Blog Post

Microsoft Defender for Endpoint Blog
3 MIN READ

WDATP September 2018 preview features are out!

Raviv Tamir's avatar
Raviv Tamir
Icon for Microsoft rankMicrosoft
Sep 05, 2018
  Listening to customer feedback and improving the day to day life of security operation teams are one of the core pillars of how we build the Windows Defender ATP service and how we operate across...
Updated Sep 05, 2018
Version 2.0
Danny Kadyshevitch's avatar
Danny Kadyshevitch
Iron Contributor
Sep 16, 2018
Yes, there should be created a new continuous report which appears separately from the data that is coming in using the on-prem log collector. The name of the continuous report is 'Win10 Endpoint Users'.
Raf Cox's avatar
Raf Cox
Copper Contributor
Oct 04, 2018

Hi,

 

small question on this: how much time does it take to propagate data from the client up to cloudApp Security through WD ATP? We upgraded a couple of machines to 1809 and the "Windows 10 Endpoint Users" report appears fine a few hour later, but there it seems to take quite some time to have data synchronized to CAS...

 

thanks!

Raf

  • Danny Kadyshevitch's avatar
    Danny Kadyshevitch
    Iron Contributor
    Oct 04, 2018
    Hi Raf,

    It takes up to 2 hours for the data to come into MCAS.
    An overall data aggregations (the stats you are seeing in the Cloud Discovery dashboard) are performed 2 to 4 times a day, so this can take a little longer to be updated.

    Other Discovery tables (i.e. discovered apps, users, machines, IP addresses) are updated every 2 hours.

    Thanks,
    Danny.
    • Raf Cox's avatar
      Raf Cox
      Copper Contributor
      Oct 05, 2018

      Thanks Danny!

      Is it possible that the upload/download numbers are not quite correct yet? With 2 computers that are actively used and where I e.g. synced > 2GB data over onedrive, the total after 2 days is 35MB for all traffic ... 

      tx

      Raf

      • Stefan Schörling's avatar
        Stefan Schörling
        MVP
        Oct 05, 2018

        I would have to agree data volumes are not reflecting in a good way here either.  I have for an example downloaded quite allot of GBs from youtube and azure for Ignite sessions and they are not reflecting either.