MDE Web Filtering indicators

[lucafabbri365]

Hello Community,

I added an Indicator (URL/Domain) as MDE Web Filtering exception. Which is the waiting time before it will be applied (how much time does the endpoint need to wait ?).

Thank you.

[#2]

Latency can be up to 2 hours according to the official documentation.

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/indicator-ip-domain?view=...
"There may be up to 2 hours of latency (usually less) between the time the action is taken, and the URL and IP being blocked."

[#3]

Hello Jonhed, I suppose it is the same waiting time if there is an allowing exception (instead of a blocking exception) ?

[#4]

Yes, there is no difference between block and allow.
As the documentation mentions though, the waiting time is usually less than 2 hours.