Forum Discussion
Haim Goldshtein
Microsoft
MicrosoftPushing custom Indicator of Compromise (IoCs) to Microsoft Defender ATP
Submit your own IOCs to Microsoft Defender ATP to create alerts and perform remediation actions.
5 Minutes
Low complexity
Many organizations maintain internal lists of ...
Haim Goldshtein Hi - the option is still not available - and I do not have the possibility to block custom URL or IP addresses. Any status on this issue ???
Andre FabbriMicrosoft
MicrosoftHi Ronnie Lykke Madsen. Blocking IPs, domains, or URLs is currently available on limited preview only. This requires sending your custom list to network protection to be enforced which is an option that will be generally available soon. As it is not yet generally available, when Automated investigations finds this indicator during an investigation it will.