You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/linux-exclusions.md
+4-5Lines changed: 4 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ description: Provide and validate exclusions for Microsoft Defender for Endpoint
4
4
ms.service: defender-endpoint
5
5
ms.author: ewalsh
6
6
author: emmwalshh
7
-
ms.reviewer: gopkr, ardeshmukh
7
+
ms.reviewer: ratujdange, ardeshmukh
8
8
ms.localizationpriority: medium
9
9
manager: deniseb
10
10
audience: ITPro
@@ -15,7 +15,7 @@ ms.collection:
15
15
ms.topic: conceptual
16
16
ms.subservice: linux
17
17
search.appverid: met150
18
-
ms.date: 03/28/2025
18
+
ms.date: 06/06/2025
19
19
---
20
20
21
21
# Configure and validate exclusions for Microsoft Defender for Endpoint on Linux
@@ -32,7 +32,7 @@ ms.date: 03/28/2025
32
32
This article provides information on how to define antivirus and global exclusions for Microsoft Defender for Endpoint. Antivirus exclusions apply to on-demand scans, real-time protection (RTP), and behavior monitoring (BM). Global exclusions apply to real-time protection (RTP), behavior monitoring (BM), and endpoint detection and response (EDR), thus stopping all the associated antivirus detections, EDR alerts, and visibility for the excluded item.
33
33
34
34
> [!IMPORTANT]
35
-
> The antivirus exclusions described in this article apply to only antivirus capabilities and not to endpoint detection and response (EDR). Files that you exclude using the antivirus exclusions described in this article can still trigger EDR alerts and other detections. Global exclusions described in this section apply to antivirus **and** endpoint detection and response capabilities, thus stopping all associated antivirus protection, EDR alerts, and detections. Global exclusions are currently in public preview, and are available in Defender for Endpoint version `101.23092.0012` or later, in the Insiders Slow and Production rings. For EDR exclusions, [contact support](/microsoft-365/admin/get-help-support).
35
+
> The antivirus exclusions described in this article apply to only antivirus capabilities, and not to endpoint detection and response (EDR). Files that you exclude by using the antivirus exclusions described in this article can still result in EDR alerts and other detections. Global exclusions described in this section apply to antivirus and EDR capabilities, thus stopping all associated antivirus protection, EDR alerts, and detections. Global exclusions are available in production for Defender for Endpoint on Linux, version `101.23092.0012` or later. For EDR-only exclusions, [contact support](/microsoft-365/admin/get-help-support).
36
36
37
37
You can exclude certain files, folders, processes, and process-opened files from Defender for Endpoint on Linux.
38
38
@@ -87,7 +87,7 @@ Wildcard|Description|Examples|
87
87
88
88
## How to configure the list of exclusions
89
89
90
-
You can configure exclusions using a management Json configuration, Defender for Endpoint security settings management, or the command line.
90
+
You can configure exclusions using a management JSON configuration, Defender for Endpoint security settings management, or the command line.
91
91
92
92
### Using the management console
93
93
@@ -141,7 +141,6 @@ In enterprise environments, exclusions can also be managed through a configurati
141
141
### Using Defender for Endpoint security settings management
142
142
143
143
> [!NOTE]
144
-
> This method is currently in private Preview. To enable this feature, please reach out to [email protected].
145
144
> Make sure to review the prerequisites: [Defender for Endpoint security settings management prerequisites](/mem/intune/protect/mde-security-integration#prerequisites)
146
145
147
146
You can use the Microsoft Intune admin center or the Microsoft Defender portal to manage exclusions as endpoint security policies and assign those policies to Microsoft Entra ID groups. If you're using this method for the first time, make sure to complete the following steps:
Copy file name to clipboardExpand all lines: defender-endpoint/web-content-filtering.md
+5-8Lines changed: 5 additions & 8 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.author: deniseb
6
6
author: denisebmsft
7
7
ms.reviewer: ericlaw
8
8
ms.localizationpriority: medium
9
-
ms.date: 02/18/2025
9
+
ms.date: 06/06/2025
10
10
manager: deniseb
11
11
audience: ITPro
12
12
ms.collection:
@@ -30,7 +30,6 @@ search.appverid: met150
30
30
> [!TIP]
31
31
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://go.microsoft.com/fwlink/p/?linkid=2225630)
32
32
33
-
34
33
## What is web content filtering?
35
34
36
35
Web content filtering is part of the [Web protection](web-protection-overview.md) capabilities in Microsoft Defender for Endpoint and Microsoft Defender for Business. Web content filtering enables your organization to track and regulate access to websites based on their content categories. Many of these websites (even if they're not malicious) might be problematic because of compliance regulations, bandwidth usage, or other concerns.
@@ -104,7 +103,7 @@ Policies can be deployed to block any of the following parent or child categorie
104
103
|**Uncategorized**| - **Newly registered domains**: Sites that are newly registered in the past 30 days and haven't yet been moved to another category.<br/><br/>- **Parked domains**: Sites that have no content or are parked for later use. |
105
104
106
105
> [!NOTE]
107
-
> Uncategorized contains only newly registered domains and parked domains, and does not include all other sites outside of these categories.
106
+
> Uncategorized contains only newly registered domains and parked domains, and does not include all other sites outside of these categories.*Remote proxy sites* are categorized as *Illegal Software*. This classification is based on their inherent ability to route traffic to any destination, which can include access to unwanted, malicious, or illegal content. As with any other blocked site, an organization can choose to use an "allow" indicator to allow access to a site that would otherwise be blocked based on its Web Content Filtering category.
108
107
109
108
### Create a policy
110
109
@@ -151,11 +150,11 @@ To define a custom indicator, follow these steps:
151
150
152
151
### Dispute categories
153
152
154
-
If you encounter a domain that has been incorrectly categorized, you can dispute the category directly from the Microsoft Defender portal.
153
+
If you encounter a domain that has been incorrectly categorized, you can dispute the category directly in the Microsoft Defender portal.
155
154
156
155
To dispute the category of a domain, navigate to **Reports**\>**Web protection**\>**Web content filtering categories details**\>**Domains**. On the domains tab of the Web Content Filtering reports, find the ellipsis beside each of the domains. Hover over the ellipsis and then select **Dispute Category**.
157
156
158
-
A panel opens where you can select the priority and add more details such as the suggested category for recategorization. Once you complete the form, select **Submit**. Our team will review the request within one business day. For manual unblocking, create a [custom allow indicator](indicator-ip-domain.md).
157
+
A panel opens where you can select the priority and add more details such as the suggested category for recategorization. Once you complete the form, select **Submit**. Our team will review the request within one business day. For manual unblocking, create a [custom allow indicator](indicator-ip-domain.md).
159
158
160
159
## Web content filtering cards and details
161
160
@@ -169,7 +168,7 @@ In the first 30 days of using this feature, your organization might not have eno
169
168
170
169
:::image type="content" source="media/web-activity-by-category600.png" alt-text="The web activity by category card" lightbox="media/web-activity-by-category600.png":::
171
170
172
-
### Web content filtering summary card
171
+
### Web content filtering summary card
173
172
174
173
This card displays the distribution of blocked access attempts across the different parent web content categories. Select one of the colored bars to view more information about a specific parent web category.
175
174
@@ -188,9 +187,7 @@ You can access the **Report details** for each card by selecting a table row or
188
187
:::image type="content" source="media/web-protection-report-details.png" alt-text="The web protection report details" lightbox="media/web-protection-report-details.png":::
189
188
190
189
-**Web categories**: Lists the web content categories that have had access attempts in your organization. Select a specific category to open a summary flyout.
191
-
192
190
-**Domains**: Lists the web domains that have been accessed or blocked in your organization.
193
-
194
191
-**Device groups**: Lists all the device groups that have generated web activity in your organization
195
192
196
193
Use the time range filter at the top left of the page to select a time period. You can also filter the information or customize the columns. Select a row to open a flyout pane with even more information about the selected item.
![m365-skilling-repo-management[bot]](https://avatars.githubusercontent.com/in/1161012?v=4&size=40){kind=avatar}
0 commit comments