You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
-[Microsoft Defender for Cloud](/azure/defender-for-cloud/defender-for-cloud-introduction)
32
32
33
-
For the Microsoft Defender XDR security portal to start enforcing the permissions and assignments configured in your new [custom roles](create-custom-rbac-roles.md) or [imported roles](import-rbac-roles.md) you must activate the Microsoft Defender XDR Unified RBAC model for some or all of your workloads.
33
+
For the Microsoft Defender XDR security portal to start enforcing the permissions and assignments configured in your new [custom roles](create-custom-rbac-roles.md) or [imported roles](import-rbac-roles.md), you must activate the Microsoft Defender XDR Unified RBAC model for some or all of your workloads.
@@ -43,6 +43,7 @@ The following steps guide you on how to activate the Microsoft Defender XDR Unif
43
43
44
44
> [!IMPORTANT]
45
45
> You must be a Global Administrator or Security Administrator in Microsoft Entra ID to perform this task. For more information on permissions, see [Permission pre-requisites](manage-rbac.md#permissions-prerequisites).
46
+
> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
46
47
47
48
### Activate from the Permissions and roles page
48
49
@@ -53,26 +54,23 @@ You can activate your workloads in two ways from the Permissions and roles page:
53
54
:::image type="content" source="/defender/media/defender/m365-defender-rbac-activate-workloads1.png" alt-text="Screenshot of the activate workloads page" lightbox="/defender/media/defender/m365-defender-rbac-activate-workloads1.png":::
54
55
55
56
1.**Activate workloads**
56
-
- Select **Activate workloads** on the banner above the list of roles.
57
-
- This will bring you directly to the **Activate workloads** screen.
58
-
- You must activate each workload one by one. Once you select the individual toggle, you'll activate (or deactivate) that workload.
57
+
- Select **Activate workloads** on the banner above the list of roles to go directly to the **Activate workloads** screen.
58
+
- You must activate each workload one by one. Once you select the individual toggle, you activate (or deactivate) that workload.
59
59
60
-
:::image type="content" source="/defender/media/defender/m365-defender-rbac-activate-workload-selection1.png" alt-text="Screenshot of the choose workloads to activate screen" lightbox="/defender/media/defender/m365-defender-rbac-activate-workload-selection1.png":::
60
+
:::image type="content" source="/defender/media/defender/m365-defender-rbac-activate-workload-selection1.png" alt-text="Screenshot of the choose workloads to activate screen" lightbox="/defender/media/defender/m365-defender-rbac-activate-workload-selection1.png":::
61
61
62
-
> [!NOTE]
63
-
> The **Activate workloads** button is only available when there is it at least one workload that's not active for Microsoft Defender XDR Unified RBAC.
64
-
65
-
> [!NOTE]
66
-
> Microsoft Defender for Cloud is active by default with Microsoft Defender XDR Unified RBAC.
67
-
68
-
> [!NOTE]
69
-
> To activate Exchange Online permissions in Microsoft Defender XDR Unified RBAC, Defender for Office 365 permissions must be active.
62
+
> [!NOTE]
63
+
> The **Activate workloads** button is only available when there is it at least one workload that's not active for Microsoft Defender XDR Unified RBAC.
64
+
>
65
+
> Microsoft Defender for Cloud is active by default with Microsoft Defender XDR Unified RBAC.
66
+
>
67
+
> To activate Exchange Online permissions in Microsoft Defender XDR Unified RBAC, Defender for Office 365 permissions must be active.
70
68
71
69
2.**Workload settings**
72
70
- Select **Workload settings**.
73
71
- This brings you to the Microsoft Defender XDR **Permission and roles** page.
74
72
- Select the toggle for the workload you want to activate.
75
-
- Select Activate on the confirmation message.
73
+
- Select **Activate** on the confirmation message.
76
74
77
75
You have now successfully activated (or deactivated) that workload.
78
76
@@ -83,11 +81,16 @@ You have now successfully activated (or deactivated) that workload.
83
81
Follow these steps to activate your workloads directly in Microsoft Defender XDR settings:
84
82
85
83
1. Sign in to the [Microsoft Defender portal](https://security.microsoft.com).
84
+
86
85
2. In the navigation pane, select **Settings**.
86
+
87
87
3. Select **Microsoft Defender XDR**.
88
+
88
89
4. Select **Permissions and roles**. This brings you to the **Activate workloads** page.
90
+
89
91
5. Select the toggle for the workload you want to activate.
90
-
6. Select Activate on the confirmation message.
92
+
93
+
6. Select **Activate** on the confirmation message.
91
94
92
95
You have now successfully activated (or deactivated) that workload.
93
96
@@ -100,11 +103,12 @@ You have now successfully activated (or deactivated) that workload.
100
103
101
104
You can deactivate Microsoft Defender XDR Unified RBAC and revert to the individual RBAC models from Microsoft Defender for Endpoint, Microsoft Defender for Identity, and Microsoft Defender for Office 365 (Exchange Online Protection).
102
105
103
-
To Deactivate the workloads, repeat the steps above and select the workloads you want to deactivate. The status will be set to **Not Active**.
106
+
To Deactivate the workloads, repeat the steps above and select the workloads you want to deactivate. The status is set to **Not Active**.
104
107
105
-
If you deactivate a workload, the roles created and edited within Microsoft Defender XDR Unified RBAC won't be effective and you'll return to using the previous permissions model. This will remove any access that users assigned these roles have.
108
+
If you deactivate a workload, the roles created and edited within Microsoft Defender XDR Unified RBAC are no longer in effect, and the previous permissions model is used instead.
106
109
107
110
## Next steps
108
111
109
112
-[Edit or delete roles](edit-delete-rbac-roles.md)
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-limits.md
+10-6Lines changed: 10 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.collection:
15
15
- m365-security
16
16
- tier3
17
17
ms.topic: conceptual
18
-
ms.date: 04/03/2024
18
+
ms.date: 06/27/2024
19
19
---
20
20
21
21
# Use the advanced hunting query resource report
@@ -35,8 +35,8 @@ Refer to the following table to understand existing quotas and usage parameters.
35
35
|--|--|--|--|
36
36
| Data range | 30 days | Every query | Each query can look up data from up to the past 30 days. |
37
37
| Result set | 30,000 rows | Every query | Each query can return up to 30,000 records. |
38
-
| Timeout | 10 minutes | Every query | Each query can run for up to 10 minutes. If it does not complete within 10 minutes, the service displays an error.
39
-
| CPU resources | Based on tenant size | Every 15 minutes | The [portal displays an error](advanced-hunting-errors.md) whenever a query runs and the tenant has consumed over 10% of allocated resources. Queries are blocked if the tenant has reached 100% until after the next 15-minute cycle. |
38
+
| Timeout | 10 minutes | Every query | Each query can run for up to 10 minutes. If it doesn't complete within 10 minutes, the service displays an error.
39
+
| CPU resources | Based on tenant size | Every 15 minutes | The [portal displays an error](advanced-hunting-errors.md) whenever a query runs and the tenant consumes over 10% of allocated resources. Queries are blocked if the tenant reaches 100% until after the next 15-minute cycle. |
40
40
41
41
> [!NOTE]
42
42
> A separate set of quotas and parameters apply to advanced hunting queries performed through the API. [Read about advanced hunting APIs](./api-advanced-hunting.md)
@@ -58,12 +58,15 @@ The report can be accessed in two ways:
58
58
59
59
:::image type="content" source="/defender/media/ah-query-resources/reports-general-query-resources.png" alt-text="view the query resources report in the Reports section" lightbox="/defender/media/ah-query-resources/reports-general-query-resources.png":::
60
60
61
-
All users can access the reports, however, only the Microsoft Entra global admin, Microsoft Entra security admin, and Microsoft Entra security reader roles can see queries done by all users in all interfaces. Any other user can only see:
61
+
All users can access the reports; however, only the Microsoft Entra Global Administrator, Microsoft Entra Security Administrator, and Microsoft Entra Security Reader roles can see queries done by all users in all interfaces. Any other user can only see:
62
62
63
63
- Queries they ran via the portal
64
64
- Public API queries they ran themselves and not through the application
65
65
- Custom detections they created
66
66
67
+
> [!IMPORTANT]
68
+
> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
69
+
67
70
### Query resource report contents
68
71
69
72
By default, the report table displays queries from the last day, and is sorted by Resource usage, to help you easily identify which queries consumed the highest amount of CPU resources.
@@ -87,7 +90,7 @@ The query resources report contains all queries that ran, including detailed res
87
90
88
91
Queries with high resource usage or a long query time can probably be optimized to prevent throttling via this interface.
89
92
90
-
The graph displays resource usage over time per interface. You can easily identify excessive usage and click the spikes in the graph to filter the table accordingly. Once you select an entry in the graph, the table is filtered to that specific date.
93
+
The graph displays resource usage over time per interface. You can easily identify excessive usage and select the spikes in the graph to filter the table accordingly. Once you select an entry in the graph, the table is filtered to that specific date.
91
94
92
95
You can identify the queries that used the most resources on that day and take action to improve them – by [applying query best practices](advanced-hunting-best-practices.md) or educating the user who ran the query or created the rule to take query efficiency and resources into consideration. For guided mode, the user needs to [switch to advanced mode](advanced-hunting-query-builder-details.md#switch-to-advanced-mode-after-building-a-query) to edit the query.
93
96
@@ -100,9 +103,10 @@ The graph supports two views:
100
103
101
104
This means that, for instance, if on a specific day you ran two queries, one used 50% of your resources and one used 100%, the average daily use value would show 75%, while the top daily use would show 100%.
102
105
103
-
## Related topics
106
+
## Related articles
104
107
105
108
-[Advanced hunting best practices](advanced-hunting-best-practices.md)
Copy file name to clipboardExpand all lines: defender-xdr/advanced-hunting-take-action.md
+14-9Lines changed: 14 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ ms.collection:
15
15
- m365-security
16
16
- tier1
17
17
ms.topic: conceptual
18
-
ms.date: 02/16/2024
18
+
ms.date: 06/27/2024
19
19
---
20
20
21
21
# Take action on advanced hunting query results
@@ -34,7 +34,12 @@ You can quickly contain threats or address compromised assets that you find in [
34
34
35
35
## Required permissions
36
36
37
-
To take action on devices through advanced hunting, you need a role in Microsoft Defender for Endpoint with [permissions to submit remediation actions on devices](/windows/security/threat-protection/microsoft-defender-atp/user-roles#permission-options). If you can't take action, contact a global administrator about getting the following permission:
37
+
To take action on devices through advanced hunting, you need a role in Microsoft Defender for Endpoint with [permissions to submit remediation actions on devices](/windows/security/threat-protection/microsoft-defender-atp/user-roles#permission-options).
38
+
39
+
> [!IMPORTANT]
40
+
> Microsoft recommends that you use roles with the fewest permissions. This helps improve security for your organization. Global Administrator is a highly privileged role that should be limited to emergency scenarios when you can't use an existing role.
41
+
42
+
If you can't take action, contact a Global Administrator about getting the following permission:
@@ -54,9 +59,9 @@ To learn more about how these response actions are performed through Microsoft D
54
59
55
60
### Quarantine files
56
61
57
-
You can deploy the *quarantine* action on files so that they are automatically quarantined when encountered. When selecting this action, you can choose between the following columns to identify which files in your query results to quarantine:
62
+
You can deploy the *quarantine* action on files so that they're automatically quarantined when encountered. When selecting this action, you can choose between the following columns to identify which files in your query results to quarantine:
58
63
59
-
-`SHA1`: In most advanced hunting tables, this column refers to the SHA-1 of the file that was affected by the recorded action. For example, if a file was copied, this affected file would be the copied file.
64
+
-`SHA1`: In most advanced hunting tables, this column refers to the SHA-1 of the file that's affected by the recorded action. For example, if a file was copied, this affected file would be the copied file.
60
65
-`InitiatingProcessSHA1`: In most advanced hunting tables, this column refers to the file responsible for initiating the recorded action. For example, if a child process was launched, this initiator file would be part of the parent process.
61
66
-`SHA256`: This column is the SHA-256 equivalent of the file identified by the `SHA1` column.
62
67
-`InitiatingProcessSHA256`: This column is the SHA-256 equivalent of the file identified by the `InitiatingProcessSHA1` column.
@@ -66,19 +71,19 @@ To learn more about how quarantine actions are taken and how files can be restor
66
71
> [!NOTE]
67
72
> To locate files and quarantine them, the query results should also include `DeviceId` values as device identifiers.
68
73
69
-
To take any of the described actions, select one or more records in your query results and then select **Take actions**. A wizard will guide you through the process of selecting and then submitting your preferred actions.
74
+
To take any of the described actions, select one or more records in your query results and then select **Take actions**. A wizard guides you through the process of selecting and then submitting your preferred actions.
70
75
71
76
:::image type="content" source="media/take-action-multiple.png" alt-text="Screenshot of the take actions option in the Microsoft Defender portal." lightbox="media/take-action-multiple.png":::
72
77
73
78
## Take various actions on emails
74
79
75
80
Apart from device-focused remediation steps, you can also take some actions on emails from your query results. Select the records you want to take action on, select **Take actions**, then under **Choose actions**, select your choice from the following:
76
81
77
-
-`Move to mailbox folder` - select this to move the email messages to Junk, Inbox, or Deleted items folder
82
+
-`Move to mailbox folder` - select this action to move the email messages to Junk, Inbox, or Deleted items folder
78
83
79
84
:::image type="content" source="media/advanced-hunting-take-actions-email.png" alt-text="Screenshot of the option Take actions in the Microsoft Defender portal." lightbox="media/advanced-hunting-take-actions-email.png":::
80
85
81
-
-`Delete email` - select this to move email messages to the Deleted items folder (**Soft delete**) or delete them permanently (**Hard delete**)
86
+
-`Delete email` - select this action to move email messages to the Deleted items folder (**Soft delete**) or delete them permanently (**Hard delete**)
82
87
83
88
Selecting **Soft delete** also automatically soft deletes the messages from the sender's Sent Items folder if the sender is in the organization.
84
89
@@ -94,7 +99,6 @@ Apart from device-focused remediation steps, you can also take some actions on e
You can also provide a remediation name and a short description of the action taken to easily track it in the action center history. You can also use the Approval ID to filter for these actions in the action center. This ID is provided at the end of the wizard:
@@ -108,11 +112,12 @@ Each action is individually recorded in the [action center](m365d-action-center.
108
112
> [!NOTE]
109
113
> Some tables in this article might not be available in Microsoft Defender for Endpoint. [Turn on Microsoft Defender XDR](m365d-enable.md) to hunt for threats using more data sources. You can move your advanced hunting workflows from Microsoft Defender for Endpoint to Microsoft Defender XDR by following the steps in [Migrate advanced hunting queries from Microsoft Defender for Endpoint](advanced-hunting-migrate-from-mde.md).
0 commit comments