Forum Discussion

Haim Goldshtein's avatar
Haim Goldshtein
Icon for Microsoft rankMicrosoft
May 05, 2019

Pushing custom Indicator of Compromise (IoCs) to Microsoft Defender ATP

Submit your own IOCs to Microsoft Defender ATP to create alerts and perform remediation actions. 5 Minutes  Low complexity      Many organizations maintain internal lists of ...
Dan Michelson's avatar
Dan Michelson
Icon for Microsoft rankMicrosoft
Jun 03, 2019

DannyC_Gamma 

 

Please check first how many items you are pushing.

 

Currently, there is a limit of 5K items in the list. If the batch you are trying to push is larger than the remaining room in the list, it may fail.

 

 

DannyC_Gamma's avatar
DannyC_Gamma
Brass Contributor
Jun 03, 2019

Dan Michelson 

 

I was more referring to the message that I'd crudely highlighted in the screen grab

 

Blocking IP addresses, domains, or URLs is not yet available for this tenant.

 

I'm sure I've had the ability to do these previously - at present, I can only block hashes. Is the URL/Domain blocking functionality going to be (re)made available soon?

 

Thanks

Danny

 

 

  • Haim Goldshtein's avatar
    Haim Goldshtein
    Icon for Microsoft rankMicrosoft
    Jun 04, 2019

    DannyC_Gamma 

    Hi Danny,

     

    Blocking IPs, URL & Domains are features you need to turn on for you tenant.

    if the feature is turned off, when going to  Indicators page-> IP TAB   you will see the following warning message:

     

    to turn on the feature, you should go to Advance Feature tab, and turn Network Protection on:

     

    Thank you for bring that up, I'll add that procedure to the blog.

    Please check it and let me know if it works for you.

     

    Thanks,

    Haim

     

    • Ronnie Lykke Madsen's avatar
      Ronnie Lykke Madsen
      Copper Contributor
      Aug 12, 2019

      Haim Goldshtein Hi - the option is still not available - and I do not have the possibility to block custom URL or IP addresses. Any status on this issue ???

    • jamrobot's avatar
      jamrobot
      Brass Contributor
      Jul 03, 2019

      Haim Goldshtein 

       

      Hi Haim,

       

      My message is sightly different would you be able to provide some context. We dont have Azure ATP enabled (yet), everything else is working as expected.

      Is this function dependent on Azure ATP by any chance

      ?  

      Many Thanks

      Mornay

       

    • DannyC_Gamma's avatar
      DannyC_Gamma
      Brass Contributor
      Jun 04, 2019

      Haim Goldshtein 

       

      Hey Haim

       

      I don't see that option in Advanced features - is that a preview feature (I do have those enabled)

       

      Thanks

      Danny

      • Dan Michelson's avatar
        Dan Michelson
        Icon for Microsoft rankMicrosoft
        Jun 04, 2019

        DannyC_Gamma This is something in preview right now. Stay tuned as it is coming.

Resources