Skip to content

Commit d571e97

Browse files
committed
Update indicator-ip-domain.md
1 parent a17347c commit d571e97

File tree

1 file changed

+7
-7
lines changed

1 file changed

+7
-7
lines changed

defender-endpoint/indicator-ip-domain.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -61,19 +61,19 @@ You can block malicious IPs/URLs through the settings page or by machine groups,
6161

6262
## Before you begin
6363

64-
It's important to understand the following prerequisites prior to creating indicators for IPS, URLs, or domains.
64+
It's important to understand the following prerequisites before creating indicators for IPS, URLs, or domains.
6565

6666
### Microsoft Defender Antivirus version requirements
6767

68-
- Your organization uses [Microsoft Defender Antivirus](/defender-endpoint/microsoft-defender-antivirus-windows). Microsoft Defender Antivirus must be in active mode for non-Microsoft browsers. With Microsoft browsers, like Edge, Microsoft Defender Antivirus can be in active or passive mode.
68+
- Your organization uses [Microsoft Defender Antivirus](/defender-endpoint/microsoft-defender-antivirus-windows). Microsoft Defender Antivirus must be in active mode for non-Microsoft browsers. With Microsoft browsers, like Microsoft Edge, Microsoft Defender Antivirus can be in active or passive mode.
6969

7070
- [Behavior Monitoring](/defender-endpoint/behavior-monitor) is enabled.
7171

7272
- [Cloud-based protection](/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus) is turned on.
7373

7474
- [Cloud Protection network connectivity](/defender-endpoint/configure-network-connections-microsoft-defender-antivirus) is turned on.
7575

76-
- The antimalware client version must be `4.18.1906.x` or later. See [Monthly platform and engine versions](/defender-endpoint/microsoft-defender-antivirus-updates).
76+
- The anti-malware client version must be `4.18.1906.x` or later. See [Monthly platform and engine versions](/defender-endpoint/microsoft-defender-antivirus-updates).
7777

7878
### Network Protection requirements
7979

@@ -89,16 +89,16 @@ For support of indicators on Android, see [Microsoft Defender for Endpoint on An
8989

9090
### IoC indicator list limitations
9191

92-
Only external IPs can be added to the indicator list. Indicators can't be created for internal IPs. For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge leverages [Network Protection](network-protection.md) to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS).
92+
Only external IPs can be added to the indicator list. Indicators can't be created for internal IPs. For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge uses [Network Protection](network-protection.md) to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS).
9393

9494
### Non Microsoft Edge and Internet Explorer processes
9595

96-
For processes other than Microsoft Edge and Internet Explorer, web protection scenarios leverage Network Protection for inspection and enforcement:
96+
For processes other than Microsoft Edge and Internet Explorer, web protection scenarios use Network Protection for inspection and enforcement:
9797

9898
- IP is supported for all three protocols (TCP, HTTP, and HTTPS (TLS))
9999
- Only single IP addresses are supported (no CIDR blocks or IP ranges) in custom indicators
100-
- Encrypted URLs (full path) can only be blocked on first party browsers (Internet Explorer, Edge)
101-
- Encrypted URLs (FQDN only) can be blocked in third party browsers (that is, other than Internet Explorer, Edge)
100+
- Encrypted URLs (full path) can only be blocked on first party browsers (Internet Explorer, Microsoft Edge)
101+
- Encrypted URLs (FQDN only) can be blocked in non-Microsoft browsers (that is, other than Internet Explorer, Edge)
102102
- URLs loaded via HTTP connection coalescing, such as content loaded by modern CDN's, can only be blocked on first party browsers (Internet Explorer, Edge), unless the CDN URL itself is added to the indicator list.
103103
- Full URL path blocks can be applied for unencrypted URLs
104104
- If there are conflicting URL indicator policies, the longer path is applied. For example, the URL indicator policy `https://support.microsoft.com/office` takes precedence over the URL indicator policy `https://support.microsoft.com`.

0 commit comments

Comments
 (0)