Forum Discussion

jamrobot's avatar
jamrobot
Brass Contributor
Jun 30, 2019

How to use "OR" for conditions in Machine groups?

I am trying to figure out how to use a single expression for using multiple naming conventions to be included in a machine group.

 

The conditions seems to lack the "OR" function and in my case I am seeking to use something simple as:

Machine name starts (abc, abd, ade) or Machine name starts (`abc` or `abd`)

 

I currently have several machine groups with the same name with different rules that works but its a messy option. Updating the rules condition block to accommodate "and "or" and allow each line item to be customized to match the required condition would be far more user friendly.

 

Thanks

 

 

1 Reply

  • Mattias Borg's avatar
    Mattias Borg
    Brass Contributor

    Hi,

     

    Another solution to your challenge would be using tags and then manage the tags outside ATP (registry entry)
    more information here: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/machine-tags

     

    best regards

     

    Mattias Borg

     

Resources