You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/indicator-ip-domain.md
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -61,19 +61,19 @@ You can block malicious IPs/URLs through the settings page or by machine groups,
61
61
62
62
## Before you begin
63
63
64
-
It's important to understand the following prerequisites prior to creating indicators for IPS, URLs, or domains.
64
+
It's important to understand the following prerequisites before creating indicators for IPS, URLs, or domains.
65
65
66
66
### Microsoft Defender Antivirus version requirements
67
67
68
-
- Your organization uses [Microsoft Defender Antivirus](/defender-endpoint/microsoft-defender-antivirus-windows). Microsoft Defender Antivirus must be in active mode for non-Microsoft browsers. With Microsoft browsers, like Edge, Microsoft Defender Antivirus can be in active or passive mode.
68
+
- Your organization uses [Microsoft Defender Antivirus](/defender-endpoint/microsoft-defender-antivirus-windows). Microsoft Defender Antivirus must be in active mode for non-Microsoft browsers. With Microsoft browsers, like Microsoft Edge, Microsoft Defender Antivirus can be in active or passive mode.
69
69
70
70
-[Behavior Monitoring](/defender-endpoint/behavior-monitor) is enabled.
71
71
72
72
-[Cloud-based protection](/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus) is turned on.
73
73
74
74
-[Cloud Protection network connectivity](/defender-endpoint/configure-network-connections-microsoft-defender-antivirus) is turned on.
75
75
76
-
- The antimalware client version must be `4.18.1906.x` or later. See [Monthly platform and engine versions](/defender-endpoint/microsoft-defender-antivirus-updates).
76
+
- The anti-malware client version must be `4.18.1906.x` or later. See [Monthly platform and engine versions](/defender-endpoint/microsoft-defender-antivirus-updates).
77
77
78
78
### Network Protection requirements
79
79
@@ -89,16 +89,16 @@ For support of indicators on Android, see [Microsoft Defender for Endpoint on An
89
89
90
90
### IoC indicator list limitations
91
91
92
-
Only external IPs can be added to the indicator list. Indicators can't be created for internal IPs. For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge leverages[Network Protection](network-protection.md) to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS).
92
+
Only external IPs can be added to the indicator list. Indicators can't be created for internal IPs. For web protection scenarios, we recommend using the built-in capabilities in Microsoft Edge. Microsoft Edge uses[Network Protection](network-protection.md) to inspect network traffic and allows blocks for TCP, HTTP, and HTTPS (TLS).
93
93
94
94
### Non Microsoft Edge and Internet Explorer processes
95
95
96
-
For processes other than Microsoft Edge and Internet Explorer, web protection scenarios leverage Network Protection for inspection and enforcement:
96
+
For processes other than Microsoft Edge and Internet Explorer, web protection scenarios use Network Protection for inspection and enforcement:
97
97
98
98
- IP is supported for all three protocols (TCP, HTTP, and HTTPS (TLS))
99
99
- Only single IP addresses are supported (no CIDR blocks or IP ranges) in custom indicators
100
-
- Encrypted URLs (full path) can only be blocked on first party browsers (Internet Explorer, Edge)
101
-
- Encrypted URLs (FQDN only) can be blocked in third party browsers (that is, other than Internet Explorer, Edge)
100
+
- Encrypted URLs (full path) can only be blocked on first party browsers (Internet Explorer, Microsoft Edge)
101
+
- Encrypted URLs (FQDN only) can be blocked in non-Microsoft browsers (that is, other than Internet Explorer, Edge)
102
102
- URLs loaded via HTTP connection coalescing, such as content loaded by modern CDN's, can only be blocked on first party browsers (Internet Explorer, Edge), unless the CDN URL itself is added to the indicator list.
103
103
- Full URL path blocks can be applied for unencrypted URLs
104
104
- If there are conflicting URL indicator policies, the longer path is applied. For example, the URL indicator policy `https://support.microsoft.com/office` takes precedence over the URL indicator policy `https://support.microsoft.com`.
0 commit comments