Skip to content

Commit bf08619

Browse files
vpattnaivpattnai
authored
Merge branch 'main' into reports-update
2 parents 9b3fbce + ffd3a1b commit bf08619

12 files changed

+229
-202
lines changed

‎CloudAppSecurityDocs/app-governance-app-policies-create.md‎

Lines changed: 55 additions & 57 deletions
Large diffs are not rendered by default.

‎CloudAppSecurityDocs/governance-actions.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,11 +34,11 @@ The following governance actions can be taken for connected apps either on a spe
3434
- **Apply label** - Ability to add a Microsoft Purview Information Protection sensitivity label.
3535
- **Remove label** - Ability to remove a Microsoft Purview Information Protection sensitivity label.
3636
- **Change sharing**
37-
37+
3838
- **Remove public sharing** – Allow access only to named collaborators, for example: *Remove public access* for Google Workspace, and *Remove direct shared link* for Box and Dropbox.
3939

40-
- **Remove external users** – Allow access only to company users.
41-
40+
- **Remove external users** – Allow access only to company users. When a group, containing both internal and external members, is added as a collaborator, the action removes members at the group level instead of individually. 
41+
4242
- **Make private** – Only Site Admins can access the file, all shares are removed.
4343

4444
- **Remove a collaborator** – Remove a specific collaborator from the file.
@@ -60,7 +60,7 @@ The following governance actions can be taken for connected apps either on a spe
6060
- **Trash** – Move the file to the trash folder. (Box, Dropbox, Google Drive, OneDrive, SharePoint, Cisco Webex)
6161

6262
![policy_create alerts.](media/policy_create-alerts.png)
63-
63+
6464
## Malware governance actions (Preview)
6565

6666
The following governance actions can be taken for connected apps either on a specific file, user or from a specific policy. For security reasons, this list is limited only to malware related actions that don't imply risk for the user or the tenant.
@@ -104,7 +104,7 @@ The following governance actions can be taken for connected apps either on a spe
104104

105105
- **Governance actions in apps** - Granular actions can be enforced per app, specific actions vary depending on app terminology.
106106

107-
- **Suspend user** – Suspend the user from the application.
107+
- **Suspend user** – Suspend the user from the application.
108108
> [!NOTE]
109109
> If your Microsoft Entra ID is set to automatically sync with the users in your Active Directory on-premises environment the settings in the on-premises environment will override the Microsoft Entra settings and this governance action will be reverted.
110110
@@ -113,7 +113,7 @@ The following governance actions can be taken for connected apps either on a spe
113113
- **Confirm user compromised** - Set the user's risk level to high. This causes the relevant policy actions defined in Microsoft Entra ID to be enforced. For more information How Microsoft Entra ID works with risk levels, see [How does Microsoft Entra ID use my risk feedback](/azure/active-directory/identity-protection/howto-identity-protection-risk-feedback#how-does-azure-ad-use-my-risk-feedback).
114114

115115
![Defender for Cloud Apps activity policy governance actions.](media/activity-policy-ref6.png)
116-
116+
117117
## Revoke an OAuth app and notify user
118118

119119
For Google Workspace and Salesforce, it's possible to revoke permission to an OAuth app or to notify the user that they should change the permission. When you revoke permission it removes all permissions that were granted to the application under "Enterprise Applications" in Microsoft Entra ID.

‎CloudAppSecurityDocs/network-requirements.md‎

Lines changed: 7 additions & 7 deletions
Large diffs are not rendered by default.

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ Anyone who is interested can contribute to the articles. When you contribute, yo
1010

1111
### Quickly update an article using GitHub.com
1212

13-
Contributors who make infrequent or small updates can edit the file directly on GitHub.com without installing any software. This article shows you how. [This two-minute video](https://www.microsoft.com/videoplayer/embed/RE1XQTG) also covers how to contribute.
13+
Contributors who make infrequent or small updates can edit the file directly on GitHub.com without installing any software. This article shows you how. [This two-minute video](https://learn-video.azurefd.net/vod/player?id=b5167c5a-9c69-499b-99ac-e5467882bc92) also covers how to contribute.
1414

1515
> [!TIP]
1616
> To edit an article, you need to get to it on the GitHub.com backend. If you're already on the GitHub.com page of the article, you're starting at step 4.

‎defender-endpoint/api/get-assessment-software-vulnerabilities.md‎

Lines changed: 47 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -94,29 +94,29 @@ GET /api/machines/SoftwareVulnerabilitiesByMachine
9494
9595
<br>
9696

97-
Property (ID)|Data type|Description|Example of a returned value
98-
:---|:---|:---|:---
99-
CveId|String|Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system.|CVE-2020-15992
100-
CvssScore|String|The CVSS score of the CVE.|6.2
101-
DeviceId|String|Unique identifier for the device in the service.|9eaf3a8b5962e0e6b1af9ec756664a9b823df2d1
102-
DeviceName|String|Fully qualified domain name (FQDN) of the device.|johnlaptop.europe.contoso.com
103-
DiskPaths|Array[string]|Disk evidence that the product is installed on the device.|["C:\Program Files (x86)\Microsoft\Silverlight\Application\silverlight.exe"]
104-
ExploitabilityLevel|String|The exploitability level of this vulnerability (NoExploit, ExploitIsPublic, ExploitIsVerified, ExploitIsInKit)|ExploitIsInKit
105-
FirstSeenTimestamp|String|First time this product CVE was seen on the device.|2020-11-03 10:13:34.8476880
106-
ID|String|Unique identifier for the record.|123ABG55_573AG&mnp!
107-
LastSeenTimestamp|String|Last time the software was reported on the device.|2020-11-03 10:13:34.8476880
108-
OSPlatform|String|Platform of the operating system running on the device. This property indicates specific operating systems with variations within the same family, such as Windows 10 and Windows 11. See Microsoft Defender Vulnerability Management supported operating systems and platforms for details.|Windows10 and Windows 11
109-
RbacGroupName|String|The role-based access control (RBAC) group. If this device isn't assigned to any RBAC group, the value is "Unassigned." If the organization doesn't contain any RBAC groups, the value is "None."|Servers
110-
RecommendationReference|String|A reference to the recommendation ID related to this software.|va-_-microsoft-_-silverlight
111-
RecommendedSecurityUpdate (optional)|String|Name or description of the security update provided by the software vendor to address the vulnerability.|April 2020 Security Updates
112-
RecommendedSecurityUpdateId (optional)|String|Identifier of the applicable security updates or identifier for the corresponding guidance or knowledge base (KB) articles|4550961
113-
RegistryPaths|Array[string]|Registry evidence that the product is installed in the device.|["HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MicrosoftSilverlight"]
114-
SecurityUpdateAvailable|Boolean|Indicates whether a security update is available for the software.| Possible values are true or false.
115-
SoftwareName|String|Name of the software product.|Chrome
116-
SoftwareVendor|String|Name of the software vendor.|Google
117-
SoftwareVersion|String|Version number of the software product.|81.0.4044.138
118-
VulnerabilitySeverityLevel|String|Severity level assigned to the security vulnerability based on the CVSS score.|Medium
119-
|
97+
|Property (ID)|Data type|Description|Example of a returned value|
98+
|:---|:---|:---|:---|
99+
|CveId|String|Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system.|CVE-2020-15992|
100+
|CvssScore|Double|The CVSS score of the CVE.|6.2|
101+
|DeviceId|String|Unique identifier for the device in the service.|9eaf3a8b5962e0e6b1af9ec756664a9b823df2d1|
102+
|DeviceName|String|Fully qualified domain name (FQDN) of the device.|johnlaptop.europe.contoso.com|
103+
|DiskPaths|Array[string]|Disk evidence that the product is installed on the device.|["C:\Program Files (x86)\Microsoft\Silverlight\Application\silverlight.exe"]|
104+
|ExploitabilityLevel|String|The exploitability level of this vulnerability (NoExploit, ExploitIsPublic, ExploitIsVerified, ExploitIsInKit)|ExploitIsInKit|
105+
|FirstSeenTimestamp|String|First time this product CVE was seen on the device.|2020-11-03 10:13:34.8476880|
106+
|ID|String|Unique identifier for the record.|123ABG55_573AG&mnp!|
107+
|LastSeenTimestamp|String|Last time the software was reported on the device.|2020-11-03 10:13:34.8476880|
108+
|OSPlatform|String|Platform of the operating system running on the device. This property indicates specific operating systems with variations within the same family, such as Windows 10 and Windows 11. See Microsoft Defender Vulnerability Management supported operating systems and platforms for details.|Windows10 and Windows 11|
109+
|RbacGroupName|String|The role-based access control (RBAC) group. If this device isn't assigned to any RBAC group, the value is "Unassigned." If the organization doesn't contain any RBAC groups, the value is "None."|Servers|
110+
|RecommendationReference|String|A reference to the recommendation ID related to this software.|va-_-microsoft-_-silverlight|
111+
|RecommendedSecurityUpdate (optional)|String|Name or description of the security update provided by the software vendor to address the vulnerability.|April 2020 Security Updates|
112+
|RecommendedSecurityUpdateId (optional)|String|Identifier of the applicable security updates or identifier for the corresponding guidance or knowledge base (KB) articles|4550961|
113+
|RegistryPaths|Array[string]|Registry evidence that the product is installed in the device.|["HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\MicrosoftSilverlight"]|
114+
|SecurityUpdateAvailable|Boolean|Indicates whether a security update is available for the software.| Possible values are true or false.|
115+
|SoftwareName|String|Name of the software product.|Chrome|
116+
|SoftwareVendor|String|Name of the software vendor.|Google|
117+
|SoftwareVersion|String|Version number of the software product.|81.0.4044.138|
118+
|VulnerabilitySeverityLevel|String|Severity level assigned to the security vulnerability based on the CVSS score.|Medium|
119+
|||||
120120

121121
### 1.6 Examples
122122

@@ -384,30 +384,30 @@ Each returned record contains all the data from the full export software vulnera
384384

385385
****
386386

387-
Property (ID)|Data type|Description|Example of returned value
388-
:---|:---|:---|:---
389-
CveId |String|Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system.|CVE-2020-15992
390-
CvssScore|String|The CVSS score of the CVE.|6.2
391-
DeviceId|String|Unique identifier for the device in the service.|9eaf3a8b5962e0e6b1af9ec756664a9b823df2d1
392-
DeviceName|String|Fully qualified domain name (FQDN) of the device.|johnlaptop.europe.contoso.com
393-
DiskPaths|Array[string]|Disk evidence that the product is installed on the device.|["C:\Program Files (x86)\Microsoft\Silverlight\Application\silverlight.exe"]
394-
EventTimestamp|String|The time this delta event was found.|2021-01-11T11:06:08.291Z
395-
ExploitabilityLevel|String|The exploitability level of this vulnerability (NoExploit, ExploitIsPublic, ExploitIsVerified, ExploitIsInKit)|ExploitIsInKit
396-
FirstSeenTimestamp|String|First time the CVE of this product was seen on the device.|2020-11-03 10:13:34.8476880
397-
ID|String|Unique identifier for the record.|123ABG55_573AG&mnp!
398-
LastSeenTimestamp|String|Last time the CVE was seen on the device.|2020-11-03 10:13:34.8476880
399-
OSPlatform|String|Platform of the operating system running on the device; specific operating systems with variations within the same family, such as Windows 10 and Windows 11. See Microsoft Defender Vulnerability Management supported operating systems and platforms for details.|Windows10 and Windows 11
400-
RbacGroupName|String|The role-based access control (RBAC) group. If this device isn't assigned to any RBAC group, the value is "Unassigned." If the organization doesn't contain any RBAC groups, the value is "None."|Servers
401-
RecommendationReference|string|A reference to the recommendation ID related to this software.|va--microsoft--silverlight
402-
RecommendedSecurityUpdate |String|Name or description of the security update provided by the software vendor to address the vulnerability.|April 2020 Security Updates
403-
RecommendedSecurityUpdateId |String|Identifier of the applicable security updates or identifier for the corresponding guidance or knowledge base (KB) articles|4550961
404-
RegistryPaths |Array[string]|Registry evidence that the product is installed in the device.|["HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome"]
405-
SoftwareName|String|Name of the software product.|Chrome
406-
SoftwareVendor|String|Name of the software vendor.|Google
407-
SoftwareVersion|String|Version number of the software product.|81.0.4044.138
408-
Status|String|**New** (for a new vulnerability introduced on a device) (1) **Fixed** (if this vulnerability doesn't exist anymore on the device, which means it was remediated). (2) **Updated** (if a vulnerability on a device changed. The possible changes are: CVSS score, exploitability level, severity level, DiskPaths, RegistryPaths, RecommendedSecurityUpdate). |Fixed
409-
VulnerabilitySeverityLevel|String|Severity level that is assigned to the security vulnerability and is based on the CVSS score.|Medium
410-
|
387+
|Property (ID)|Data type|Description|Example of returned value|
388+
|:---|:---|:---|:---|
389+
|CveId |String|Unique identifier assigned to the security vulnerability under the Common Vulnerabilities and Exposures (CVE) system.|CVE-2020-15992|
390+
|CvssScore|Double|The CVSS score of the CVE.|6.2|
391+
|DeviceId|String|Unique identifier for the device in the service.|9eaf3a8b5962e0e6b1af9ec756664a9b823df2d1|
392+
|DeviceName|String|Fully qualified domain name (FQDN) of the device.|johnlaptop.europe.contoso.com|
393+
|DiskPaths|Array[string]|Disk evidence that the product is installed on the device.|["C:\Program Files (x86)\Microsoft\Silverlight\Application\silverlight.exe"]|
394+
|EventTimestamp|String|The time this delta event was found.|2021-01-11T11:06:08.291Z|
395+
|ExploitabilityLevel|String|The exploitability level of this vulnerability (NoExploit, ExploitIsPublic, ExploitIsVerified, ExploitIsInKit)|ExploitIsInKit|
396+
|FirstSeenTimestamp|String|First time the CVE of this product was seen on the device.|2020-11-03 10:13:34.8476880|
397+
|ID|String|Unique identifier for the record.|123ABG55_573AG&mnp!|
398+
|LastSeenTimestamp|String|Last time the CVE was seen on the device.|2020-11-03 10:13:34.8476880|
399+
|OSPlatform|String|Platform of the operating system running on the device; specific operating systems with variations within the same family, such as Windows 10 and Windows 11. See Microsoft Defender Vulnerability Management supported operating systems and platforms for details.|Windows10 and Windows 11|
400+
|RbacGroupName|String|The role-based access control (RBAC) group. If this device isn't assigned to any RBAC group, the value is "Unassigned." If the organization doesn't contain any RBAC groups, the value is "None."|Servers|
401+
|RecommendationReference|string|A reference to the recommendation ID related to this software.|va--microsoft--silverlight|
402+
|RecommendedSecurityUpdate |String|Name or description of the security update provided by the software vendor to address the vulnerability.|April 2020 Security Updates|
403+
|RecommendedSecurityUpdateId |String|Identifier of the applicable security updates or identifier for the corresponding guidance or knowledge base (KB) articles|4550961|
404+
|RegistryPaths |Array[string]|Registry evidence that the product is installed in the device.|["HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome"]|
405+
|SoftwareName|String|Name of the software product.|Chrome|
406+
|SoftwareVendor|String|Name of the software vendor.|Google|
407+
|SoftwareVersion|String|Version number of the software product.|81.0.4044.138|
408+
|Status|String|**New** (for a new vulnerability introduced on a device) (1) **Fixed** (if this vulnerability doesn't exist anymore on the device, which means it was remediated). (2) **Updated** (if a vulnerability on a device changed. The possible changes are: CVSS score, exploitability level, severity level, DiskPaths, RegistryPaths, RecommendedSecurityUpdate). |Fixed|
409+
|VulnerabilitySeverityLevel|String|Severity level that is assigned to the security vulnerability and is based on the CVSS score.|Medium|
410+
|||||
411411

412412
#### Clarifications
413413

0 commit comments

Comments
 (0)