diff --git a/.openpublishing.redirection.defender-cloud-apps.json b/.openpublishing.redirection.defender-cloud-apps.json index 2184bfbf44..efd6656d36 100644 --- a/.openpublishing.redirection.defender-cloud-apps.json +++ b/.openpublishing.redirection.defender-cloud-apps.json @@ -994,6 +994,11 @@ "source_path": "CloudAppSecurityDocs/what-is-cloud-app-security.md", "redirect_url": "/defender-cloud-apps/what-is-defender-for-cloud-apps", "redirect_document_id": true + }, + { + "source_path": "CloudAppSecurityDocs/tutorial-ueba.md", + "redirect_url": "/defender-cloud-apps/", + "redirect_document_id": true }, { "source_path": "CloudAppSecurityDocs/file-filters.md", diff --git a/CloudAppSecurityDocs/index.yml b/CloudAppSecurityDocs/index.yml index ccb93be7b2..b948f6f501 100644 --- a/CloudAppSecurityDocs/index.yml +++ b/CloudAppSecurityDocs/index.yml @@ -94,16 +94,6 @@ landingContent: - text: Threat response governance actions url: governance-actions.md - - linkListType: how-to-guide - links: - - text: Use in-browser protection with Microsoft Edge - url: in-browser-protection.md - - text: Investigate behaviors by hunting - url: behaviors.md - - text: Investigate anomaly detection alerts - url: investigate-anomaly-alerts.md - - text: Investigate risky users - url: tutorial-ueba.md # Card (optional) - title: Information protection diff --git a/CloudAppSecurityDocs/tutorial-ueba.md b/CloudAppSecurityDocs/tutorial-ueba.md deleted file mode 100644 index ab53229756..0000000000 --- a/CloudAppSecurityDocs/tutorial-ueba.md +++ /dev/null @@ -1,131 +0,0 @@ ---- -title: Investigate risky users -description: This tutorial describes the process to investigate risky users in Microsoft Defender for Cloud Apps, across hybrid environments, by integrating with Microsoft Defender for Identity. -ms.date: 05/19/2024 -ms.topic: tutorial ---- -# Tutorial: Investigate risky users - -> [!IMPORTANT] -> Starting November 2024, **Investigate risky users** support for Microsoft Defender for Cloud Apps is retired. As such, the legacy procedure presented in this article is provided for informational purposes only. -> - -Security operations teams are challenged to monitor user activity, suspicious or otherwise, across all dimensions of the identity attack surface, using multiple security solutions that often aren't connected. While many companies now have hunting teams to proactively identify threats in their environments, knowing what to look for across the vast amount of data can be a challenge. Microsoft Defender for Cloud Apps removes the need to create complex correlation rules, and lets you look for attacks that span across your cloud and on-premises network. - -To help you focus on user identity, Microsoft Defender for Cloud Apps provides user entity behavioral analytics (UEBA) in the cloud. UEBA can be extended to your on-premises environment by integrating with Microsoft Defender for Identity, after which you'll also gain context around user identity from its native integration with Active Directory. - -Whether your trigger is an alert you see in the Defender for Cloud Apps dashboard, or whether you have information from a third-party security service, start your investigation from the Defender for Cloud Apps dashboard to deep dive into risky users. - -In this tutorial, you learn how to use Defender for Cloud Apps to investigate risky users: - -> [!div class="checklist"] -> -> - [Connect to the apps you want to protect](#connect-apps-protect) -> - [Identify top risky users](#identify) -> - [Further investigate users](#investigate) -> - [Protect your organization](#protect) - - -## Understand the investigation priority score - -The **investigation priority score** is a score that Defender for Cloud Apps gives to each user to let you know how risky the user is, relative to other users in your organization. Use the investigation priority score to determine which users to investigate first, detecting both malicious insiders, and external attackers moving laterally in your organizations, without having to rely on standard deterministic detections. - -Every Microsoft Entra user has a dynamic investigation priority score, which is constantly updated based on recent behavior and impact built from data evaluated from Defender for Identity and Defender for Cloud Apps. - -Defender for Cloud Apps builds user profiles for each user, based on analytics that consider security alerts and abnormal activities over time, peer groups, expected user activity, and the effect any specific user might have on the business or company assets. - -Activity that is anomalous to a user's baseline is evaluated and scored. After scoring is complete, Microsoft's proprietary dynamic peer calculations and machine learning are run on the user activities to calculate the investigation priority for each user. - -Understand who the real top risky users are right away by filtering according to **Investigation priority score**, directly verifying each user's business impact, and investigating all related activities – whether they're compromised, exfiltrating data, or acting as insider threats. - -Defender for Cloud Apps uses the following to measure risk: - -- **Alert scoring**: The alert score represents the potential impact of a specific alert on each user. Alert scoring is based on severity, user impact, alert popularity across users, and all entities in the organization. - -- **Activity scoring**: The activity score determines the probability of a specific user performing a specific activity, based on behavioral learning of the user and their peers. Activities identified as the most abnormal receive the highest scores. - -Select the investigation priority score for an alert or an activity to view the evidence that explains how Defender for Cloud Apps scored the activity. - -## Phase 1: Connect to the apps you want to protect - -Connect at least one app to Microsoft Defender for Cloud Apps using the [API connectors](enable-instant-visibility-protection-and-governance-actions-for-your-apps.md). We recommend that you start by connecting [Microsoft 365](./connect-office-365.md). - -Microsoft Entra ID apps are automatically onboarded for Conditional Access app control. - -## Phase 2: Identify top risky users - -To identify who your riskiest users are in Defender for Cloud Apps: - -1. In the Microsoft Defender Portal, under **Assets**, select **Identities**. Sort the table by **Investigation priority**. Then one by one go to their user page to investigate them. -The **investigation priority number**, found next to the user name, is a sum of all the user's risky activities over the last week. - - ![Screenshot of the Top users dashboard.](media/dashboard-top-users.png) - -1. Select the three dots to the right of the user, and choose **View User page**. - - ![Screenshot of a user details page.](media/user-page.png) - -1. Review the information in the user details page to get an overview of the user and see if there are points at which the user performed activities that were unusual for that user or were performed at an unusual time. - - The **User's score compared to the organization** represents which percentile the user is in based on their ranking in your organization - how high they are on the list of users you should investigate, relative to other users in your organization. The number is red if a user is in or above the 90th percentile of risky users across your organization. - -The user details page helps you answer the following questions: - -|Question |Details | -|---------|---------| -|**Who is the user?** | Look for basic details about the user and what the system knows about them, including the user's role in your company and their department.

For example, is the user a DevOps engineer who often performs unusual activities as part of their job? Or is the user a disgruntled employee who just got passed over for a promotion? | -|**Is the user risky?** | What is the employee's [risk score](#risk-score), and is it worth your while investigating them? | -|**What's risk does the user present to your organization?** | Scroll down to investigate each activity and alert related to the user to start understanding the type of risk the user represents.

In the timeline, select each line to drill down deeper into the activity or alert itself. Select the number next to the activity so that you can understand the evidence that influenced the score itself. | -|**What's the risk to other assets in your organization?** | Select the **Lateral movement paths** tab to understand which paths an attacker can use to gain control of other assets in your organization.

For example, even if the user you're investigating has a nonsensitive account, an attacker can use connections to the account to discover and attempt to compromise sensitive accounts in your network.

For more information, see [Use Lateral Movement Paths](/defender-for-identity/investigate-lateral-movement-path). | - - ->[!NOTE] ->While user details pages provide information for devices, resources, and accounts across all activities, the investigation priority score includes the **sum** of all risky activities and alerts over the last 7 days. - -### Reset user score - -If the user was investigated and no suspicion for compromise was found, or if you want to reset the user's investigation priority score for any other reason, so manually as follows: - -1. In the Microsoft Defender Portal, under **Assets**, select **Identities**. - -1. Select the three dots to the right of the investigated user, and then select **Reset investigation priority score**. You can also select **View user page** and then select **Reset investigation priority score** from the three dots in the user details page. - - > [!NOTE] - > Only users with a non-zero investigation priority score can be reset. - - ![Screenshot of the Reset investigation priority score link.](media/reset-investigation-priority-score.png) - -1. In the confirmation window, select **Reset score**. - - ![Screenshot of the Reset score button.](media/reset-score.png) - -## Phase 3: Further investigate users - -Some activities might not be cause for alarm on their own, but might be an indication of a suspicious event when aggregated with other activities. - -When you investigate a user, you want to ask the following questions about the activities and alerts you see: - -- **Is there a business justification for this employee to perform these activities?** For example, if someone from marketing is accessing the code base, or someone from development accesses the finance database, you should follow up with the employee to make sure this was an intentional and justified activity. - -- **Why did this activity receive a high score while others didn't**? Go to the **Activity log** and set the **Investigation priority** to **Is set** to understand which activities are suspicious. - - For example, you can filter based on **Investigation priority** for all activities that occurred in a specific geographical area. Then you can see whether there were other activities that were risky, where the user connected from, and you can easily pivot to other drill downs, such as recent nonanomalous cloud and on-premises activities, to continue your investigation. - -## Phase 4: Protect your organization - -If your investigation leads you to the conclusion that a user is compromised, use the following steps to mitigate the risk. - -- **Contact the user** – Using the user contact information integrated with Defender for Cloud Apps from Active Directory, you can drill down into each alert and activity to resolve the user identity. Make sure the user is familiar with the activities. - -- Directly from the Microsoft Defender Portal, in the **Identities** page, select the three dots by the investigated user and choose whether to require the user to sign in again, suspend the user, or confirm the user as compromised. - -- In the case of a compromised identity, you can ask the user to reset their password, making sure the password meets best practice guidelines for length and complexity. -- If you drill down into an alert and determine that the activity shouldn't have triggered an alert, in the [Activity drawer](activity-filters.md), select the **Send us feedback** link so that we can be sure to fine-tune our alerting system with your organization in mind. -- After you remediate the issue, close the alert. - -## See also - -> [!div class="nextstepaction"] -> [Best practices for protecting your organization](best-practices.md) - -[!INCLUDE [Open support ticket](includes/support.md)] diff --git a/defender-endpoint/defender-antivirus-compatibility-without-mde.md b/defender-endpoint/defender-antivirus-compatibility-without-mde.md index 19f23de9c1..7bf89d1e15 100644 --- a/defender-endpoint/defender-antivirus-compatibility-without-mde.md +++ b/defender-endpoint/defender-antivirus-compatibility-without-mde.md @@ -6,7 +6,7 @@ ms.author: deniseb ms.reviewer: yongrhee ms.service: defender-endpoint ms.topic: conceptual -ms.date: 01/06/2025 +ms.date: 01/23/2025 ms.subservice: ngp search.appverid: met150 ms.localizationpriority: medium @@ -67,12 +67,20 @@ gsv WinDefend, WdBoot, WdFilter, WdNisSvc, WdNisDrv | ft -auto DisplayName, Name **A:** We don't support the manual modification of the start type of the services and drivers for Microsoft Defender Antivirus in Windows images. On Windows clients, the supported method is by your non-Microsoft antivirus registering in Windows Security Center (WSC) api. Or, on Windows Server, you can uninstall the Microsoft Defender Antivirus feature by using roles and features MMC or by running the following PowerShell command (as an administrator): +Windows Server 2019 and newer ```powershell Uninstall-WindowsFeature Windows-Defender ``` +Windows Server 2016 +```powershell + +Uninstall-WindowsFeature Windows-Defender +Uninstall-WindowsFeature Windows-Defender-Gui +``` + **Q:** Can I use Microsoft Defender Antivirus in passive mode without onboarding to Microsoft Defender for Endpoint? **A:** No. Passive mode is a functionality in Microsoft Defender for Endpoint Plan 2. diff --git a/defender-endpoint/indicator-certificates.md b/defender-endpoint/indicator-certificates.md index 1aacac4bf8..419ce579dc 100644 --- a/defender-endpoint/indicator-certificates.md +++ b/defender-endpoint/indicator-certificates.md @@ -15,7 +15,7 @@ ms.collection: ms.topic: conceptual ms.subservice: asr search.appverid: met150 -ms.date: 07/31/2024 +ms.date: 01/23/2025 --- # Create indicators based on certificates @@ -33,19 +33,19 @@ ms.date: 07/31/2024 You can create indicators for certificates. Some common use cases include: -- Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) but need to allow behaviors from signed applications by adding the certificate in the allow list. -- Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Windows Defender AV will prevent file executions (block and remediate) and the Automated Investigation and Remediation behave the same. +- Scenarios when you need to deploy blocking technologies, such as [attack surface reduction rules](attack-surface-reduction.md) but need to allow behaviors from signed applications by adding the certificate in the allowlist. +- Blocking the use of a specific signed application across your organization. By creating an indicator to block the certificate of the application, Microsoft Defender Antivirus prevents file executions (block and remediate), and automated investigation and remediation behaves the same. ## Before you begin -It's important to understand the following requirements prior to creating indicators for certificates: +It's important to understand the following requirements before creating indicators for certificates: -- This feature is available if your organization uses Microsoft Defender Antivirus and Cloud-based protection is enabled. For more information, see [Manage cloud-based protection](/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus). -- The Antimalware client version must be 4.18.1901.x or later. +- This feature is available if your organization uses Microsoft Defender Antivirus (in active mode) and cloud-based protection is enabled. For more information, see [Manage cloud-based protection](/windows/security/threat-protection/microsoft-defender-antivirus/deploy-manage-report-microsoft-defender-antivirus). +- The anti-malware client version must be `4.18.1901.x` or later. - Supported on machines on Windows 10, version 1703 or later, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, and Windows Server 2022. > [!NOTE] - > Windows Server 2016 and Windows Server 2012 R2 will need to be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2016-and-windows-server-2012-r2) for this feature to work. + > Windows Server 2016 and Windows Server 2012 R2 must be onboarded using the instructions in [Onboard Windows servers](configure-server-endpoints.md#windows-server-2016-and-windows-server-2012-r2) for this feature to work. - The virus and threat protection definitions must be up to date. - This feature currently supports entering .CER or .PEM file extensions. @@ -53,8 +53,8 @@ It's important to understand the following requirements prior to creating indica > [!IMPORTANT] > > - A valid leaf certificate is a signing certificate that has a valid certification path and must be chained to the Root Certificate Authority (CA) trusted by Microsoft. Alternatively, a custom (self-signed) certificate can be used as long as it's trusted by the client (Root CA certificate is installed under the Local Machine 'Trusted Root Certification Authorities'). -> - The children or parent of the allow/block certificate IOCs are not included in the allow/block IoC functionality, only leaf certificates are supported. -> - Microsoft signed certificates cannot be blocked. +> - The children or parent of the allow/block certificate IOCs aren't included in the allow/block IoC functionality, only leaf certificates are supported. +> - Microsoft signed certificates can't be blocked. ## Create an indicator for certificates from the settings page: @@ -66,11 +66,12 @@ It's important to understand the following requirements prior to creating indica 2. Select **Add indicator**. 3. Specify the following details: - - Indicator - Specify the entity details and define the expiration of the indicator. - - Action - Specify the action to be taken and provide a description. - - Scope - Define the scope of the machine group. -4. Review the details in the Summary tab, then click **Save**. + - **Indicator**: Specify the entity details and define the expiration of the indicator. + - **Action**: Specify the action to be taken and provide a description. + - **Scope**: Define the scope of the machine group. + +4. Review the details on the **Summary** tab, and then select **Save**. ## Related articles @@ -79,4 +80,5 @@ It's important to understand the following requirements prior to creating indica - [Create indicators for IPs and URLs/domains](indicator-ip-domain.md) - [Manage indicators](indicator-manage.md) - [Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus](defender-endpoint-antivirus-exclusions.md) + [!INCLUDE [Microsoft Defender for Endpoint Tech Community](../includes/defender-mde-techcommunity.md)] diff --git a/defender-endpoint/machines-view-overview.md b/defender-endpoint/machines-view-overview.md index 1ab4cccc4d..f0c9c47c9b 100644 --- a/defender-endpoint/machines-view-overview.md +++ b/defender-endpoint/machines-view-overview.md @@ -13,7 +13,7 @@ ms.collection: - tier2 ms.topic: conceptual search.appverid: met150 -ms.date: 10/30/2024 +ms.date: 01/23/2025 --- # Device inventory @@ -58,6 +58,11 @@ The following image depicts the devices list: You can apply the following filters to limit the list of alerts and get a more focused view. +> [!NOTE] +> If you're not seeing some devices, try clearing your filters. +> +> To clear your filters, navigate to the top-right of the **Devices list** and select the **Filter** icon. On the flight-out pane, select the **Clear all filters** button. + ### Device name During the Microsoft Defender for Endpoint onboarding process, devices onboarded to Defender for Endpoint are gradually populated into the device inventory as they begin to report sensor data. The device inventory is also populated by devices that are discovered in your network through the device discovery process. The device inventory has the following tabs: @@ -129,38 +134,41 @@ The available device properties to use as filters vary based on the device inven |Property|Tabs|Description| |---|---|---| -|**Cloud platforms**||The cloud platform that the device belongs to. The available values are: | -|**Criticality level**||The assigned criticality level of the device (how critical a device is for your organization). The available values are:
For more information, see [Overview of critical asset management](/security-exposure-management/critical-asset-management).| -|**Device category**|**All devices**|The category value assigned to the device. Enter a value or select from the available values: | -|**Device subtype**||The subtype value assigned to the device. Enter a value or select an available value (for example, **Video conference**).| -|**Device type**||The type value assigned to the device. Enter a value or select an available value (for example, **Audio and Video**).| +|**Cloud platforms**|**All devices**, **Computers & mobile**|The cloud platform that the device belongs to. The available values are:
- **Azure**
- **AWS**
- **GCP**
- **Arc**
- **None**| +|**Criticality level**|**All devices**, **Computers & mobile**|The available values are:
- **Very high** (The device is considered a business critical asset)
- **High**
- **Medium**
- **Low**
- **None**. For more information, see [Overview of critical asset management](/security-exposure-management/critical-asset-management).| +|**Device category**|**All devices**|The category value assigned to the device. Enter a value or select from the available values:
- **BMS**
- **Computers and Mobile**
- **IoT**
- **Medical**
- **Network Device**
- **OT**
- **Unknown**| +|**Device subtype**|**All devices**, **IoT/OT**|The subtype value assigned to the device. Enter a value or select an available value (for example, **Video conference**).| +|**Device type**|**All devices**, **IoT/OT**|The type value assigned to the device. Enter a value or select an available value (for example, **Audio and Video**).| |**Device role**|All|The specific role of the device within the organization. For detailed descriptions of each role, see [Predefined classifications](/security-exposure-management/predefined-classification-rules-and-levels).| |**Device value**|All|The assigned value of the device. The available values are **High** and **Low**.| |**Discovery sources**|All|The source reporting on the device.| |**Exclusion state**|All|The available values are **Not excluded** and **Excluded**. For more information, see [Exclude devices](exclude-devices.md).| -|**Exposure level**|All|The exposure level of the device based on pending security recommendations. The available values are: | +|**Exposure level**|All|The exposure level of the device based on pending security recommendations. The available values are:
- **High**
- **Medium**
- **Low**: Devices are less vulnerable to exploitation.
- **No data available**: Possible causes for this value include:
- The device is inactive (stopped reporting for more than 30 days). - The OS on the device isn't supported. For more information, see [minimum requirements for Microsoft Defender for Endpoint](minimum-requirements.md). - The agent software on the device is stale (unlikely).| |**First seen**|All tabs except **Network devices**|How long ago the device was first seen on the network or when it was first reported by the Microsoft Defender for Endpoint sensor. The available values are **Last 7 days** or **Over 7 days ago**.| -|**Group**||Device groups. Enter a value in the box.| -|**Internet facing**||Whether the device is internet facing. The available values are **Yes** and **No**.| -|**Managed by**||How the device is being managed. The available values are: | -|**Mitigation status**||The available values are **Contained** and **Isolated**.| +|**Group**|**All devices**, **Computers & mobile**, **Network devices**|Device groups. Enter a value in the box.| +|**Internet facing**|**Tabs**|**Description**| +|**All devices**|**Computers & mobile**|Whether the device is internet facing. The available values are **Yes** and **No**.| +|**Managed by**|**All devices**, **Computers & mobile**|How the device is being managed. The available values are:
- **Intune**: Microsoft Intune, including co-management with Microsoft Configuration Manager via tenant attach
- **ConfigMgr**: Microsoft Configuration manager
- **MDE**: Microsoft Defender for Endpoint
- **Unknown**: This value is caused by one of the following conditions: An outdated version of Windows, GPO management, Non-Microsoft mobile device management (MDM).| +|**Mitigation status**|**All devices**, **Computers & mobile**|The available values are **Contained** and **Isolated**.| |**Model**|**All devices**|The model of the device. Enter a value or select from the available values.| -|**Onboarding status**||Whether the device is currently onboarded in Defender for Endpoint. Device discovery must be enabled for this filter to appear. The available values are: