You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In the request body, supply a JSON object with the following parameters:
73
69
74
-
Parameter|Type|Description
75
-
:---|:---|:---
76
-
indicatorValue|String|Identity of the [Indicator](ti-indicator.md) entity. **Required**
77
-
indicatorType|Enum|Type of the indicator. Possible values are: `FileSha1`, `FileMd5`, `CertificateThumbprint`, `FileSha256`, `IpAddress`, `DomainName`, and `Url`. **Required**
78
-
action|Enum|The action that is taken if the indicator is discovered in the organization. Possible values are: `Alert`, `Warn`, `Block`, `Audit`, `BlockAndRemediate`, `AlertAndBlock`, and `Allowed`. **Required**. The `GenerateAlert` parameter must be set to `TRUE` when creating an action with `Audit`.
79
-
application|String|The application associated with the indicator. This field only works for new indicators. It doesn't update the value on an existing indicator. **Optional**
80
-
title|String|Indicator alert title. **Required**
81
-
description|String|Description of the indicator. **Required**
82
-
expirationTime|DateTimeOffset|The expiration time of the indicator. **Optional**
83
-
severity|Enum|The severity of the indicator. Possible values are: `Informational`, `Low`, `Medium`, and `High`. **Optional**
rbacGroupNames|String|Comma-separated list of RBAC group names the indicator would be applied to. **Optional**
86
-
educateUrl|String|Custom notification/support URL. Supported for Block and Warn action types for URL indicators. **Optional**
87
-
generateAlert|Enum|**True** if alert generation is required, **False** if this indicator shouldn't generate an alert.
70
+
|Parameter|Type|Description|
71
+
|:---|:---|:---|
72
+
|indicatorValue|String|Identity of the [Indicator](ti-indicator.md) entity. **Required**|
73
+
|indicatorType|Enum|Type of the indicator. Possible values are: `FileSha1`, `FileMd5`, `CertificateThumbprint`, `FileSha256`, `IpAddress`, `DomainName`, and `Url`. **Required**|
74
+
|action|Enum|The action that is taken if the indicator is discovered in the organization. Possible values are: `Alert`, `Warn`, `Block`, `Audit`, `BlockAndRemediate`, `AlertAndBlock`, and `Allowed`. **Required**. The `GenerateAlert` parameter must be set to `TRUE` when creating an action with `Audit`.|
75
+
|application|String|A user-friendly name for the content blocked by the indicator. If specified, this text will be shown in the blocking notification in place of the blocked filename or domain. This field only works for new indicators; it doesn't update the value on an existing indicator. **Optional**|
Copy file name to clipboardExpand all lines: defender-endpoint/configure-network-connections-microsoft-defender-antivirus.md
-1Lines changed: 0 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -109,7 +109,6 @@ The following table lists solutions:
109
109
|Solution|Description|
110
110
|:---|:---|
111
111
| Solution (Preferred) | Configure the system-wide WinHttp proxy that allows the CRL check.|
112
-
| Solution (Preferred 2) | 1. Go to **Computer Configuration** > **Windows Settings** > **Security Settings** > **Public Key Policies** > **Certificate Path Validation Settings**.<br/>2. Select the **Network Retrieval** tab, and then select **Define these policy settings**.<br/>3. Clear the **Automatically update certificates in the Microsoft Root Certificate Program (recommended)** check box.<br/><br/> Here are some useful resources: <br/> - [Configure Trusted Roots and Disallowed Certificates](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/dn265983(v=ws.11))<br/>- [Improving application Start up time: GeneratePublisherEvidence setting in Machine.config](/archive/blogs/amolravande/improving-application-start-up-time-generatepublisherevidence-setting-in-machine-config)|
113
112
| Work-around solution (Alternative) <br/> *This is not a best practice since you're no longer checking for revoked certificates or certificate pinning.*| Disable CRL check only for SPYNET. <br/> Configuring this registry SSLOption disables CRL check only for SPYNET reporting. It won't impact other services.<br/><br/> Go to **HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet**, and then set `SSLOptions (dword)` to `2` (hex). <br/>For reference, here are possible values for the DWORD: <br/> - `0 – disable pinning and revocation checks` <br/> - `1 – disable pinning` <br/> - `2 – disable revocation checks only` <br/> - `3 – enable revocation checks and pinning (default)`|
114
113
115
114
## Attempt to download a fake malware file from Microsoft
- Support phase: **Security and Critical Updates**
84
+
85
+
#### What's new
86
+
87
+
-**Improved service startup behavior**: The core service now only restarts when necessary, for example, during a successful platform update. This change allows the organization to avoid unnecessary restarts when the service is already running correctly.
88
+
-**Improved stability for RPC services**: Added input validation across multiple RPC endpoints to prevent crashes caused by malformed data, which addresses a reported security vulnerability.
89
+
-**Fixed threat exclusion handling**: Resolved an issue where severity-based exclusions could cause the engine to misidentify threats, potentially skipping high severity detections.
90
+
-**Restored performance optimization for network file access**: Fixed a regression that caused slowdowns during file operations, like robocopy to network shares. The fix included reintroducing the logic to skip unnecessary checks on non-local files when Controlled Folder Access is enabled.
@@ -98,13 +113,10 @@ Improved Defender update reliability by allowing non-admin processes to trigger
98
113
99
114
- Enhanced Passive Mode Scanning Behavior
100
115
When Microsoft Defender is in Passive mode, an Antivirus scan will not occur after a signature update , unless specifically set in the policy setting DisableScanOnUpdate.
101
-
102
116
- Improved Tamper Protection Handling
103
117
Optimized the configuration process for Tamper Protection in multi-threaded environments to ensure more reliable behavior.
104
-
105
118
- Digital Signature Verification Performance Boost
106
119
Enhanced the efficiency of digital signature verification to improve overall system performance.
107
-
108
120
- Refined ASR Rule Exclusion Processing
109
121
Refined exclusion processing and resolved false positives for the Attack Surface Reduction (ASR) rule: Block Office applications from injecting code into other processes.
Copy file name to clipboardExpand all lines: defender-endpoint/web-threat-protection.md
+6-24Lines changed: 6 additions & 24 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -27,47 +27,29 @@ appliesto:
27
27
28
28
29
29
30
-
Web threat protection is part of [Web protection](web-protection-overview.md) in Defender for Endpoint. It uses [network protection](network-protection.md) to secure your devices against web threats. By integrating with Microsoft Edge and popular third-party browsers like Chrome and Firefox, web threat protection stops web threats without a web proxy and can protect devices while they're away or on premises. Web threat protection stops access to phishing sites, malware vectors, exploit sites, untrusted or low-reputation sites, and sites that you are blocked because they're in your [custom indicator list](indicators-overview.md).
30
+
Web threat protection is part of [Web protection](web-protection-overview.md) in Defender for Endpoint. It uses [network protection](network-protection.md) to secure your devices against web threats. By integrating with Microsoft Edge and popular third-party browsers like Chrome and Firefox, web threat protection stops web threats without a web proxy and can protect devices while they're away or on premises. Web threat protection stops access to phishing sites, malware vectors, exploit sites, untrusted or low-reputation sites, and sites that you've blocked because they're in your [custom indicator list](indicators-overview.md).
31
31
32
32
> [!NOTE]
33
33
> It might take up to two hours for devices to receive new custom indicators.
34
34
35
35
## Prerequisites
36
36
37
-
Web protection uses network protection to provide web browsing security on Microsoft Edge and non-Microsoft web browsers.
37
+
Web threat protection uses network protection to provide web browsing security in Edge (excepting Windows devices), non-Microsoft web browsers and nonbrowser processes. On Windows devices, web threat protection in Edge uses Microsoft Defender SmartScreen and network protection isn't required to be enabled.
38
+
39
+
To turn on Microsoft Defender SmartScreen in Edge: [Configure Microsoft Defender SmartScreen](/deployedge/microsoft-edge-policies#smartscreenenabled).
38
40
39
41
To turn on network protection on your devices:
40
42
41
43
- Edit the Defender for Endpoint security baseline under **Web & Network Protection** to enable network protection before deploying or redeploying it. [Learn about reviewing and assigning the Defender for Endpoint security baseline](configure-machines-security-baseline.md#review-and-assign-the-microsoft-defender-for-endpoint-security-baseline)
42
44
- Turn network protection on using Intune device configuration, SCCM, Group Policy, or your MDM solution. [Read more about enabling network protection](enable-network-protection.md)
43
45
44
46
> [!NOTE]
45
-
> If you set network protection to **Audit only**, blocking will be unavailable. Also, you will be able to detect and log attempts to access malicious and unwanted websites on Microsoft Edge only.
47
+
> If you set network protection to **Audit only**, blocking is unavailable. Also, you are able to detect and log attempts to access malicious and unwanted websites on Microsoft Edge only.
46
48
47
49
## Configure web threat protection
48
50
49
-
The following procedure describes how to configure web threat protection using the Microsoft Intune admin center.
50
-
51
-
1. Go to the Microsoft Intune admin center ([https://intune.microsoft.com](https://intune.microsoft.com)), and sign in.
52
-
53
-
2. Choose **Endpoint security**\>**Attack surface reduction**, and then choose **+ Create policy**.
54
-
55
-
3. Select a platform, such as **Windows 10 and later**, select the **Web protection** profile, and then choose **Create**.
56
-
57
-
4. On the **Basics** tab, specify a name and description, and then choose **Next**.
58
-
59
-
5. On the **Configuration settings** tab, expand **Web Protection**, specify your settings, and then choose **Next**.
60
-
61
-
- Set **Enable network protection** to **Enabled** so web protection is turned on. Alternately, you can set network protection to **Audit mode** to see how it works in your environment. In audit mode, network protection doesn't prevent users from visiting sites or domains, but it does track detections as events.
62
-
- To protect users from potential phishing scams and malicious software, turn **Require SmartScreen for Microsoft Edge Legacy** to **Yes**.
63
-
- To prevent users from bypassing warnings about potentially malicious sites, set **Block malicious site access** to **Yes**.
64
-
- To prevent users from bypassing the warnings and downloading unverified files, set **Block unverified file download** to **Yes**.
65
-
66
-
6. On the **Scope tags** tab, if your organization is using scope tags, choose **+ Select scope tags**, and then choose **Next**. (If you aren't using scope tags, choose **Next**.) To learn more about scope tags, see [Use role-based access control (RBAC) and scope tags for distributed IT](/mem/intune/fundamentals/scope-tags).
67
-
68
-
7. On the **Assignments** tab, specify the users and devices to receive the web protection policy, and then choose **Next**.
51
+
The legacy **Web protection** policy in Intune has been deprecated and web threat protection will be enabled if the prerequisites are met.
69
52
70
-
8. On the **Review + create** tab, review your policy settings, and then choose **Create**.
1. Run the modified command on your machine to deploy the container. When successful, the logs show pulling an image from mcr.microsoft.com and continuing to create blobs for the container.
Copy file name to clipboardExpand all lines: defender-for-cloud-apps/protect-atlassian.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -85,7 +85,7 @@ This section provides instructions for connecting Microsoft Defender for Cloud A
85
85
86
86
87
87
88
-
1. Go to **Settings -> API keys** and then **Create API key**. (Atlassian documentation for creating API keys can also be found [here](https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/)).
88
+
1. Go to **Settings -> API keys** and then **Create API key** without scopes. (Atlassian documentation for creating API keys can also be found [here](https://support.atlassian.com/organization-administration/docs/manage-an-organization-with-the-admin-apis/)).
89
89
90
90
0 commit comments