenshot of the Copilot pane in advanced hunting." lightbox="/defender/media/advanced-hunting-security-copilot-pane-big.png":::
48
-
48
+
49
49
You can also reopen Copilot by selecting **Copilot** at the top of the query editor.
50
-
1. In the Copilot prompt bar, ask any threat hunting query that you want to run and press  or **Enter** .
50
+
1. In the Copilot prompt bar, ask any threat hunting query that you want to run and press :::image type="icon" source="media/Send.png" border="false"::: or **Enter** .
51
+
52
+
51
53
52
54
:::image type="content" source="/defender/media/advanced-hunting-security-copilot-query.png" alt-text="Screenshot that shows prompt bar in the Copilot for Security for advanced hunting." lightbox="/defender/media/advanced-hunting-security-copilot-query-big.png":::
53
-
55
+
54
56
1. Copilot generates a KQL query from your text instruction or question. While Copilot is generating, you can cancel the query generation by selecting **Stop generating**.
55
57
56
-
58
+
59
+
57
60
58
-
59
-
1. Review the generated query. You can then choose to run the query by selecting **Add and run**.
61
+
1. Review the generated query. You can then choose to run the query by selecting **Add and run**.
60
62
61
-
63
+
62
64
63
-
The generated query then appears as the last query in the query editor and runs automatically.
65
+
The generated query then appears as the last query in the query editor and runs automatically.
64
66
65
-
If you need to make further tweaks, select **Add to editor**.
67
+
If you need to make further tweaks, select **Add to editor**.
66
68
67
69
68
70
69
71
The generated query appears in the query editor as the last query, where you can edit it before running using the regular **Run query** above the query editor.
70
72
71
-
73
+
72
74
1. You can provide feedback about the generated response by selecting the feedback icon  and choosing **Confirm**, **Off-target**, or **Potentially harmful**.
73
75
74
76
75
77
> [!TIP]
76
-
> Providing feedback is an important way to let the Copilot for Security team know how well the query assistant was able to help in generating a useful KQL query. Feel free to articulate what could have made the query better, what adjustments you had to make before running the generated KQL query, or share the KQL query that you eventually used.
78
+
> Providing feedback is an important way to let the Copilot for Security team know how well the query assistant was able to help in generating a useful KQL query. Feel free to articulate what could have made the query better, what adjustments you had to make before running the generated KQL query, or share the KQL query that you eventually used.
77
79
78
80
## Query sessions
79
81
80
-
You can start your first session anytime by asking a question in the Copilot side pane in advanced hunting. Your session contains the requests you made using your user account. Closing the side pane or refreshing the advanced hunting page does not discard the session. You can still access the generated queries should you need them.
82
+
You can start your first session anytime by asking a question in the Copilot side pane in advanced hunting. Your session contains the requests you made using your user account. Closing the side pane or refreshing the advanced hunting page does not discard the session. You can still access the generated queries should you need them.
81
83
82
-
Select the chat bubble icon (**New chat**) to discard the current session.
84
+
Select the chat bubble icon (**New chat**) to discard the current session.
83
85
84
-
86
+
85
87
86
88
## Modify settings
87
89
88
-
Select the ellipses in the Copilot side pane to choose whether or not to automatically add and run the generated query in advanced hunting.
90
+
Select the ellipses in the Copilot side pane to choose whether or not to automatically add and run the generated query in advanced hunting.
89
91
90
-
92
+
91
93
92
-
Deselecting the **Run generated query automatically** setting gives you the option of running the generated query automatically (**Add and run**) or adding the generated query to the query editor for further modification (**Add to editor**).
94
+
Deselecting the **Run generated query automatically** setting gives you the option of running the generated query automatically (**Add and run**) or adding the generated query to the query editor for further modification (**Add to editor**).
Copy file name to clipboardExpand all lines: defender-xdr/before-you-begin-defender-experts.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -71,9 +71,9 @@ The following sections enumerate additional information about the service's data
71
71
72
72
### Data collection, usage, and retention
73
73
74
-
All data used for hunting from existing Defender services will continue to reside in the customer's original Microsoft Defender XDR service storage location. [Learn more](/enterprise/o365-data-locations)
74
+
All data used for hunting from existing Defender services will continue to reside in the customer's original Microsoft Defender XDR service storage location. [Learn more](/microsoft-365/enterprise/o365-data-locations)
75
75
76
-
Defender Experts for Hunting operational data, such as case tickets and analyst notes, are generated and stored in a Microsoft data center in the US region for the length of the service, irrespective of the Microsoft Defender XDR service storage location. Data generated for the reporting dashboard is stored in customer's Microsoft Defender XDR service storage location. Reporting data and operational data will be retained for a grace period of no more than 90 days after a customer's subscription expires. If the customer terminates their subscription, data will be deleted within 30 days.
76
+
Defender Experts for Hunting operational data, such as case tickets and analyst notes, are generated and stored in a Microsoft data center in the US region for the length of the service, irrespective of the Microsoft Defender XDR service storage location. Data generated for the reporting dashboard is stored in customer's Microsoft Defender XDR service storage location. Reporting data and operational data will be retained for a grace period of no more than 90 days after a customer's subscription expires. If the customer terminates their subscription, data will be deleted within 30 days.
77
77
78
78
Microsoft experts hunt over [advanced hunting logs](advanced-hunting-schema-tables.md) in Microsoft Defender XDR advanced hunting tables. The data in these tables depend on the set of Defender services the customer is enabled for (for example, Microsoft Defender for Endpoint, Microsoft Defender for Office 365, Microsoft Defender for Identity, Microsoft Defender for Cloud Apps, and Microsoft Entra ID). Experts also use a large set of internal threat intelligence data to inform their hunting and automation.
Copy file name to clipboardExpand all lines: defender-xdr/configure-siem-defender.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -99,9 +99,9 @@ For more information on the Elastic connector, see: [Microsoft M365 Defender | E
99
99
100
100
## Ingesting streaming event data via Event Hubs
101
101
102
-
First you need to stream events from your Microsoft Entra tenant to your Event Hubs or Azure Storage Account. For more information, see [Streaming API](/defender/streaming-api).
102
+
First you need to stream events from your Microsoft Entra tenant to your Event Hubs or Azure Storage Account. For more information, see [Streaming API](streaming-api.md).
103
103
104
-
For more information on the event types supported by the Streaming API, see [Supported streaming event types](/defender/supported-event-types).
104
+
For more information on the event types supported by the Streaming API, see [Supported streaming event types](supported-event-types.md).
0 commit comments