Merge pull request #709 from MicrosoftDocs/metadata

denisebmsft · web-flow · commit e1464446eb31 · 2024-06-14T09:58:10.000-07:00
metadata
diff --git a/defender-vulnerability-management/defender-vulnerability-management-capabilities.md b/defender-vulnerability-management/defender-vulnerability-management-capabilities.md
@@ -4,7 +4,7 @@ description: Compare Defender Vulnerability Management Offerings. Learn about th
 search.appverid: MET150  
 author: siosulli
 ms.author: siosulli
-manager: dansimp 
+manager: deniseb 
 audience: ITPro
 ms.topic: overview
 ms.service: defender-vuln-mgmt
diff --git a/defender-vulnerability-management/defender-vulnerability-management-faq.md b/defender-vulnerability-management/defender-vulnerability-management-faq.md
@@ -7,7 +7,7 @@ f1.keywords:
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection: 
 - m365-security
diff --git a/defender-vulnerability-management/defender-vulnerability-management-trial.md b/defender-vulnerability-management/defender-vulnerability-management-trial.md
@@ -7,7 +7,7 @@ f1.keywords:
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection: 
 - m365-security
diff --git a/defender-vulnerability-management/defender-vulnerability-management.md b/defender-vulnerability-management/defender-vulnerability-management.md
@@ -3,7 +3,7 @@ title: Microsoft Defender Vulnerability Management
 description: Microsoft Defender Vulnerability Management uses a risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.
 author: siosulli
 ms.author: siosulli
-manager: dansimp
+manager: deniseb
 ms.topic: overview
 ms.service: defender-vuln-mgmt
 ms.localizationpriority: medium
diff --git a/defender-vulnerability-management/device-restart-status.md b/defender-vulnerability-management/device-restart-status.md
@@ -6,7 +6,7 @@ ms.pagetype: security
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection:
   - m365-security
diff --git a/defender-vulnerability-management/fixed-reported-inaccuracies.md b/defender-vulnerability-management/fixed-reported-inaccuracies.md
@@ -6,7 +6,7 @@ ms.service: defender-vuln-mgmt
 ms.pagetype: security
 ms.author: siosulli
 author: siosulli
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection: 
   - m365-security
diff --git a/defender-vulnerability-management/get-defender-vulnerability-management.md b/defender-vulnerability-management/get-defender-vulnerability-management.md
@@ -4,7 +4,7 @@ description: Get Microsoft Defender Vulnerability Management
 search.appverid: MET150
 author: siosulli
 ms.author: siosulli
-manager: dansimp 
+manager: deniseb 
 audience: Admin
 ms.topic: overview
 ms.service: defender-vuln-mgmt
diff --git a/defender-vulnerability-management/mdvm-onboard-devices.md b/defender-vulnerability-management/mdvm-onboard-devices.md
@@ -4,7 +4,7 @@ description: Learn how to onboard endpoints to Microsoft Defender Vulnerability
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection:
 - m365-security
diff --git a/defender-vulnerability-management/threat-and-vuln-mgt-event-timeline.md b/defender-vulnerability-management/threat-and-vuln-mgt-event-timeline.md
@@ -5,7 +5,7 @@ ms.service: defender-vuln-mgmt
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection: 
 - m365-security
diff --git a/defender-vulnerability-management/trial-user-guide-defender-vulnerability-management.md b/defender-vulnerability-management/trial-user-guide-defender-vulnerability-management.md
@@ -5,7 +5,7 @@ ms.service: defender-vuln-mgmt
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection: 
 - m365-security-compliance
diff --git a/defender-vulnerability-management/tvm-assign-device-value.md b/defender-vulnerability-management/tvm-assign-device-value.md
@@ -5,7 +5,7 @@ ms.service: defender-vuln-mgmt
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection: 
   - m365-security
diff --git a/defender-vulnerability-management/tvm-browser-extensions.md b/defender-vulnerability-management/tvm-browser-extensions.md
@@ -6,7 +6,7 @@ ms.pagetype: security
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection:
   - m365-security
diff --git a/defender-vulnerability-management/tvm-certificate-inventory.md b/defender-vulnerability-management/tvm-certificate-inventory.md
@@ -5,7 +5,7 @@ ms.service: defender-vuln-mgmt
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection:
   - m365-security
diff --git a/defender-vulnerability-management/tvm-dashboard-insights.md b/defender-vulnerability-management/tvm-dashboard-insights.md
@@ -5,7 +5,7 @@ ms.service: defender-vuln-mgmt
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection:
   - m365-security
diff --git a/defender-vulnerability-management/tvm-end-of-support-software.md b/defender-vulnerability-management/tvm-end-of-support-software.md
@@ -1,15 +1,11 @@
 ---
 title: Plan for end-of-support software and software versions
 description: Discover and plan for software and software versions that are no longer supported and won't receive security updates.
-keywords: threat and vulnerability management, Microsoft Defender for Endpoint tvm security recommendation, cybersecurity recommendation, actionable security recommendation, Microsoft Defender Vulnerability Management
 ms.service: defender-vuln-mgmt
-ms.mktglfcycl: deploy
-ms.sitesec: library
-ms.pagetype: security
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection:
   - m365-security-compliance
@@ -28,7 +24,7 @@ ms.date: 03/04/2022
 - [Microsoft Defender XDR](/defender-xdr)
 - [Microsoft Defender for Servers Plan 1 & 2](/azure/defender-for-cloud/plan-defender-for-servers-select-plan)
 
-End-of-support (EOS), otherwise known as end-of-life (EOL), for software or software versions means that they will no longer be supported or serviced, and will not receive security updates. When you use software or software versions with ended support, you're exposing your organization to security vulnerabilities, legal, and financial risks.
+End-of-support (EOS), otherwise known as end-of-life (EOL), for software or software versions means that they'll no longer be supported or serviced, and won't receive security updates. When you use software or software versions with ended support, you're exposing your organization to security vulnerabilities, legal, and financial risks.
 
 It's crucial for Security and IT Administrators to work together and ensure that the organization's software inventory is configured for optimal results, compliance, and a healthy network ecosystem. They should examine the options to remove or replace apps that have reached end-of-support and update versions that are no longer supported. It's best to create and implement a plan **before** the end of support dates.
 
@@ -45,7 +41,7 @@ It's crucial for Security and IT Administrators to work together and ensure that
 
 :::image type="content" alt-text="tags that say EOS software, EOS versions, and Upcoming EOS versions." source="/defender/media/defender-vulnerability-management/tvm-eos-tag.png" lightbox="/defender/media/defender-vulnerability-management/tvm-eos-tag.png":::
 
-3. You'll see a list of recommendations related to software with ended support, software versions that are end of support, or versions with upcoming end of support. These tags are also visible in the [software inventory](tvm-software-inventory.md) page. Tags for versions with upcoming end of support will display up to 6 months in advance.
+3. You see a list of recommendations related to software with ended support, software versions that are end of support, or versions with upcoming end of support. These tags are also visible in the [software inventory](tvm-software-inventory.md) page. Tags for versions with upcoming end of support displays up to six months in advance.
 
 :::image type="content" alt-text="image of recommendations with EOS tag." source="/defender/media/defender-vulnerability-management/tvm-eos-tags-column.png" lightbox="/defender/media/defender-vulnerability-management/tvm-eos-tags-column.png":::
 
@@ -54,21 +50,21 @@ It's crucial for Security and IT Administrators to work together and ensure that
 
 To view a list of versions that have reached end of support, or end or support soon, and those dates, follow the below steps:
 
-1. A message will appear in the security recommendation flyout for software with versions that have reached end of support, or will reach end of support soon.
+1. A message appears in the security recommendation flyout for software with versions that have reached end of support, or will reach end of support soon.
 
 :::image type="content" alt-text="image of version distribution link." source="/defender/media/defender-vulnerability-management/eos-upcoming-eos.png" lightbox="/defender/media/defender-vulnerability-management/eos-upcoming-eos.png":::
 
 2. Select the **version distribution** link to go to the software drill-down page. There, you can see a filtered list of versions with tags identifying them as end of support, or upcoming end of support.
 
 :::image type="content" alt-text="image of software drilldown page with end of support software." source="/defender/media/defender-vulnerability-management/software-drilldown-eos.png" lightbox="/defender/media/defender-vulnerability-management/software-drilldown-eos.png":::
 
-3. Select one of the versions in the table to open. For example, version 10.0.18362.1. A flyout will appear with the end of support date.
+3. Select one of the versions in the table to open. For example, version 10.0.18362.1. A flyout appears with the end of support date.
 
 :::image type="content" alt-text="image of end of support date." source="/defender/media/defender-vulnerability-management/version-eos-date.png" lightbox="/defender/media/defender-vulnerability-management/version-eos-date.png":::
 
-Once you identify which software and software versions are vulnerable due to their end-of-support status, you must decide whether to update or remove them from your organization. Doing so will lower your organizations exposure to vulnerabilities and advanced persistent threats.
+Once you identify which software and software versions are vulnerable due to their end-of-support status, you must decide whether to update or remove them from your organization. Doing so lowers your organizations exposure to vulnerabilities and advanced persistent threats.
 
-## Related topics
+## Related articles
 
 - [Microsoft Defender Vulnerability Management overview](defender-vulnerability-management.md)
 - [Security recommendations](tvm-security-recommendation.md)
diff --git a/defender-vulnerability-management/tvm-exception.md b/defender-vulnerability-management/tvm-exception.md
@@ -5,7 +5,7 @@ ms.service: defender-vuln-mgmt
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection:
   - m365-security
diff --git a/defender-vulnerability-management/tvm-exposure-score.md b/defender-vulnerability-management/tvm-exposure-score.md
@@ -5,7 +5,7 @@ ms.service: defender-vuln-mgmt
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection: 
   - m365-security
diff --git a/defender-vulnerability-management/tvm-hardware-and-firmware.md b/defender-vulnerability-management/tvm-hardware-and-firmware.md
@@ -5,7 +5,7 @@ ms.service: defender-vuln-mgmt
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection:
   - m365-security
diff --git a/defender-vulnerability-management/tvm-hunt-exposed-devices.md b/defender-vulnerability-management/tvm-hunt-exposed-devices.md
@@ -5,7 +5,7 @@ ms.service: defender-vuln-mgmt
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection: 
   - m365-security
diff --git a/defender-vulnerability-management/tvm-manage-Log4shell-guidance.md b/defender-vulnerability-management/tvm-manage-Log4shell-guidance.md
@@ -7,15 +7,15 @@ f1.keywords:
 ms.author: siosulli
 author: siosulli
 ms.localizationpriority: medium
-manager: dansimp
+manager: deniseb
 audience: ITPro
 ms.collection:
   - M365-security
   - tier2
 ms.custom: admindeeplinkDEFENDER
 ms.topic: conceptual
 search.appverid: met150
-ms.date: 06/29/2022
+ms.date: 06/14/2024
 ---
 
 # Learn how to manage the Log4Shell vulnerability in Microsoft Defender for Endpoint
@@ -25,11 +25,11 @@ The Log4Shell vulnerability is a remote code execution (RCE) vulnerability found
 > [!NOTE]
 > Refer to the blogs [Guidance for preventing, detecting, and hunting for exploitation of the Log4j 2 vulnerability and](https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/) [Microsoft Security Response Center](https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/) for guidance and technical information about the vulnerability and product specific mitigation recommendations to protect your organization.
 
-## Overview of discovery, monitoring and mitigation capabilities
+## Overview of discovery, monitoring, and mitigation capabilities
 
 Defender Vulnerability Management provides you with the following capabilities to help you identify, monitor, and mitigate your organizational exposure to the Log4Shell vulnerability:
 
-- **Discovery**: Detection of exposed devices, both Microsoft Defender for Endpoint onboarded devices as well as devices that have been discovered but aren't yet onboarded, is based on vulnerable software and vulnerable files detected on disk.
+- **Discovery**: Detection of exposed devices, both Microsoft Defender for Endpoint onboarded devices and devices that have been discovered but aren't yet onboarded, is based on vulnerable software and vulnerable files detected on disk.
 - **Threat awareness:** A consolidated view to assess your organizational exposure. This view shows your exposure at the device level and software level, and provides access to details on vulnerable files like, the last time it was seen, the last time it was executed and the last time it was executed with open ports. You can use this information to prioritize your remediation actions. It can take up to 24 hours for data related to exposed devices to appear on the dashboard.
 - **Mitigation options:** Apply mitigation options to help lower your exposure risk.
 - **Advanced hunting:** Use advanced hunting to return details for vulnerable log4j files identified on disk.
@@ -47,19 +47,21 @@ Defender Vulnerability Management provides you with the following capabilities t
 
 Embedded Defender Vulnerability Management capabilities, along with enabling Log4j detection, in the Microsoft Defender portal, will help you discover devices exposed to the Log4Shell vulnerability.
 
-Onboarded devices, are assessed using existing embedded Defender Vulnerability Management capabilities that can discover vulnerable software and files.
+Onboarded devices are assessed using existing embedded Defender Vulnerability Management capabilities that can discover vulnerable software and files.
 
-For detection on discovered but not yet onboarded devices, Log4j detection must be enabled. This will initiate probes in the same way device discovery actively probes your network. This includes probing from multiple onboarded endpoints (Windows 10+ and Windows Server 2019+ devices) and only probing within subnets, to detect devices that are vulnerable and remotely exposed to CVE-2021-44228.
+For detection on discovered but not yet onboarded devices, Log4j detection must be enabled. This initiates probes in the same way device discovery actively probes your network. Probing includes multiple onboarded endpoints (Windows 10+ and Windows Server 2019+ devices) and only probing within subnets to detect devices that are vulnerable and remotely exposed to CVE-2021-44228.
 
 To enable Log4 detection:
 
 1. Go to **Settings** > **Device discovery** > **Discovery setup**.
+
 2. Select **Enable Log4j2 detection (CVE-2021-44228)**.
+
 3. Select **Save**.
 
 :::image type="content" source="media/enable-log4j.png" alt-text="Screenshot of setting to enable log4j2 detection." lightbox="media/enable-log4j.png":::
 
-Running these probes will trigger the standard Log4j flow without causing any harmful impact on either the device being probed or the probing device. The probing itself is done by sending multiple HTTP requests to discovered devices, targeting common web application ports (for example - 80,8000,8080,443,8443) and URLs. The request contains HTTP headers with a JNDI payload that triggers a DNS request from the probed machine.
+Running these probes triggers the standard Log4j flow without causing any harmful impact on either the device being probed or the probing device. The probing itself is done by sending multiple HTTP requests to discovered devices, targeting common web application ports (for example - 80,8000,8080,443,8443) and URLs. The request contains HTTP headers with a JNDI payload that triggers a DNS request from the probed machine.
 
 For example, User-Agent: ${jndi:dns://192.168.1.3:5353/MDEDiscoveryUser-Agent} where 192.168.1.3 is the IP of the probing machine.
 
@@ -83,7 +85,7 @@ Defender Vulnerability Management provides layers of detection to help you disco
 
 This table describes the search capabilities supported platforms and versions:
 
-|Capability|File Type|Windows10+,<br>server2019+|Server 2012R2,<br>server2016|Server 2008R2|Linux + macOS|
+|Capability|File Type|Windows 10+,<br>server2019+|Server 2012R2,<br>server2016|Server 2008R2|Linux + macOS|
 |:---|:---|:---|:---|:---|:---|
 |Search In Memory  | Log4j-core | Yes |Yes<sup>[1]| - | Yes |
 | |Uber-JARs | Yes |Yes<sup>[1]| - | Yes |
@@ -95,7 +97,9 @@ This table describes the search capabilities supported platforms and versions:
 ## Learn about your Log4Shell exposure and mitigation options
 
 1. In the Microsoft Defender portal, go to **Vulnerability management** > **Weaknesses**.  
+
 2. Select **CVE-2021-44228**.
+
 3. Select **Open vulnerability page**.
 
 :::image type="content" source="media/open-vulnerability-page.png" alt-text="Screenshot of vulnerability page on the vulnerability management dashboard." lightbox="media/open-vulnerability-page.png":::
@@ -106,6 +110,7 @@ This table describes the search capabilities supported platforms and versions:
 The log4Shell vulnerability can be mitigated by preventing JNDI lookups on Log4j versions 2.10 - 2.14.1 with default configurations. To create this mitigation action, from the **Threat awareness dashboard**:
 
 1. Select **View vulnerability details**.
+
 2. Select **Mitigation options**.
 
 You can choose to apply the mitigation to all exposed devices or select specific onboarded devices. To complete the process and apply the mitigation on devices, select **Create mitigation action**.
@@ -114,11 +119,11 @@ You can choose to apply the mitigation to all exposed devices or select specific
 
 ### Mitigation status
 
-The mitigation status indicates whether the workaround mitigation to disable JDNI lookups has been applied to the device. You can view the mitigation status for each affected device in the Exposed devices tabs. This can help prioritize mitigation and/or patching of devices based on their mitigation status.
+The mitigation status indicates whether the workaround mitigation to disable JDNI lookups was applied to the device. You can view the mitigation status for each affected device in the Exposed devices tabs. This can help prioritize mitigation and/or patching of devices based on their mitigation status.
 
 :::image type="content" source="media/mitigation-status.png" alt-text="Screenshot of Possible mitigation statuses." lightbox="media/mitigation-status.png":::
 
-The table below lists the potential mitigation statuses:
+The following table lists the potential mitigation statuses:
 
 | Mitigation status | Description |
 |:---|:---|
@@ -139,18 +144,21 @@ In cases where the mitigation needs to be reverted, follow these steps:
 **_For Windows:_**
 
 1. Open an elevated PowerShell window.
+
 2. Run the following command:
 
- ```Powershell
+   ```Powershell
    [Environment]::SetEnvironmentVariable("LOG4J\_FORMAT\_MSG\_NO\_LOOKUPS", $null,[EnvironmentVariableTarget]::Machine)
-```
+   ```
 
 The change will take effect after the device restarts.
 
 **_For Linux:_**
 
 1. Open the file /etc/environment and delete the line LOG4J\_FORMAT\_MSG\_NO\_LOOKUPS=true
+
 2. Delete the file /etc/systemd/system.conf.d/log4j\_disable\_jndi\_lookups.conf
+
 3. Delete the file /etc/systemd/user.conf.d/log4j\_disable\_jndi\_lookups.conf
 
 The change will take effect after the device restarts.
@@ -167,7 +175,7 @@ The change will take effect after the device restarts.
 
 ### Apache Log4j security recommendations
 
-To see active security recommendation related to Apache log4j, select the **Security recommendations** tab from the vulnerability details page. In this example, if you select **Update Apache Log4j** you'll see another flyout with more information:
+To see active security recommendation related to Apache log4j, select the **Security recommendations** tab from the vulnerability details page. In this example, if you select **Update Apache Log4j** you see another flyout with more information:
 
 :::image type="content" source="media/update-apache-log4j.png" alt-text="Screenshot of update apache log4j security recommendation." lightbox="media/update-apache-log4j.png":::
 
@@ -177,7 +185,7 @@ Select **Request remediation** to create a remediation request.
 
 ## Explore the vulnerability in the Microsoft Defender portal
 
-Once exposed devices, files and software are found, relevant information will also be conveyed through the following experiences in the Microsoft Defender portal:
+Once exposed devices, files and software are found, relevant information is conveyed through the following experiences in the Microsoft Defender portal:
 
 ### Software inventory
 
