Home
%3CLINGO-SUB%20id%3D%22lingo-sub-185877%22%20slang%3D%22en-US%22%3EAnnouncing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-185877%22%20slang%3D%22en-US%22%3E%3CP%3EOur%20mission%20is%20to%20empower%20every%20person%20and%20every%20organization%20on%20the%20planet%20to%20achieve%20more.%20A%20trusted%20and%20secure%20computing%20environment%20is%20a%20critical%20component%20of%20our%20approach.%20When%20we%20introduced%20Windows%20Defender%20Advanced%20Threat%20Protection%20(ATP)%20more%20than%20two%20years%20ago%2C%20our%20target%20was%20to%20leverage%20the%20power%20of%20the%20cloud%2C%20built-in%20Windows%20security%20capabilities%20and%20artificial%20intelligence%20(AI)%20to%20enable%20our%20customers%E2%80%99%20to%20stay%20one%20step%20ahead%20of%20the%20cyber-challenges.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CBLOCKQUOTE%3E%0A%3CP%3EWith%20the%20next%20update%20to%20Windows%2010%2C%20we%20are%20further%20expanding%20Windows%20Defender%20ATP%20to%20provide%20richer%20capabilities%20for%20businesses%20to%20improve%20their%20security%20posture%20and%20solve%20security%20incidents%20more%20quickly%20and%20efficiently.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ELet%E2%80%99s%20dive%20in%20into%20these%20new%20capabilities%20in%20more%20detail.%3C%2FP%3E%3CCITE%3E%3C%2FCITE%3E%3C%2FBLOCKQUOTE%3E%0A%3CH1%20id%3D%22toc-hId-1820010539%22%20id%3D%22toc-hId-1899463912%22%3E%3CSTRONG%3EAutomatic%20investigation%20and%20remediation%20of%20threats%3C%2FSTRONG%3E%3C%2FH1%3E%0A%3CP%3ENow%20you%20can%20go%20from%20alert%20to%20remediation%20in%20minutes%E2%80%94at%20scale!%20Automated%20investigation%20and%20response%20dramatically%20reduces%20the%20volume%20of%20alerts%20that%20security%20analysts%20need%20to%20handle.%20It%20uses%20artificial%20intelligence%20to%20investigate%20alerts%2C%20exercise%20in%20minutes%20sophisticated%20playbooks%20mimicking%20the%20best%20human%20analysts%E2%80%99%20decisions%20and%20forensic%20processes%2C%20determine%20if%20a%20threat%20is%20active%2C%20its%20origin%20and%20then%20decide%20the%20appropriate%20steps%20to%20automatically%20remediate%20it.%20When%20Windows%20Defender%20ATP%20identifies%20that%20the%20incident%20includes%20multiple%20machines%2C%20it%20automatically%20expands%20the%20investigation%20across%20the%20entire%20scope%20of%20breach%20and%20performs%20the%20required%20actions%20on%20those%20in%20parallel.%20Threat%20investigation%20and%20remediation%20decisions%20can%20be%20taken%20automatically%20by%20Windows%20Defender%20ATP%20based%20on%20extensive%20historical%20data%20collected%2C%20stored%20and%20analyzed%20in%20our%20cloud%20(%E2%80%9Ctime%20travel%E2%80%9D).%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3C%2FP%3E%3CDIV%20class%3D%22video-embed-center%20video-embed%22%3E%3CIFRAME%20class%3D%22embedly-embed%22%20src%3D%22https%3A%2F%2Fcdn.embedly.com%2Fwidgets%2Fmedia.html%3Fsrc%3Dhttps%253A%252F%252Fwww.youtube.com%252Fembed%252FrqxRXcn_d-g%253Ffeature%253Doembed%26amp%3Burl%3Dhttp%253A%252F%252Fwww.youtube.com%252Fwatch%253Fv%253DrqxRXcn_d-g%26amp%3Bimage%3Dhttps%253A%252F%252Fi.ytimg.com%252Fvi%252FrqxRXcn_d-g%252Fhqdefault.jpg%26amp%3Bkey%3Dfad07bfa4bd747d3bdea27e17b533c0e%26amp%3Btype%3Dtext%252Fhtml%26amp%3Bschema%3Dyoutube%22%20width%3D%22600%22%20height%3D%22337%22%20scrolling%3D%22no%22%20frameborder%3D%220%22%20allow%3D%22autoplay%3B%20fullscreen%22%20allowfullscreen%3D%22true%22%20title%3D%22Video%22%3E%3C%2FIFRAME%3E%3C%2FDIV%3E%3CP%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWith%20the%20new%20security%20automation%20capabilities%2C%20Windows%20Defender%20ATP%20can%20now%20prevent%20and%20find%20breaches%3B%20it%20can%20fix%20them.%20These%20actions%20can%20be%20set%20to%20run%20automatically%20for%20simple%2C%20clear-cut%20cases%2C%20or%20can%20be%20reviewed%20prior%20to%20execution.%20Either%20way%2C%20time%20and%20effort%20are%20saved%20by%20SecOps%2C%20enabling%20those%20talented%20professionals%20to%20focus%20on%20more%20complex%20and%20strategic%20problems.%20In%20addition%2C%20the%20organization%E2%80%99s%20security%20team%20moves%20faster%2C%20thereby%20better%20executing%20on%20their%20critical%20mission.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH1%20id%3D%22toc-hId--732146422%22%20id%3D%22toc-hId--652693049%22%3E%3CSTRONG%3EMicrosoft%20365%20conditional%20access%20based%20on%20device-risk%3C%2FSTRONG%3E%3C%2FH1%3E%0A%3CP%3EIf%20a%20threat%20gets%20detected%2C%20the%20next%20logical%20step%20would%20be%20to%20block%20access%20to%20your%20sensitive%20business%20data%20from%20the%20device%20while%20the%20threat%20is%20still%20active.%20This%20is%20now%20possible!%20We%20worked%20with%20our%20colleagues%20from%20the%20Microsoft%20Intune%20and%20Azure%20Active%20Directory%20(AAD)%20team%2C%20to%20enrich%20one%20of%20our%20most%20popular%20security%20scenarios%20of%20%3CEM%3EMicrosoft%20365%20conditional%20access%3C%2FEM%3E.%3C%2FP%3E%0A%3CP%3EAvailable%20in%20the%20next%20update%2C%20the%20%3CSTRONG%3Edynamic%20machine%20risk%3C%2FSTRONG%3E%20level%20can%20be%20used%20to%20define%20%3CA%20href%3D%22https%3A%2F%2Fcloudblogs.microsoft.com%2Fenterprisemobility%2F2018%2F04%2F18%2Fenhancing-conditional-access-with-machine-risk-data-from-windows-defender-advanced-threat-protection%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Ecorporate%20access%20policies%20and%20prevent%20risk%20to%20corporate%20data%3C%2FA%3E.%3C%2FP%3E%0A%3CP%3EAs%20an%20example%2C%20if%20a%20bad%20threat%20lands%20on%20your%20endpoints%2C%20even%20using%20the%20most%20advanced%20file%20less%20attacks%2C%20Windows%20Defender%20ATP%20can%20detect%20it%20and%20automatically%20protect%20your%20precious%20corporate%20information%20through%20conditional%20access.%20In%20parallel%2C%20Windows%20Defender%20ATP%20will%20start%20an%20automated%20investigation%20to%20quickly%20remediate%20the%20threat.%20Once%20the%20threat%20is%20remediated%2C%20based%20on%20the%20preference%20set%20(automatic%20or%20reviewed)%2C%20the%20risk%20level%20is%20set%20back%20to%20%E2%80%9Cno%20risk%E2%80%9D%20%E2%80%93%20and%20access%20is%20granted%20again.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3C%2FP%3E%3CDIV%20class%3D%22video-embed-center%20video-embed%22%3E%3CIFRAME%20class%3D%22embedly-embed%22%20src%3D%22https%3A%2F%2Fcdn.embedly.com%2Fwidgets%2Fmedia.html%3Fsrc%3Dhttps%253A%252F%252Fwww.youtube.com%252Fembed%252FBbQ3G2owiMo%253Ffeature%253Doembed%26amp%3Burl%3Dhttp%253A%252F%252Fwww.youtube.com%252Fwatch%253Fv%253DBbQ3G2owiMo%26amp%3Bimage%3Dhttps%253A%252F%252Fi.ytimg.com%252Fvi%252FBbQ3G2owiMo%252Fhqdefault.jpg%26amp%3Bkey%3Dfad07bfa4bd747d3bdea27e17b533c0e%26amp%3Btype%3Dtext%252Fhtml%26amp%3Bschema%3Dyoutube%22%20width%3D%22600%22%20height%3D%22337%22%20scrolling%3D%22no%22%20frameborder%3D%220%22%20allow%3D%22autoplay%3B%20fullscreen%22%20allowfullscreen%3D%22true%22%20title%3D%22Video%22%3E%3C%2FIFRAME%3E%3C%2FDIV%3E%3CP%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWith%20Windows%20Defender%20ATP%2C%20you%20can%20now%20control%20access%20based%20on%20the%20risk%20level%20of%20the%20device%20itself%2C%20helping%20to%20ensure%20devices%20are%20always%20trusted.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH1%20id%3D%22toc-hId-1010663913%22%20id%3D%22toc-hId-1090117286%22%3E%3CSTRONG%3EAdvanced%20hunting%3C%2FSTRONG%3E%3C%2FH1%3E%0A%3CP%3EWhen%20it%20comes%20to%20more%20complex%20issues%2C%20security%20analysts%20seek%20rich%20optics%20and%20the%20right%20tools%20to%20quickly%20hunt%20and%20investigate.%20We%20developed%20a%20new%2C%20powerful%20query-based%20search%20that%20we%20call%20Advanced%20Hunting%20designed%20to%20unleash%20the%20hunter%20in%20you.%3C%2FP%3E%0A%3CP%3EWith%20Advanced%20Hunting%2C%20you%20can%20proactively%20hunt%20and%20investigate%20across%20your%20organization%E2%80%99s%20data.%20From%20new%20process%20creation%2C%20file%20modification%2C%20machine%20login%2C%20network%20communication%2C%20registry%20update%2C%20remediation%20actions%20and%20many%20other%20event%20types%20%E2%80%93%20are%20entities%20you%20can%20now%20easily%20query%2C%20correlate%20and%20intersect.%26nbsp%3BAdvanced%20hunting%20is%20an%20integral%20part%20of%20our%20investigation%20experience%2C%20so%20your%20hunting%20results%2C%20such%20as%20machines%20and%20files%2C%20can%20leverage%20the%20rich%20set%20of%20features%20we%20already%20provide%20in%20Windows%20Security%20Center%20(correlate%20with%20worldwide%20information%2C%20VT%20data%2C%20trigger%20block%20or%20containment%20actions%20etc.)%3C%2FP%3E%0A%3CP%3ETo%20help%20you%20get%20started%2C%20we%20added%20a%20set%20of%20sample%20queries%20within%20the%20tool%2C%20and%20we%20also%20have%20a%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FMicrosoft%2FWindowsDefenderATP-Hunting-Queries%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Eproject%20on%20GitHub%3C%2FA%3E%20which%20contains%20additional%20sample%20queries.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH1%20id%3D%22toc-hId--1541493048%22%20id%3D%22toc-hId--1462039675%22%3E%3CSTRONG%3ESignal%20sharing%20across%20the%20Intelligent%20Security%20Graph%3C%2FSTRONG%3E%3C%2FH1%3E%0A%3CP%3EOur%20services%20also%20learn%20from%20each%20other.%20Through%20the%20Microsoft%20Intelligent%20Security%20Graph%20(ISG)%20we%20share%20detections%20to%20automatically%20update%20our%20protection%20and%20detection%20mechanism%20across%20Microsoft%20365%20and%20orchestrate%20remediation.%20For%20example%2C%20if%20a%20threat%20gets%20detected%20by%20any%20of%20the%20Windows%20Defender%20ATP%20components%2C%20that%20threat%20will%20instantly%20be%20blocked%20if%20it%20is%20encountered%20through%20an%20email%20that%20is%20protected%20by%20Office%20365%20ATP%20%E2%80%93%20and%20the%20other%20way%20around.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3C%2FP%3E%3CDIV%20class%3D%22video-embed-center%20video-embed%22%3E%3CIFRAME%20class%3D%22embedly-embed%22%20src%3D%22https%3A%2F%2Fcdn.embedly.com%2Fwidgets%2Fmedia.html%3Fsrc%3Dhttps%253A%252F%252Fwww.youtube.com%252Fembed%252FT6FgiJER6mM%253Ffeature%253Doembed%26amp%3Burl%3Dhttp%253A%252F%252Fwww.youtube.com%252Fwatch%253Fv%253DT6FgiJER6mM%26amp%3Bimage%3Dhttps%253A%252F%252Fi.ytimg.com%252Fvi%252FT6FgiJER6mM%252Fhqdefault.jpg%26amp%3Bkey%3Dfad07bfa4bd747d3bdea27e17b533c0e%26amp%3Btype%3Dtext%252Fhtml%26amp%3Bschema%3Dyoutube%22%20width%3D%22600%22%20height%3D%22337%22%20scrolling%3D%22no%22%20frameborder%3D%220%22%20allow%3D%22autoplay%3B%20fullscreen%22%20allowfullscreen%3D%22true%22%20title%3D%22Video%22%3E%3C%2FIFRAME%3E%3C%2FDIV%3E%3CP%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWhen%20it%20comes%20to%20investigating%20threats%2C%20other%20Microsoft%20ATP%20services%20might%20have%20information%20important%20to%20understanding%20the%20full%20picture.%20We%20are%20excited%20to%20share%20that%20we%20are%20expanding%20how%20Windows%2C%20Office%2C%20and%20now%20Azure%20Advanced%20Threat%20Protection%20(ATP)%20work%20together.%20We%20are%20providing%20wider%20Advanced%20Threat%20Protection%20coverage%20across%20identities%20(Azure%20ATP)%2C%20apps%20and%20data%20(Office%20365%20ATP)%20and%20devices%20(Windows%20Defender%20ATP).%20This%20means%20relevant%20information%20is%20displayed%20right%20at%20your%20fingertips%20and%20seamless%20navigation%20between%20the%20consoles%20without%20losing%20context.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CBLOCKQUOTE%3E%0A%3CP%3EWe%20added%26nbsp%3Bimproved%20prevention%20for%20ransomware%2C%20exploits%20and%20advanced%20attacks.%3C%2FP%3E%3CCITE%3E%3C%2FCITE%3E%3C%2FBLOCKQUOTE%3E%0A%3CP%3EAttackers%20are%20using%20new%20techniques%20like%20%E2%80%9Cfileless%E2%80%9D%20attacks%20to%20compromise%20and%20deliver%20ransomware%20and%20other%20types%20of%20malware.%20To%20address%20these%20types%20of%20threats%20we%20significantly%20improved%20our%20existing%20exploit%20protection%20and%20behavior%20monitoring%20techniques%20which%20are%20%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fcloudblogs.microsoft.com%2Fmicrosoftsecure%2F2018%2F03%2F22%2Fwhy-windows-defender-antivirus-is-the-most-deployed-in-the-enterprise%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ealready%20consistently%20earning%20top%20scores%20on%20independent%20tests%3C%2FA%3E%3C%2FSTRONG%3E%20to%20protect%20from%20these%20scenarios.%20Cloud%20protection%20has%20also%20been%20updated%20to%20inspect%20and%20block%20a%20broader%20range%20of%20content%20types%20(e.g.%3A%20java%20scripts%2C%20macros%2C%20and%20documents)%20regardless%20of%20whether%20it%20was%20downloaded%20from%20the%20web%2C%20USB%20stick%2C%20etc.%3C%2FP%3E%0A%3CP%3EWe%E2%80%99ve%20added%20new%20capabilities%20to%20prevent%20unauthorized%20lateral%20movement%20and%20new%20techniques%20to%20address%20aggressive%20ransomware%20attacks%20that%20attempt%20to%20render%20devices%20unbootable%20through%20boot%20sector%20tampering%20(e.g.%3A%20NotPetya).%3C%2FP%3E%0A%3CP%3EFaster%20performance%20and%20reaction%20times%20to%20fast-moving%20outbreaks%20have%20also%20been%20added.%20The%20Intelligent%20Security%20Graph%20can%20now%20be%20used%20to%20instantly%20update%20devices%20with%20the%20latest%20dynamic%20intelligence%20as%20soon%20as%20a%20new%20outbreak%20is%20detected.%20%26nbsp%3BWe%E2%80%99ve%20also%20added%20new%20accelerated%20memory%20scanning%20capability%20which%20takes%20advantage%20of%20%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fnewsroom.intel.com%2Feditorials%2Fsecuring-digital-world-intel-announces-silicon-level-security-technologies-industry-adoption-rsa-2018%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3EIntel%E2%80%99s%20Threat%20Detection%20Technology%20(TDT)%3C%2FA%3E%3C%2FSTRONG%3E.%20This%20capability%20leverages%20Intel%E2%80%99s%20integrated%20graphics%20processor%20to%20live-scan%20memory%20for%20advanced%20threats%20offering%20improved%20performance%2C%20user%20experience%2C%20and%20better%20battery%20life.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH1%20id%3D%22toc-hId-201317287%22%20id%3D%22toc-hId-280770660%22%3E%3CSTRONG%3EMicrosoft%20Secure%20Score%3C%2FSTRONG%3E%3C%2FH1%3E%0A%3CP%3EWe%20all%20know%20that%20fixing%20a%20problem%20before%20it%20happens%2C%20is%20the%20best%20way%20to%20keep%20you%20safe.%20Windows%20Secure%20Score%20does%20this%20by%20helping%20you%20run%20reports%20on%20your%20devices%E2%80%99%20security%20posture%20and%20providing%20actionable%20recommendations%2C%20ensuring%20your%20entire%20organization%20is%20fortified%20against%20the%20next%20attack.%20But%20we%20know%20that%20the%20security%20state%20of%20devices%20is%20not%20everything%2C%20that%E2%80%99s%20why%20we%20display%20your%20Secure%20Score%20across%20Windows%20and%20Office%20in%20a%20single%20view%20with%20the%20Microsoft%20Secure%20Score.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3C%2FP%3E%3CDIV%20class%3D%22video-embed-center%20video-embed%22%3E%3CIFRAME%20class%3D%22embedly-embed%22%20src%3D%22https%3A%2F%2Fcdn.embedly.com%2Fwidgets%2Fmedia.html%3Fsrc%3Dhttps%253A%252F%252Fwww.youtube.com%252Fembed%252Fie89m8DiGiw%253Ffeature%253Doembed%26amp%3Burl%3Dhttp%253A%252F%252Fwww.youtube.com%252Fwatch%253Fv%253Die89m8DiGiw%26amp%3Bimage%3Dhttps%253A%252F%252Fi.ytimg.com%252Fvi%252Fie89m8DiGiw%252Fhqdefault.jpg%26amp%3Bkey%3Dfad07bfa4bd747d3bdea27e17b533c0e%26amp%3Btype%3Dtext%252Fhtml%26amp%3Bschema%3Dyoutube%22%20width%3D%22600%22%20height%3D%22337%22%20scrolling%3D%22no%22%20frameborder%3D%220%22%20allow%3D%22autoplay%3B%20fullscreen%22%20allowfullscreen%3D%22true%22%20title%3D%22Video%22%3E%3C%2FIFRAME%3E%3C%2FDIV%3E%3CP%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIf%20you%E2%80%99re%20worried%20about%20the%20latest%20threat%2C%20we%E2%80%99ve%20got%20you%20covered%20with%20a%20new%20dashboard%20that%20provides%20insights%20about%20the%20exposure%20level%20of%20your%20organization%20%E2%80%93%20currently%20for%20the%20Meltdown%20and%20Spectre%20vulnerability%2C%20so%20you%20can%20easily%20understand%20what%20machines%20are%20still%20exposed.%20This%20includes%20information%20about%20your%20network%2C%20operating%20system%20updates%2C%20and%20microcode%20level%20information%20against%20these%20threats.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CH1%20id%3D%22toc-hId-1944127622%22%20id%3D%22toc-hId-2023580995%22%3E%3CSTRONG%3EWindows%20Defender%20ATP%20today%3C%2FSTRONG%3E%3C%2FH1%3E%0A%3CP%3EThese%20new%20Windows%20Defender%20ATP%20innovations%20place%20an%20emphasis%20on%20leveraging%20intelligence%2C%20cloud%2C%20and%20analytics%20to%20build%20deeper%20levels%20of%20advanced%20threat%20protection%20for%20our%20customers.%20We%20are%20expanding%20the%20platform%20coverage%20beyond%20Windows%2010%3A%20Windows%20Defender%20ATP%20is%20now%20%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fcloudblogs.microsoft.com%2Fwindowsserver%2F2018%2F03%2F20%2Fintroducing-windows-server-2019-now-available-in-preview%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ebuilt%20into%20Windows%20Server%202019%3C%2FA%3E%3C%2FSTRONG%3E%2C%20is%20currently%20in%20private%20preview%20for%20%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fblogs.windows.com%2Fbusiness%2F2018%2F02%2F12%2Fannouncing-windows-defender-atp-support-for-windows-7-and-windows-8-1%2F%23ms7Ssz2vTYqq3Tvd.97%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3EWindows%207%20and%208.1%3C%2FA%3E%3C%2FSTRONG%3E%20with%20general%20availability%20coming%20soon%2C%20and%20extends%20across%20macOS%2C%20Linux%2C%20iOS%2C%20and%20Android%20devices%20through%20our%20%3CSTRONG%3E%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fassociation%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%22%3EMicrosoft%20Intelligent%20Security%20Association%3C%2FA%3E%3C%2FSTRONG%3E.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CBLOCKQUOTE%3E%0A%3CP%3EAll%20these%20new%20capabilities%20are%20already%20available%20in%20Public%20Preview%20today.%20%3CA%20href%3D%22https%3A%2F%2Fwinatpregistration-prd.trafficmanager.net%2FUserAgreement%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%20noopener%20noreferrer%22%3ESign%20up%20for%20a%2090-day%20trial%20of%20Windows%20Defender%20ATP%20today%3C%2FA%3E%20or%20enable%20Preview%20features%20on%20existing%20tenants.%3C%2FP%3E%0A%3C%2FBLOCKQUOTE%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-253411%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-253411%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20are%20not%20supporting%20Windows%20Server%202008%20R2.%3C%2FP%3E%0A%3CP%3ETo%20use%20Windows%20Defender%20ATP%20for%20server%20you%20should%20to%20use%20one%20of%20our%20supported%20server%20versions%2C%20Windows%20Server%202012%20R2%20and%20above.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%2C%3C%2FP%3E%0A%3CP%3EMichal%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-253366%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-253366%22%20slang%3D%22en-US%22%3E%3CP%3EHi%3C%2FP%3E%3CP%3EIs%20windows%20defender%20ATP%20is%20supported%20in%20windows%20server%202008%20and%20R2%3F%3C%2FP%3E%3CP%3EIf%20we%20have%20to%20replace%20current%20antivirus%20with%20windows%20defender%20ATP%20in%20server's%20then%20what%20are%20the%20option%20we%20have.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-239814%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-239814%22%20slang%3D%22en-US%22%3E%3CP%3ERicky%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThat%20was%20very%20helpful.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20short%20term%20solution%20I%20suggest%20the%20following%3A%3C%2FP%3E%0A%3CP%3EA%20stream%20in%20Advanced%20hunting%20for%20the%20aggregated%20data%20(1h%20interval)%3C%2FP%3E%0A%3COL%3E%0A%3CLI%3ENot%20sure%20if%20UDP%2FTCP%20info%20will%20be%20there%20as%20well%20as%20the%20specific%20process%20info.%20I%20believe%20solving%20the%20process%20identity%20here%20is%20important.%20Not%20sure%20if%20protocol%20(TCP%2FUDP)%20is%20so%20important%20here.%3C%2FLI%3E%0A%3C%2FOL%3E%0A%3CP%3EFor%20longer%20term%20we'll%20consider%20adding%20it%20to%20the%20UX%20and%20even%20build%20a%20full%20AutoIR%20flow.%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20would%20appreciate%20your%20feedback%20about%20both.%3C%2FP%3E%0A%3CP%3EAlso%2C%20please%20share%20the%20name%20of%20the%20NIDS%20solution%20you%20use.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%2C%3C%2FP%3E%0A%3CP%3EDan%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-239454%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-239454%22%20slang%3D%22en-US%22%3E%3CP%3EDan%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20for%20the%20response%2C%20very%20helpful%20information%20to%20know.%20I'll%20share%20my%20ideas%20and%20answers%20to%20your%20questions%20below%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20certainly%20agree%20that%20presenting%20every%20UDP%20transaction%20would%20be%20overly%20noisy%20for%20most%20deployment%20situations.%20Perhaps%20a%20toggle%20feature%2C%20similar%20to%20the%20ability%20to%20filter%20on%20Event%20Type%20within%20the%20timeline%20view%3F%20I'm%20imagining%20selecting%20only%20network%20communications%2C%20with%20further%20options%20for%20selecting%20TCP%20and%2For%20UDP%20communications.%20Even%20when%20selecting%20UDP%20from%20the%20dropdown%20menu%2C%20I%20think%20it%20would%20be%20beneficial%20to%20provide%205-tuple%20summaries%20similar%20to%20how%20the%20timeline%20currently%20summarizes%20encrypted%20network%20communications%20with%20the%20source%20process%20tree%20and%20destination%20IPs%20(ex%3A%20chrome.exe%20communicated%20over%20the%20network%20using%20an%20encrypted%20channel)%2C%20adding%20in%20the%20destination%20port%20would%20help%20with%20lead%20information.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1)%20What%20was%20the%20trigger%20for%20typical%20investigation%20cases%3F%3C%2FP%3E%3CP%3EVarious%20NIDS%20alerts%20for%20newly%20seen%20outbound%20UDP%20traffic%20(VOIP%20Traffic%20to%20a%20cloud%20service%20as%20an%20example)%3C%2FP%3E%3CP%3E2)%20Was%20it%20HTTP%20over%20UDP%20traffic%20or%20something%20else%3F%3C%2FP%3E%3CP%3EVOIP%20and%20its%20supporting%20protocols%20(sip%2C%20stun%2Fturn)%2C%20NTP%2C%20DNS%3C%2FP%3E%3CP%3E3)%20Inbound%20or%20outbound%20traffic.%3C%2FP%3E%3CP%3EOutbound%3C%2FP%3E%3CP%3E4)%20What%20data%20in%20the%20machine%20time%20line%20or%20in%20the%20investigation%20experience%20of%20ATP%20could%20help%20you%3F%3C%2FP%3E%3CP%3E%26nbsp%3BA%20summary%20of%20source%20process%2C%20destination%20IPs%2C%20ports%2C%20would%20help.%20(ntpd.exe%20communicated%20over%20UDP%20123%20with%206%20IPs)%3C%2FP%3E%3CP%3E5)%20Anything%20else%20you%20might%20think%20will%20be%20useful.%3C%2FP%3E%3CP%3EEven%20if%20the%20information%20doesn't%20make%20sense%20to%20view%20in%20the%20timeline%20feature%2C%20perhaps%20adding%20a%20table%20within%20the%20Advanced%20Hunting%20feature%20dedicated%20to%20UDP%20communications%20would%20help%20during%20an%20investigation%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20again%2C%3C%2FP%3E%3CP%3ERicky%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-239400%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-239400%22%20slang%3D%22en-US%22%3E%3CP%3EThanks%20for%20your%20feedback%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ENothing%20wrong%20with%20your%20deployment.%20ATP%20does%20not%20present%20every%20piece%20of%20information%20that%20is%20collected.%20We%20try%20to%20keep%20the%20investigation%20experience%20useful.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EATP%20do%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Emonitor%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3Ethe%20volumes%20of%20inbound%20and%20outbound%20traffic%20in%20an%20aggregative%20way%20including%20UDP%20traffic.%20It%20means%20that%20we%20can%20tell%20the%20volume%20of%20the%20traffic%20in%20a%20time%20window%20for%20a%20specific%20process%2Fdestination%20address%20but%20we%20cannot%20really%20tell%20if%20it%20was%20a%20two%20files%20upload%20case%20or%20one%20single%20upload.%20As%20UDP%20is%20a%20connectionless%20protocol%2C%20it%26nbsp%3Bfeels%20like%20it%20is%20too%26nbsp%3Bnoisy%20to%20present%20every%20single%20packet%20in%20the%20timeline.%26nbsp%3BThere%20will%20be%20some%20more%20work%20to%20do%20in%20order%20to%20present%20it%20in%20a%20way%20that%20will%20make%20sense.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EWe'd%20love%20to%20hear%20your%20feedback%20regarding%20the%20investigation%20use%20cases%20you%20had%20and%20regarding%20the%20way%26nbsp%3Byou%20would%20suggest%20to%20see%20this%20information.%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20example%3A%3C%2FP%3E%0A%3CP%3E1)%20What%20was%20the%20trigger%20for%20typical%20investigation%20cases%3F%3C%2FP%3E%0A%3CP%3E2)%20Was%20it%20HTTP%20over%20UDP%20traffic%20or%20something%20else%3F%3C%2FP%3E%0A%3CP%3E3)%20Inbound%20or%20outbound%20traffic.%3C%2FP%3E%0A%3CP%3E4)%20What%20data%20in%20the%20machine%20time%20line%20or%20in%20the%20investigation%20experience%20of%20ATP%20could%20help%20you%3F%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E5)%20Anything%20else%20you%20might%20think%20will%20be%20useful.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%2C%3C%2FP%3E%0A%3CP%3EDan%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-238234%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-238234%22%20slang%3D%22en-US%22%3E%3CP%3EGood%20afternoon%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI'm%20asking%20here%20because%20I%20can%20find%20no%20documentation%20on%20this%20subject%20anywhere%20else%2C%20but%20does%20Defender%20ATP%20record%20UDP%20events%20into%20the%20event%20tables%3F%20Every%20time%20we%20have%20attempted%20to%20investigate%20a%20UDP%20based%20NIDS%20alert%2C%20Defender%20ATP%20has%20nothing%20to%20report.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20this%20is%20a%20supported%20feature%2C%20any%20ideas%20on%20what%20could%20be%20wrong%20with%20a%20deployment%20that%20picks%20up%20no%20UDP%20activity%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20this%20isn't%20a%20supported%20feature%2C%20is%20there%20a%20reason%20why%3F%20UDP%20comms%20is%20a%20standard%20technique%20for%20exfiltrating%20data%20from%20a%20network%20and%20would%20be%20a%20pretty%20large%20coverage%20gap%20for%20a%20tool%20such%20as%20this.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%2C%3C%2FP%3E%3CP%3ERicky%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-217688%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-217688%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%3C%2FP%3E%0A%3CP%3EPlease%20submit%20a%20frown%20in%20WDATP%20portal%20when%20you're%20logged%20on%20to%20the%20tenant%20with%20the%20300%20points.%20This%20way%20we'll%20get%20all%20the%20necessary%20details%20to%20investigate.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EDid%20you%20see%20this%20drop%20for%20a%20given%20tenant%20that%20previously%20had%20800%20potential%20and%20now%20has%20300%20potential%3F%20Or%2C%20alternatively%2C%20you%20see%20the%20300%20for%20a%20*new*%20tenant.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EGenerally%2C%20the%20potential%20score%20is%20subject%20to%20the%20Win10%20client%20versions%20that%20are%20onboarded%20(RS1%2F2%20vs%20RS3%2B%20vs%20RS4%2B)%20as%20it%20infers%20the%20supported%20security%20controls%20(for%20instance%20bitlocker%20is%20only%20available%20in%20RS4)%20and%20the%20secure%20score%20exclusion%20settings.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-217686%22%20slang%3D%22en-US%22%3ERe%3A%20RE%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-217686%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Chet%2C%3C%2FP%3E%0A%3CP%3EI%20sent%20you%20an%20answer%20in%20a%20private%20message.%3C%2FP%3E%0A%3CP%3EBest%2C%3C%2FP%3E%0A%3CP%3EYarden%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-217480%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-217480%22%20slang%3D%22en-US%22%3E%3CP%3EDid%20something%20happen%20with%20the%20Secure%20Score%3F%26nbsp%3B%20It%20went%20from%20800%20possible%20to%20100%20possible%20in%20the%20Security%20and%20Compliance%20Center%20and%20300%20possible%20in%20ATP%20dashboard.%26nbsp%3B%20I%20didn't%20see%20notification%20of%20change%20on%20this.%26nbsp%3B%20Why%20is%20it%20all%20screwy%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-214942%22%20slang%3D%22en-US%22%3ERE%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-214942%22%20slang%3D%22en-US%22%3Ehow%20do%20we%20reset%20and%20start%20a%20new%20enrollment%20process%3F%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-214069%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-214069%22%20slang%3D%22en-US%22%3E%3CP%3EThank%20you%20for%20responding.%26nbsp%3B%20The%20screenshots%20I%20just%20provided%20is%20the%20expected%20behavior%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-213634%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-213634%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Jeffrey%2C%26nbsp%3B%3C%2FP%3E%0A%3CP%3EThanks%20for%20your%20feedback.%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20The%20action%20center%20display%20the%20initialization%20of%20the%20scan.%20%26nbsp%3BAs%20the%20scan%20may%20run%20for%20a%20long%20time%2C%20its%20actual%20outcome%20and%20detection%20results%20(if%20there%20are%20such)%20are%20available%20in%20the%20machine%20timeline.%3CBR%20%2F%3E%20%3CBR%20%2F%3E%20Best%2C%3CBR%20%2F%3E%20Oren%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-213519%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-213519%22%20slang%3D%22en-US%22%3EWhen%20running%20a%20quick%20scan%20through%20ATP%20on%202%20machines%20in%20action%20center%20it%20shows%20that%20the%20scan%20is%20successfully%20triggered%2C%20but%20the%20machines%20never%20reports%20back%20to%20ATP%20as%20scan%20completed.%20The%20machines%20are%20communicating%20with%20ATP%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-211051%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-211051%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20Azim%2C%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EI%20will%20contact%20you%20in%20private%20to%20solve%20this%20issue.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EBest%2C%3C%2FP%3E%0A%3CP%3EYarden%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-206582%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-206582%22%20slang%3D%22en-US%22%3E%3CP%3E%22%3CSPAN%3EOur%20mission%20is%20to%20empower%20every%20person%20and%20every%20organization%20on%20the%20planet%20to%20achieve%20more.%20A%20trusted%20and%20secure%20computing%20environment%20is%20a%20critical%20component%20of%20our%20approach%22%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EIf%20this%20was%20truly%20the%20case%2C%20i%20would%20not%20have%20been%20rejected%20from%20a%20free%20trial%20of%20this%20toolset%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-206581%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-206581%22%20slang%3D%22en-US%22%3E%3CP%3E%22%3CSPAN%3EOur%20mission%20is%20to%20empower%20every%20person%20and%20every%20organization%20on%20the%20planet%20to%20achieve%20more.%20A%20trusted%20and%20secure%20computing%20environment%20is%20a%20critical%20component%20of%20our%20approach%22%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%3CSPAN%3EIf%20this%20was%20truly%20the%20case%2C%20i%20would%20not%20have%20been%20rejected%20from%20a%20free%20trial%20of%20this%20toolset%3CBR%20%2F%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20648px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F36435i4FA5DFF84AA88341%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22Untitled%20picture.png%22%20title%3D%22Untitled%20picture.png%22%20%2F%3E%3C%2FSPAN%3E%3CBR%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-204176%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-204176%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20such%20a%20fantastic%20way%20to%20perform%20an%20update%20on%20the%20new%20features.%20Please%20keep%20it%20up.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-189326%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-189326%22%20slang%3D%22en-US%22%3EHi%20Dustin%2C%20%3CBR%20%2F%3EThanks%20for%20your%20feedback!.%3CBR%20%2F%3E%3CBR%20%2F%3ETo%20troubleshoot%20the%20issue%2C%20I%20would%20need%20a%20bit%20more%20information%20about%20the%20problem%20you%20are%20experiencing.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20have%20sent%20you%20a%20private%20message%2C%20with%20a%20few%20followup%20questions.%3CBR%20%2F%3E%3CBR%20%2F%3EBest%2C%3CBR%20%2F%3EBarak%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-189184%22%20slang%3D%22en-US%22%3ERe%3A%20Announcing%20new%20exciting%20capabilities%20of%20Windows%20Defender%20ATP%20(April%202018)%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-189184%22%20slang%3D%22en-US%22%3E%3CP%3EThe%20buttons%20to%20approve%20a%20remediation%20seem%20to%20have%20vanished...%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

Our mission is to empower every person and every organization on the planet to achieve more. A trusted and secure computing environment is a critical component of our approach. When we introduced Windows Defender Advanced Threat Protection (ATP) more than two years ago, our target was to leverage the power of the cloud, built-in Windows security capabilities and artificial intelligence (AI) to enable our customers’ to stay one step ahead of the cyber-challenges.

 

With the next update to Windows 10, we are further expanding Windows Defender ATP to provide richer capabilities for businesses to improve their security posture and solve security incidents more quickly and efficiently.

 

Let’s dive in into these new capabilities in more detail.

Automatic investigation and remediation of threats

Now you can go from alert to remediation in minutes—at scale! Automated investigation and response dramatically reduces the volume of alerts that security analysts need to handle. It uses artificial intelligence to investigate alerts, exercise in minutes sophisticated playbooks mimicking the best human analysts’ decisions and forensic processes, determine if a threat is active, its origin and then decide the appropriate steps to automatically remediate it. When Windows Defender ATP identifies that the incident includes multiple machines, it automatically expands the investigation across the entire scope of breach and performs the required actions on those in parallel. Threat investigation and remediation decisions can be taken automatically by Windows Defender ATP based on extensive historical data collected, stored and analyzed in our cloud (“time travel”).

 

 

With the new security automation capabilities, Windows Defender ATP can now prevent and find breaches; it can fix them. These actions can be set to run automatically for simple, clear-cut cases, or can be reviewed prior to execution. Either way, time and effort are saved by SecOps, enabling those talented professionals to focus on more complex and strategic problems. In addition, the organization’s security team moves faster, thereby better executing on their critical mission.

 

Microsoft 365 conditional access based on device-risk

If a threat gets detected, the next logical step would be to block access to your sensitive business data from the device while the threat is still active. This is now possible! We worked with our colleagues from the Microsoft Intune and Azure Active Directory (AAD) team, to enrich one of our most popular security scenarios of Microsoft 365 conditional access.

Available in the next update, the dynamic machine risk level can be used to define corporate access policies and prevent risk to corporate data.

As an example, if a bad threat lands on your endpoints, even using the most advanced file less attacks, Windows Defender ATP can detect it and automatically protect your precious corporate information through conditional access. In parallel, Windows Defender ATP will start an automated investigation to quickly remediate the threat. Once the threat is remediated, based on the preference set (automatic or reviewed), the risk level is set back to “no risk” – and access is granted again.

 

 

With Windows Defender ATP, you can now control access based on the risk level of the device itself, helping to ensure devices are always trusted.

 

Advanced hunting

When it comes to more complex issues, security analysts seek rich optics and the right tools to quickly hunt and investigate. We developed a new, powerful query-based search that we call Advanced Hunting designed to unleash the hunter in you.

With Advanced Hunting, you can proactively hunt and investigate across your organization’s data. From new process creation, file modification, machine login, network communication, registry update, remediation actions and many other event types – are entities you can now easily query, correlate and intersect. Advanced hunting is an integral part of our investigation experience, so your hunting results, such as machines and files, can leverage the rich set of features we already provide in Windows Security Center (correlate with worldwide information, VT data, trigger block or containment actions etc.)

To help you get started, we added a set of sample queries within the tool, and we also have a project on GitHub which contains additional sample queries.

 

Signal sharing across the Intelligent Security Graph

Our services also learn from each other. Through the Microsoft Intelligent Security Graph (ISG) we share detections to automatically update our protection and detection mechanism across Microsoft 365 and orchestrate remediation. For example, if a threat gets detected by any of the Windows Defender ATP components, that threat will instantly be blocked if it is encountered through an email that is protected by Office 365 ATP – and the other way around.

 

 

When it comes to investigating threats, other Microsoft ATP services might have information important to understanding the full picture. We are excited to share that we are expanding how Windows, Office, and now Azure Advanced Threat Protection (ATP) work together. We are providing wider Advanced Threat Protection coverage across identities (Azure ATP), apps and data (Office 365 ATP) and devices (Windows Defender ATP). This means relevant information is displayed right at your fingertips and seamless navigation between the consoles without losing context.

 

We added improved prevention for ransomware, exploits and advanced attacks.

Attackers are using new techniques like “fileless” attacks to compromise and deliver ransomware and other types of malware. To address these types of threats we significantly improved our existing exploit protection and behavior monitoring techniques which are already consistently earning top scores on independent tests to protect from these scenarios. Cloud protection has also been updated to inspect and block a broader range of content types (e.g.: java scripts, macros, and documents) regardless of whether it was downloaded from the web, USB stick, etc.

We’ve added new capabilities to prevent unauthorized lateral movement and new techniques to address aggressive ransomware attacks that attempt to render devices unbootable through boot sector tampering (e.g.: NotPetya).

Faster performance and reaction times to fast-moving outbreaks have also been added. The Intelligent Security Graph can now be used to instantly update devices with the latest dynamic intelligence as soon as a new outbreak is detected.  We’ve also added new accelerated memory scanning capability which takes advantage of Intel’s Threat Detection Technology (TDT). This capability leverages Intel’s integrated graphics processor to live-scan memory for advanced threats offering improved performance, user experience, and better battery life.

 

Microsoft Secure Score

We all know that fixing a problem before it happens, is the best way to keep you safe. Windows Secure Score does this by helping you run reports on your devices’ security posture and providing actionable recommendations, ensuring your entire organization is fortified against the next attack. But we know that the security state of devices is not everything, that’s why we display your Secure Score across Windows and Office in a single view with the Microsoft Secure Score.

 

 

 

If you’re worried about the latest threat, we’ve got you covered with a new dashboard that provides insights about the exposure level of your organization – currently for the Meltdown and Spectre vulnerability, so you can easily understand what machines are still exposed. This includes information about your network, operating system updates, and microcode level information against these threats.

 

Windows Defender ATP today

These new Windows Defender ATP innovations place an emphasis on leveraging intelligence, cloud, and analytics to build deeper levels of advanced threat protection for our customers. We are expanding the platform coverage beyond Windows 10: Windows Defender ATP is now built into Windows Server 2019, is currently in private preview for Windows 7 and 8.1 with general availability coming soon, and extends across macOS, Linux, iOS, and Android devices through our Microsoft Intelligent Security Association.

 

All these new capabilities are already available in Public Preview today. Sign up for a 90-day trial of Windows Defender ATP today or enable Preview features on existing tenants.

19 Comments
Contributor

The buttons to approve a remediation seem to have vanished...

Hi Dustin,
Thanks for your feedback!.

To troubleshoot the issue, I would need a bit more information about the problem you are experiencing.

I have sent you a private message, with a few followup questions.

Best,
Barak

This is such a fantastic way to perform an update on the new features. Please keep it up. 

New Contributor

"Our mission is to empower every person and every organization on the planet to achieve more. A trusted and secure computing environment is a critical component of our approach"

If this was truly the case, i would not have been rejected from a free trial of this toolset
Untitled picture.png

New Contributor

"Our mission is to empower every person and every organization on the planet to achieve more. A trusted and secure computing environment is a critical component of our approach"

If this was truly the case, i would not have been rejected from a free trial of this toolset

Microsoft

Hi Azim,

 

I will contact you in private to solve this issue.

 

Best,

Yarden

Deleted
Not applicable
When running a quick scan through ATP on 2 machines in action center it shows that the scan is successfully triggered, but the machines never reports back to ATP as scan completed. The machines are communicating with ATP
Microsoft

Hi Jeffrey, 

Thanks for your feedback.

The action center display the initialization of the scan.  As the scan may run for a long time, its actual outcome and detection results (if there are such) are available in the machine timeline.

Best,
Oren

Deleted
Not applicable

Thank you for responding.  The screenshots I just provided is the expected behavior?

Regular Visitor
how do we reset and start a new enrollment process?
New Contributor

Did something happen with the Secure Score?  It went from 800 possible to 100 possible in the Security and Compliance Center and 300 possible in ATP dashboard.  I didn't see notification of change on this.  Why is it all screwy?

Microsoft

Hi Chet,

I sent you an answer in a private message.

Best,

Yarden

Microsoft

Hi,

Please submit a frown in WDATP portal when you're logged on to the tenant with the 300 points. This way we'll get all the necessary details to investigate.

 

Did you see this drop for a given tenant that previously had 800 potential and now has 300 potential? Or, alternatively, you see the 300 for a *new* tenant.

 

Generally, the potential score is subject to the Win10 client versions that are onboarded (RS1/2 vs RS3+ vs RS4+) as it infers the supported security controls (for instance bitlocker is only available in RS4) and the secure score exclusion settings.

 

 

Senior Member

Good afternoon,

 

I'm asking here because I can find no documentation on this subject anywhere else, but does Defender ATP record UDP events into the event tables? Every time we have attempted to investigate a UDP based NIDS alert, Defender ATP has nothing to report. 

 

If this is a supported feature, any ideas on what could be wrong with a deployment that picks up no UDP activity?

 

If this isn't a supported feature, is there a reason why? UDP comms is a standard technique for exfiltrating data from a network and would be a pretty large coverage gap for a tool such as this.

 

Thanks,

Ricky

Microsoft

Thanks for your feedback,

 

Nothing wrong with your deployment. ATP does not present every piece of information that is collected. We try to keep the investigation experience useful.

 

ATP do monitor the volumes of inbound and outbound traffic in an aggregative way including UDP traffic. It means that we can tell the volume of the traffic in a time window for a specific process/destination address but we cannot really tell if it was a two files upload case or one single upload. As UDP is a connectionless protocol, it feels like it is too noisy to present every single packet in the timeline. There will be some more work to do in order to present it in a way that will make sense.

 

We'd love to hear your feedback regarding the investigation use cases you had and regarding the way you would suggest to see this information.

 

For example:

1) What was the trigger for typical investigation cases?

2) Was it HTTP over UDP traffic or something else?

3) Inbound or outbound traffic.

4) What data in the machine time line or in the investigation experience of ATP could help you?

 

5) Anything else you might think will be useful.

 

Thanks,

Dan

Senior Member

Dan,

 

Thanks for the response, very helpful information to know. I'll share my ideas and answers to your questions below:

 

I certainly agree that presenting every UDP transaction would be overly noisy for most deployment situations. Perhaps a toggle feature, similar to the ability to filter on Event Type within the timeline view? I'm imagining selecting only network communications, with further options for selecting TCP and/or UDP communications. Even when selecting UDP from the dropdown menu, I think it would be beneficial to provide 5-tuple summaries similar to how the timeline currently summarizes encrypted network communications with the source process tree and destination IPs (ex: chrome.exe communicated over the network using an encrypted channel), adding in the destination port would help with lead information.

 

1) What was the trigger for typical investigation cases?

Various NIDS alerts for newly seen outbound UDP traffic (VOIP Traffic to a cloud service as an example)

2) Was it HTTP over UDP traffic or something else?

VOIP and its supporting protocols (sip, stun/turn), NTP, DNS

3) Inbound or outbound traffic.

Outbound

4) What data in the machine time line or in the investigation experience of ATP could help you?

 A summary of source process, destination IPs, ports, would help. (ntpd.exe communicated over UDP 123 with 6 IPs)

5) Anything else you might think will be useful.

Even if the information doesn't make sense to view in the timeline feature, perhaps adding a table within the Advanced Hunting feature dedicated to UDP communications would help during an investigation?

 

Thanks again,

Ricky

Microsoft

Ricky,

 

That was very helpful.

 

For short term solution I suggest the following:

A stream in Advanced hunting for the aggregated data (1h interval)

  1. Not sure if UDP/TCP info will be there as well as the specific process info. I believe solving the process identity here is important. Not sure if protocol (TCP/UDP) is so important here.

For longer term we'll consider adding it to the UX and even build a full AutoIR flow. 

 

I would appreciate your feedback about both.

Also, please share the name of the NIDS solution you use.

 

Thanks,

Dan

 

Established Member

Hi

Is windows defender ATP is supported in windows server 2008 and R2?

If we have to replace current antivirus with windows defender ATP in server's then what are the option we have.

 

Thanks

Hi,

 

We are not supporting Windows Server 2008 R2.

To use Windows Defender ATP for server you should to use one of our supported server versions, Windows Server 2012 R2 and above.

 

Thanks,

Michal