Files

 public

/

defender-xdr

/

Copy path

Directory actions

More options

Directory actions

More options

Latest commit

diannegali

Merge branch 'main' into diannegali-updaterbacpages

Jan 13, 2025

6643e1f · Jan 13, 2025

History

History

This branch is 3670 commits behind MicrosoftDocs/defender-docs:public.

/

defender-xdr

/

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
breadcrumb		breadcrumb
media		media
TOC.yml		TOC.yml
access-den-graph-api.md		access-den-graph-api.md
activate-defender-rbac.md		activate-defender-rbac.md
additional-information-xdr.md		additional-information-xdr.md
advanced-hunting-aadsignineventsbeta-table.md		advanced-hunting-aadsignineventsbeta-table.md
advanced-hunting-aadspnsignineventsbeta-table.md		advanced-hunting-aadspnsignineventsbeta-table.md
advanced-hunting-alertevidence-table.md		advanced-hunting-alertevidence-table.md
advanced-hunting-alertinfo-table.md		advanced-hunting-alertinfo-table.md
advanced-hunting-assignedipaddresses-function.md		advanced-hunting-assignedipaddresses-function.md
advanced-hunting-behaviorentities-table.md		advanced-hunting-behaviorentities-table.md
advanced-hunting-behaviorinfo-table.md		advanced-hunting-behaviorinfo-table.md
advanced-hunting-best-practices.md		advanced-hunting-best-practices.md
advanced-hunting-cloudappevents-table.md		advanced-hunting-cloudappevents-table.md
advanced-hunting-cloudauditevents-table.md		advanced-hunting-cloudauditevents-table.md
advanced-hunting-cloudprocessevents-table.md		advanced-hunting-cloudprocessevents-table.md
advanced-hunting-custom-functions.md		advanced-hunting-custom-functions.md
advanced-hunting-defender-results.md		advanced-hunting-defender-results.md
advanced-hunting-defender-use-custom-rules.md		advanced-hunting-defender-use-custom-rules.md
advanced-hunting-devicebaselinecomplianceassessment-table.md		advanced-hunting-devicebaselinecomplianceassessment-table.md
advanced-hunting-devicebaselinecomplianceassessmentkb-table.md		advanced-hunting-devicebaselinecomplianceassessmentkb-table.md
advanced-hunting-devicebaselinecomplianceprofiles-table.md		advanced-hunting-devicebaselinecomplianceprofiles-table.md
advanced-hunting-deviceevents-table.md		advanced-hunting-deviceevents-table.md
advanced-hunting-devicefilecertificateinfo-table.md		advanced-hunting-devicefilecertificateinfo-table.md
advanced-hunting-devicefileevents-table.md		advanced-hunting-devicefileevents-table.md
advanced-hunting-devicefromip-function.md		advanced-hunting-devicefromip-function.md
advanced-hunting-deviceimageloadevents-table.md		advanced-hunting-deviceimageloadevents-table.md
advanced-hunting-deviceinfo-table.md		advanced-hunting-deviceinfo-table.md
advanced-hunting-devicelogonevents-table.md		advanced-hunting-devicelogonevents-table.md
advanced-hunting-devicenetworkevents-table.md		advanced-hunting-devicenetworkevents-table.md
advanced-hunting-devicenetworkinfo-table.md		advanced-hunting-devicenetworkinfo-table.md
advanced-hunting-deviceprocessevents-table.md		advanced-hunting-deviceprocessevents-table.md
advanced-hunting-deviceregistryevents-table.md		advanced-hunting-deviceregistryevents-table.md
advanced-hunting-devicetvmbrowserextensions-table.md		advanced-hunting-devicetvmbrowserextensions-table.md
advanced-hunting-devicetvmbrowserextensionskb-table.md		advanced-hunting-devicetvmbrowserextensionskb-table.md
advanced-hunting-devicetvmcertificateinfo-table.md		advanced-hunting-devicetvmcertificateinfo-table.md
advanced-hunting-devicetvmhardwarefirmware-table.md		advanced-hunting-devicetvmhardwarefirmware-table.md
advanced-hunting-devicetvminfogathering-table.md		advanced-hunting-devicetvminfogathering-table.md
advanced-hunting-devicetvminfogatheringkb-table.md		advanced-hunting-devicetvminfogatheringkb-table.md
advanced-hunting-devicetvmsecureconfigurationassessment-table.md		advanced-hunting-devicetvmsecureconfigurationassessment-table.md
advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md		advanced-hunting-devicetvmsecureconfigurationassessmentkb-table.md
advanced-hunting-devicetvmsoftwareevidencebeta-table.md		advanced-hunting-devicetvmsoftwareevidencebeta-table.md
advanced-hunting-devicetvmsoftwareinventory-table.md		advanced-hunting-devicetvmsoftwareinventory-table.md
advanced-hunting-devicetvmsoftwarevulnerabilities-table.md		advanced-hunting-devicetvmsoftwarevulnerabilities-table.md
advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md		advanced-hunting-devicetvmsoftwarevulnerabilitieskb-table.md
advanced-hunting-email-threats.md		advanced-hunting-email-threats.md
advanced-hunting-emailattachmentinfo-table.md		advanced-hunting-emailattachmentinfo-table.md
advanced-hunting-emailevents-table.md		advanced-hunting-emailevents-table.md
advanced-hunting-emailpostdeliveryevents-table.md		advanced-hunting-emailpostdeliveryevents-table.md
advanced-hunting-emailurlinfo-table.md		advanced-hunting-emailurlinfo-table.md
advanced-hunting-errors.md		advanced-hunting-errors.md
advanced-hunting-expert-training.md		advanced-hunting-expert-training.md
advanced-hunting-exposuregraphedges-table.md		advanced-hunting-exposuregraphedges-table.md
advanced-hunting-exposuregraphnodes-table.md		advanced-hunting-exposuregraphnodes-table.md
advanced-hunting-extend-data.md		advanced-hunting-extend-data.md
advanced-hunting-fileprofile-function.md		advanced-hunting-fileprofile-function.md
advanced-hunting-find-ransomware.md		advanced-hunting-find-ransomware.md
advanced-hunting-go-hunt.md		advanced-hunting-go-hunt.md
advanced-hunting-identitydirectoryevents-table.md		advanced-hunting-identitydirectoryevents-table.md
advanced-hunting-identityinfo-table.md		advanced-hunting-identityinfo-table.md
advanced-hunting-identitylogonevents-table.md		advanced-hunting-identitylogonevents-table.md
advanced-hunting-identityqueryevents-table.md		advanced-hunting-identityqueryevents-table.md
advanced-hunting-limits.md		advanced-hunting-limits.md
advanced-hunting-link-to-incident.md		advanced-hunting-link-to-incident.md
advanced-hunting-microsoft-defender.md		advanced-hunting-microsoft-defender.md
advanced-hunting-migrate-from-mde.md		advanced-hunting-migrate-from-mde.md
advanced-hunting-modes.md		advanced-hunting-modes.md
advanced-hunting-overview.md		advanced-hunting-overview.md
advanced-hunting-query-builder-details.md		advanced-hunting-query-builder-details.md
advanced-hunting-query-builder-results.md		advanced-hunting-query-builder-results.md
advanced-hunting-query-builder.md		advanced-hunting-query-builder.md
advanced-hunting-query-emails-devices.md		advanced-hunting-query-emails-devices.md
advanced-hunting-query-history.md		advanced-hunting-query-history.md
advanced-hunting-query-language.md		advanced-hunting-query-language.md
advanced-hunting-query-results.md		advanced-hunting-query-results.md
advanced-hunting-schema-changes.md		advanced-hunting-schema-changes.md
advanced-hunting-schema-tables.md		advanced-hunting-schema-tables.md
advanced-hunting-security-copilot.md		advanced-hunting-security-copilot.md
advanced-hunting-seenby-function.md		advanced-hunting-seenby-function.md
advanced-hunting-shared-queries.md		advanced-hunting-shared-queries.md
advanced-hunting-take-action.md		advanced-hunting-take-action.md
advanced-hunting-urlclickevents-table.md		advanced-hunting-urlclickevents-table.md
alert-classification-malicious-exchange-connectors.md		alert-classification-malicious-exchange-connectors.md
alert-classification-password-spray-attack.md		alert-classification-password-spray-attack.md
alert-classification-playbooks.md		alert-classification-playbooks.md
alert-classification-suspicious-ip-password-spray.md		alert-classification-suspicious-ip-password-spray.md
alert-grading-playbook-email-forwarding.md		alert-grading-playbook-email-forwarding.md
alert-grading-playbook-inbox-forwarding-rules.md		alert-grading-playbook-inbox-forwarding-rules.md
alert-grading-playbook-inbox-manipulation-rules.md		alert-grading-playbook-inbox-manipulation-rules.md
alerts-incidents-correlation.md		alerts-incidents-correlation.md
api-access.md		api-access.md
api-advanced-hunting.md		api-advanced-hunting.md
api-articles.md		api-articles.md
api-create-app-user-context.md		api-create-app-user-context.md
api-create-app-web.md		api-create-app-web.md
api-error-codes.md		api-error-codes.md
api-get-incident.md		api-get-incident.md
api-hello-world.md		api-hello-world.md
api-incident.md		api-incident.md
api-list-incidents.md		api-list-incidents.md
api-overview.md		api-overview.md
api-partner-access.md		api-partner-access.md
api-supported.md		api-supported.md
api-update-incidents.md		api-update-incidents.md
auditing.md		auditing.md
autoad-results.md		autoad-results.md
automatic-attack-disruption.md		automatic-attack-disruption.md
before-you-begin-defender-experts.md		before-you-begin-defender-experts.md
before-you-begin-xdr.md		before-you-begin-xdr.md
communicate-defender-experts-xdr.md		communicate-defender-experts-xdr.md
compare-rbac-roles.md		compare-rbac-roles.md
configure-asset-rules.md		configure-asset-rules.md
configure-attack-disruption.md		configure-attack-disruption.md
configure-deception.md		configure-deception.md
configure-email-notifications.md		configure-email-notifications.md
configure-event-hub.md		configure-event-hub.md
configure-siem-defender.md		configure-siem-defender.md
copilot-in-defender-device-summary.md		copilot-in-defender-device-summary.md
copilot-in-defender-file-analysis.md		copilot-in-defender-file-analysis.md
create-custom-rbac-roles.md		create-custom-rbac-roles.md
criteria.md		criteria.md
custom-detection-rules.md		custom-detection-rules.md
custom-detections-overview.md		custom-detections-overview.md
custom-permissions-details.md		custom-permissions-details.md
custom-roles.md		custom-roles.md
data-privacy.md		data-privacy.md
deception-overview.md		deception-overview.md
defender-experts-for-hunting.md		defender-experts-for-hunting.md
defender-experts-report.md		defender-experts-report.md
defender-experts-scoped-coverage.md		defender-experts-scoped-coverage.md
defender-threat-intelligence.md		defender-threat-intelligence.md
defender-xdr-custom-reports.md		defender-xdr-custom-reports.md
deploy-configure-m365-defender.md		deploy-configure-m365-defender.md
deploy-supported-services.md		deploy-supported-services.md
developer-faq.yml		developer-faq.yml
dex-xdr-overview.md		dex-xdr-overview.md
dex-xdr-permissions.md		dex-xdr-permissions.md
dlp-investigate-alerts-defender.md		dlp-investigate-alerts-defender.md
dlp-investigate-alerts-sentinel.md		dlp-investigate-alerts-sentinel.md
docfx.json		docfx.json
edit-delete-rbac-roles.md		edit-delete-rbac-roles.md
entity-page-device.md		entity-page-device.md
entity-page-ip.md		entity-page-ip.md
experts-on-demand.md		experts-on-demand.md
export-incidents-queue.md		export-incidents-queue.md
faq-incident-notifications-xdr.md		faq-incident-notifications-xdr.md
faq-managed-response.md		faq-managed-response.md
feedback.md		feedback.md
fetch-incidents.md		fetch-incidents.md
first-incident-path-identity.md		first-incident-path-identity.md
first-incident-path-phishing.md		first-incident-path-phishing.md
frequently-asked-questions.md		frequently-asked-questions.md
get-started-xdr.md		get-started-xdr.md
get-started.md		get-started.md
image-1.png		image-1.png
image.png		image.png
import-rbac-roles.md		import-rbac-roles.md
incident-queue.md		incident-queue.md
incident-response-overview.md		incident-response-overview.md
incidents-overview.md		incidents-overview.md
index.yml		index.yml
integrate-microsoft-365-defender-secops-plan.md		integrate-microsoft-365-defender-secops-plan.md
integrate-microsoft-365-defender-secops-readiness.md		integrate-microsoft-365-defender-secops-readiness.md
integrate-microsoft-365-defender-secops-roles.md		integrate-microsoft-365-defender-secops-roles.md
integrate-microsoft-365-defender-secops-services.md		integrate-microsoft-365-defender-secops-services.md
integrate-microsoft-365-defender-secops-tasks.md		integrate-microsoft-365-defender-secops-tasks.md
integrate-microsoft-365-defender-secops-use-cases.md		integrate-microsoft-365-defender-secops-use-cases.md
integrate-microsoft-365-defender-secops.md		integrate-microsoft-365-defender-secops.md
investigate-alerts.md		investigate-alerts.md
investigate-incidents.md		investigate-incidents.md
investigate-respond-container-threats.md		investigate-respond-container-threats.md
investigate-users.md		investigate-users.md
m365d-action-center.md		m365d-action-center.md
m365d-autoir-actions.md		m365d-autoir-actions.md
m365d-autoir-report-false-positives-negatives.md		m365d-autoir-report-false-positives-negatives.md
m365d-autoir-results.md		m365d-autoir-results.md
m365d-autoir.md		m365d-autoir.md
m365d-configure-auto-investigation-response.md		m365d-configure-auto-investigation-response.md
m365d-enable-faq.md		m365d-enable-faq.md
m365d-enable.md		m365d-enable.md
m365d-notifications-incidents.md		m365d-notifications-incidents.md
m365d-permissions.md		m365d-permissions.md
m365d-remediation-actions.md		m365d-remediation-actions.md
m365d-response-actions-notifications.md		m365d-response-actions-notifications.md
m365d-threat-analytics-notifications.md		m365d-threat-analytics-notifications.md
m365d-time-zone.md		m365d-time-zone.md
malware-naming.md		malware-naming.md
manage-incidents.md		manage-incidents.md
manage-rbac.md		manage-rbac.md
managed-detection-and-response-xdr.md		managed-detection-and-response-xdr.md
microsoft-365-defender-integration-with-azure-sentinel.md		microsoft-365-defender-integration-with-azure-sentinel.md
microsoft-365-defender-portal.md		microsoft-365-defender-portal.md
microsoft-365-defender-train-security-staff.md		microsoft-365-defender-train-security-staff.md
microsoft-365-defender.md		microsoft-365-defender.md
microsoft-365-security-center-defender-cloud.md		microsoft-365-security-center-defender-cloud.md
microsoft-365-security-center-mde.md		microsoft-365-security-center-mde.md
microsoft-365-security-center-mdo.md		microsoft-365-security-center-mdo.md
microsoft-secure-score-history-metrics-trends.md		microsoft-secure-score-history-metrics-trends.md
microsoft-secure-score-improvement-actions.md		microsoft-secure-score-improvement-actions.md
microsoft-secure-score-whats-new.md		microsoft-secure-score-whats-new.md
microsoft-secure-score.md		microsoft-secure-score.md
microsoft-sentinel-onboard.md		microsoft-sentinel-onboard.md
microsoft-threat-actor-naming.md		microsoft-threat-actor-naming.md
microsoft-xdr-auditing.md		microsoft-xdr-auditing.md
mssp-access.md		mssp-access.md
mto-advanced-hunting.md		mto-advanced-hunting.md
mto-dashboard.md		mto-dashboard.md
mto-endpoint-security-policy.md		mto-endpoint-security-policy.md
mto-incidents-alerts.md		mto-incidents-alerts.md
mto-overview.md		mto-overview.md
mto-requirements.md		mto-requirements.md
mto-tenant-devices.md		mto-tenant-devices.md
mto-tenantgroups.md		mto-tenantgroups.md
mto-tenants.md		mto-tenants.md
onboarding-defender-experts-for-hunting.md		onboarding-defender-experts-for-hunting.md
pilot-deploy-defender-cloud-apps.md		pilot-deploy-defender-cloud-apps.md
pilot-deploy-defender-endpoint.md		pilot-deploy-defender-endpoint.md
pilot-deploy-defender-identity.md		pilot-deploy-defender-identity.md
pilot-deploy-defender-office-365.md		pilot-deploy-defender-office-365.md
pilot-deploy-investigate-respond.md		pilot-deploy-investigate-respond.md
pilot-deploy-overview.md		pilot-deploy-overview.md
playbook-detecting-ransomware-m365-defender.md		playbook-detecting-ransomware-m365-defender.md
playbook-responding-ransomware-m365-defender.md		playbook-responding-ransomware-m365-defender.md
portals.md		portals.md
prerequisites.md		prerequisites.md
preview.md		preview.md
reports-xdr.md		reports-xdr.md
respond-first-incident-365-defender.md		respond-first-incident-365-defender.md
respond-first-incident-analyze.md		respond-first-incident-analyze.md
respond-first-incident-remediate.md		respond-first-incident-remediate.md
secure-score-data-storage-privacy.md		secure-score-data-storage-privacy.md
security-copilot-defender-identity-summary.md		security-copilot-defender-identity-summary.md
security-copilot-in-microsoft-365-defender.md		security-copilot-in-microsoft-365-defender.md
security-copilot-m365d-create-incident-report.md		security-copilot-m365d-create-incident-report.md
security-copilot-m365d-guided-response.md		security-copilot-m365d-guided-response.md
security-copilot-m365d-incident-summary.md		security-copilot-m365d-incident-summary.md
security-copilot-m365d-script-analysis.md		security-copilot-m365d-script-analysis.md
session-cookie-theft-alert.md		session-cookie-theft-alert.md
setup-m365deval.md		setup-m365deval.md
start-using-mdex-xdr.md		start-using-mdex-xdr.md
streaming-api-event-hub.md		streaming-api-event-hub.md
streaming-api-storage.md		streaming-api-storage.md
streaming-api.md		streaming-api.md
submission-guide.md		submission-guide.md
supported-event-types.md		supported-event-types.md
teams-restrictions-dexapp.md		teams-restrictions-dexapp.md
threat-analytics-analyst-reports.md		threat-analytics-analyst-reports.md
threat-analytics.md		threat-analytics.md
top-scoring-industry-tests.md		top-scoring-industry-tests.md
troubleshoot.md		troubleshoot.md
unlink-alert-from-incident.md		unlink-alert-from-incident.md
usgov.md		usgov.md
virus-initiative-criteria.md		virus-initiative-criteria.md
whats-new-in-microsoft-defender-urbac.md		whats-new-in-microsoft-defender-urbac.md
whats-new.md		whats-new.md
zero-trust-with-microsoft-365-defender.md		zero-trust-with-microsoft-365-defender.md
View all files