| Category | Microsoft Docs article | Related commit history on GitHub | Change details |
|---|---|---|---|
| threat-intelligence | What Is Microsoft Defender Threat Intelligence Defender Ti | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti.md | In the same breadth, Vulnerability Intelligence Analysts battle correlating thei MicrosoftΓÇÖs goal is to re-imagine the analyst workflow by developing a platform, Defender TI, that aggregates and enriches critical data sources and displays data in an innovative, easy to use interface to correlate when indicators are linked to articles and vulnerabilities, infrastructure chain together indicators of compromise (IOCs), and collaborate on investigations with fellow Defender TI licensed users within their tenant. With security organizations actioning an ever-increasing amount of intelligence and alerts within their environment, having a Threat Analysis & Intelligence Platform that allows for accurate and timely assessments of alerting is important. -Below is a screenshot of Defender TIΓÇÖs Threat Intelligence Home Page. Analysts can quickly scan new featured articles as well as begin their intelligence gathering, triage, incident response, and hunting efforts by performing a keyword, artifact or CVE-ID search. +Below is a screenshot of Defender TIΓÇÖs Threat Intelligence Home Page. Analysts can quickly scan new featured articles as well as begin their intelligence gathering, triage, incident response, and hunting efforts by performing a keyword, indicator, or CVE-ID search.  For more information, see [Reputation scoring](reputation-scoring.md). Analyst insights distill MicrosoftΓÇÖs vast data set into a handful of observations that simplify the investigation and make it more approachable to analysts of all levels. -Insights are meant to be small facts or observations about a domain or IP address and provide Defender TI users with the ability to make an assessment about the artifact queried and improve a user's ability to determine if an indicator being investigated is malicious, suspicious, or benign. +Insights are meant to be small facts or observations about a domain or IP address and provide Defender TI users with the ability to make an assessment about the indicator queried and improve a user's ability to determine if an indicator being investigated is malicious, suspicious, or benign. For more information, see [Analyst insights](analyst-insights.md). For more information, see [Analyst insights](analyst-insights.md). ## Data sets Microsoft centralizes numerous data sets into a single platform, Defender TI, making it easier for MicrosoftΓÇÖs community and customers to conduct infrastructure analysis. MicrosoftΓÇÖs primary focus is to provide as much data as possible about Internet infrastructure to support a variety of security use cases. -Microsoft collects, analyzes, and indexes internet data to assist users in detecting and responding to threats, prioritizing incidents, and proactively identifying adversariesΓÇÖ infrastructure associated with actor groups targeting their organization. Microsoft collects internet data via itsΓÇÖ PDNS sensor network, global proxy network of virtual users, port scans, and leverages third-party sources for malware and added Domain Name System (DNS) data. +Microsoft collects, analyzes, and indexes Internet data via Passive DNS sensors, port scanning, URL and file detonation, and other sources to assist users in detecting threats, prioritizing incidents, and identifying infrastructure associated with threat actor groups. Users' URL searches may be used to automatically initiate detonations if there is no available detonation data for a URL at the time of the request. The data collected from such detonations is used to populate results for any future searches for that URL from the user who submitted the original search or any other users of the platform. -This internet data is categorized into two distinct groups: traditional and advanced. Traditional data sets include Resolutions, WHOIS, SSL Certificates, Subdomains, DNS, Reverse DNS, and Services. Advanced data sets include Trackers, Components, Host Pairs, and Cookies. Trackers, Components, Host Pairs, and Cookies data sets are collected from observing the Document Object Model (DOM) of web pages crawled. Additionally, Components and Trackers are also observed from detection rules that are triggered based on the banner responses from port scans or SSL Certificate details. Many of these data sets have various methods to sort, filter, and download data, making it easier to access information that may be associated with a specific artifact type or time in history. +Supported Internet datasets include Resolutions, WHOIS, SSL Certificates, Subdomains, DNS, Reverse DNS, and Detonation Analysis, as well as derived data sets collected from the Document Object Model (DOM) of detonated URLs, including Trackers, Components, Host Pairs, and Cookies. Additionally, Components and Trackers are also observed from detection rules that are triggered based on the banner responses from port scans or SSL Certificate details. Many of these data sets have various methods to sort, filter, and download data, making it easier to access information that may be associated with a specific indicator type or time in history. For more information, see: For more information, see: ## Tags -Defender TI tags are used to provide quick insight about an artifact, whether derived by the system or generated by other users. Tags aid analysts in connecting the dots between current incidents and investigations and their historical context for improved analysis. +Defender TI tags are used to provide quick insight about an indicator, whether derived by the system or generated by other users. Tags aid analysts in connecting the dots between current incidents and investigations and their historical context for improved analysis. The Defender TI platform offers two types of tags: system tags and custom tags. For more information, see [Using tags](using-tags.md). ## Projects -MicrosoftΓÇÖs Defender TI platform allows users to develop multiple project types for organizing indicators of interest and indicators of compromise from an investigation. Projects contain a listing of all associated artifacts and a detailed history that retains the names, descriptions, and collaborators. +Microsoft Defender TI platform allows users to develop multiple project types for organizing indicators of interest and indicators of compromise from an investigation. Projects contain a listing of all associated indicators and a detailed history that retains the names, descriptions, and collaborators. -When a user searches an IP address, domain, or host in Defender TI, if that indicator is listed within a project the user has access to, the user can see a link to the project from the Projects sections in the Summary tab as well as Data tab. From here, the user can navigate to the details of the project for more context about the indicator before reviewing the other data sets for more information. This helps analysts to avoid reinventing the wheel of an investigation one of their Defender TI tenant users may have already started or add onto that investigation by adding new artifacts (indicators of compromise) related to that project (if they have been added as a collaborator to the project). +When a user searches an IP address, domain, or host in Defender TI, if that indicator is listed within a project the user has access to, the user can see a link to the project from the Projects sections in the Summary tab as well as Data tab. From here, the user can navigate to the details of the project for more context about the indicator before reviewing the other data sets for more information. This helps analysts to avoid reinventing the wheel of an investigation one of their Defender TI tenant users may have already started or add onto that investigation by adding new indicators (indicators of compromise) related to that project (if they have been added as a collaborator to the project). For more information, see [Using projects](using-projects.md). |
| enterprise | Microsoft 365 For The Web Monitoring | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/enterprise/microsoft-365-for-the-web-monitoring.md | + + Title: "Microsoft 365 for the web monitoring" +++ Last updated : 08/15/2023+audience: Admin +++ms.localizationpriority: medium +search.appverid: +- MET150 ++- scotvorg +- Ent_O365 +- Strat_O365_Enterprise ++f1.keywords: +- NOCSH +description: "Use Microsoft 365 monitoring for information about incidents or advisories in Microsoft 365." +++# Microsoft 365 for the web monitoring ++You can use Microsoft 365 for the web monitoring in the [Microsoft 365 admin center](https://go.microsoft.com/fwlink/p/?linkid=2024339) to monitor the health of the Microsoft 365 for the web service for your organization's Microsoft 365 subscription. Microsoft 365 for the web monitoring provides you with information about incidents and advisories related to any issue detected in the Microsoft 365 infrastructure that Microsoft owns for providing regular updates and resolving the issue. For example, users cannot open or save Excel for the web application because of issues with Excel or the Microsoft 365 cloud infrastructure. ++To go to the **Service health** dashboard in the Microsoft 365 admin center, select **Health > Service health**. ++Issues in your organization are identified and used by organizational-level monitoring. The value in the **Health** column under **Microsoft service health** indicates that the service is healthy or has advisories or incidents based on the cloud services that Microsoft maintains. ++Here’s an example of the Microsoft 365 for the web monitoring page in the Microsoft 365 admin center that shows the health of organization-level scenarios available by going to **Health > Service health > Microsoft 365 for the web**. ++ ++ ++++ ++ ++With the **Microsoft 365 for the web** monitoring page, you can see whether the Microsoft 365 for the web service is healthy or not and whether there are any associated incidents or advisories for any underlying Microsoft 365 for the web apps. With Microsoft 365 for the web monitoring, you can look at the service health for specific app scenarios and view near real-time signals to determine the impact by organization-level scenario. ++ ++## Organization-level scenarios ++Microsoft 365 for the web monitoring supports the following scenarios: ++- **Word for the web**: View the health for “Document Open” and “Document Save” scenarios. ++- **Excel for the web**: View the health for “Sheet Open” and “Sheet Save” scenarios. ++- **PowerPoint for the web**: View the health for Deck Open” and “Deck Save” scenarios. ++- **OneNote for the web**: View the health for “Note Open” and “Note Save” scenarios. ++- **Visio for the web**: View the health for “Diagram Open” and “Diagram Save” scenarios. ++ +++Detailed views for each of these scenarios show the near real-time trend for the past seven days with the 60-minute aggregate compared with the previous week. ++ + + ++## Send us feedback ++Use the **Give feedback** option available on every page of the Microsoft 365 admin center. ++ |
| lighthouse | M365 Lighthouse Manage Sspr | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/lighthouse/m365-lighthouse-manage-sspr.md | The following conditions must be met before a tenant will appear in the list: - The customer tenant must have an Azure AD Premium license for each user. For more information on which licenses support SSPR, see [Licensing requirements for Azure Active Directory self-service password reset](/azure/active-directory/authentication/concept-sspr-licensing). -- The customer tenant must be active within Lighthouse. To learn how to determine if a tenant is active, see [Overview of the Windows 365 (Cloud PCs) page in Microsoft 365 Lighthouse](m365-lighthouse-tenants-page-overview.md).+- The customer tenant must be active within Lighthouse. To learn how to determine if a tenant is active, see [Overview of the Tenants page in Microsoft 365 Lighthouse](m365-lighthouse-tenants-page-overview.md). ## View SSPR tenant status |
| loop | Loop Compliance Summary | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/loop/loop-compliance-summary.md | Loop components created outside of the Loop app in other Microsoft 365 apps (suc Because Loop components are stored as files in OneDrive, there are many capabilities you're already familiar with that function just like any other file in OneDrive of SharePoint. Here are the notable differences from Office files in OneDrive that are **not available** yet for Loop components: - [Sensitivity Labeling](/microsoft-365/compliance/information-protection) (Microsoft Information Protection) at the File-level-- [Data Loss Prevention (DLP)](/microsoft-365/compliance/dlp-learn-about-dlp)-- Graph API to convert .loop file content into HTML+- End-user ability to see [Data Loss Prevention (DLP)](/microsoft-365/compliance/dlp-learn-about-dlp) policy tips +- Graph API to convert Loop content into HTML for export - [Conditional Access](/azure/active-directory/conditional-access/overview) ## Summary of compliance capabilities for content created in Loop workspaces Content created in a Loop workspace is stored in Syntex repository services. You Syntex repository services has many of the same compliance capabilities as the rest of SharePoint and OneDrive. However, the capabilities below are **not available** yet for content created in Loop workspaces. While we continue to improve rapidly in this area, if you require any of these capabilities, Microsoft recommends proactively disabling Loop workspaces using the instructions here: [Manage Loop workspaces in Syntex repository services](/microsoft-365/loop/loop-workspaces-configuration): - [Intune Device Management Support](/mem/intune/remote-actions/device-management)-- Third-party tools for discovery workflows and Graph API export-- Full eDiscovery export using Purview-- Tenant admin experience: Discovery of all Loop workspaces in Purview or SPO Tenant Admin center-- Tenant admin experience: Restoring a deleted workspace or pages-- [Retention Policies, Retention Labels, and Preservation Hold](/microsoft-365/compliance/retention-policies-sharepoint)-- [Legal Hold](/sharepoint/governance/ediscovery-and-in-place-holds-in-sharepoint-server)+- Third-party tools for discovery workflows and Graph API to convert Loop content into HTML for export +- Tenant admin experience: Restoring a deleted workspace +- End-user ability to see or set [Retention Labels](/microsoft-365/compliance/retention-policies-sharepoint) - [Sensitivity Labeling](/microsoft-365/compliance/information-protection) (Microsoft Information Protection) at the File-level and Container-level+- End-user ability to see [Data Loss Prevention (DLP)](/microsoft-365/compliance/dlp-learn-about-dlp) policy tips +- Audit logs with Loop tag to be able to filter on Loop activity related to item/entity creation, access, alteration, and deletion - Multiple owners on a workspace-- [Data Loss Prevention (DLP)](/microsoft-365/compliance/dlp-learn-about-dlp)-- Granular audit logs that describe all activity related to item/entity creation, access, alteration, and deletion-- [Stream audit log data](/microsoft-365/compliance/audit-log-activities) to 1st and 3rd-party systems for ingestion and analysis-- [Alerting](/microsoft-365/compliance/alert-policies) on unusual data movement or access patterns-- [Multi-Geo](/microsoft-365/enterprise/microsoft-365-multi-geo) support+- [Multi-Geo](/microsoft-365/enterprise/microsoft-365-multi-geo) account move support - [Conditional Access](/azure/active-directory/conditional-access/overview) *This list of capabilities is not exhaustive* |
| security | Corelight Integration | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/corelight-integration.md | - Title: Enable Corelight as data source in Microsoft Defender for Endpoint -description: Enable Corelight integration to gain visibility focused on IoT/OT devices in areas of the network where MDE is not deployed -keywords: enable siem connector, siem, connector, security information and events -search.product: eADQiWindows 10XVcnh --ms.sitesec: library -ms.pagetype: security ------ m365-security-- tier3-- Previously updated : 11/22/2021---# Enable Corelight as data source in Microsoft Defender for Endpoint ---**Applies to:** --- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)-- [Microsoft 365 Defender](https://go.microsoft.com/fwlink/?linkid=2118804)---> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-enablesiem-abovefoldlink) --Microsoft has partnered with [Corelight](https://corelight.com/integrations/iot-security), provider of the industry's leading open network detection and response (NDR) platform, to help you discover IoT/OT devices across your organization. Using data, sent from Corelight network appliances, Microsoft 365 Defender gains increased visibility into the network activities of unmanaged devices, including communication with other unmanaged devices or external networks. --With this data source enabled, all events from Corelight network appliances are sent to Microsoft 365 Defender. You can view these activities in the unmanaged devices timeline, available in the Microsoft Defender for Endpoint device inventory. For more information, see [Device discovery](device-discovery.md). --## Prerequisites --1. To setup the Corelight data integration, the user must have the following roles: - - Tenant Global Administrator in Azure Active Directory - - Security Administrator for the Azure subscription that will be used for the Microsoft Defender for IoT integration -2. An onboarded Defender for IoT plan. For more information, see [Enable Enterprise IoT security with Defender for Endpoint](/azure/defender-for-iot/organizations/eiot-defender-for-endpoint/). --## Enabling the Corelight integration --To enable the Corelight integration, you'll need to take the following steps: --[Step 1: Turn on Corelight as a data source](#step-1-turn-on-corelight-as-a-data-source)<br> -[Step 2: Provide permission for Corelight to send events to Microsoft 365 Defender](#step-2-provide-permission-for-corelight-to-send-events-to-microsoft-365-defender)<br> -[Step 3: Configure your Corelight appliance to send data to Microsoft 365 Defender](#step-3-configure-your-corelight-appliance-to-send-data-to-microsoft-365-defender) --### Step 1: Turn on Corelight as a data source --1. In the navigation pane of the [https://security.microsoft.com](https://security.microsoft.com/) portal, select **Settings** \> **Device discovery** \> **Data sources**. -- :::image type="content" source="../../media/defender-endpoint/enable-corelight.png" alt-text="The data sources page in the Microsoft 365 Defender portal" lightbox="../../media/defender-endpoint/enable-corelight.png"::: --2. Select **Send Corelight data to M365D** and select **Save**. --### Step 2: Provide permission for Corelight to send events to Microsoft 365 Defender --> [!NOTE] -> You must be a global admin to grant Corelight permission to access resources in your organization. --1. As a Tenant Global Administrator, go to this [link](<https://login.microsoftonline.com/common/oauth2/authorize?prompt=consent&client_id=d8be544e-9d1a-4825-a5cb-fb447457f692&response_type=code&sso_reload=true>) to grant permission. -2. Go to [https://security.microsoft.com](https://security.microsoft.com/) portal, select **Settings** \> **Microsoft 365 Defender**, and take note of the **Tenant ID**. You'll need this information when configuring your Corelight appliance. --### Step 3: Configure your Corelight appliance to send data to Microsoft 365 Defender --> [!NOTE] -> The integration is available in Corelight Sensor software v25 and later. -> -> You will need internet connectivity for your sensor to reach both the Defender and Corelight cloud services for the solution to work. --#### Enable the integration in the Corelight web interface --1. In the Corelight web interface, navigate to **Sensor** \> **Export**. -- :::image type="content" source="images/exporttodefender.png" alt-text="The kafka export" lightbox="images/exporttodefender.png"::: --2. Enable **Export To Microsoft Defender**. -3. Enter your Microsoft 356 Defender Tenant ID. -4. Optionally, you can: - - set the **Zeek Logs to Exclude**. The minimal set of logs you must include are: dns, conn, files, http, ssl, ssh, x509, snmp, smtp, ftp, sip, dhcp, and notice. - - choose to create a **Microsoft Defender Log Filter**. -5. Select **Apply Changes**. --#### Enable the integration in the corelight-client --1. Enable **Export To Microsoft Defender** using the following command in the corelight-client: -- ``` command - corelight-client configuration update \ - --bro.export.defender.enable True - ``` --2. Set your tenant ID --3. Optionally, you can use the following command to exclude certain logs or to create a Microsoft Defender log filter. The minimal set of logs you must include are: dns, conn, files, http, ssl, ssh, x509, snmp, smtp, ftp, sip, dhcp, and notice. -- ``` command - corelight-client configuration update \ - --bro.export.defender.exclude=<logs_to_exclude> \ - --bro.export.defender.filter=<logs_to_filter> - ``` --## See also --- [Device discovery FAQ](device-discovery-faq.md) |
| security | Device Discovery | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/device-discovery.md | Network devices aren't managed as standard endpoints, as Defender for Endpoint d For more information, see [Network devices](network-devices.md). -## Device discovery Integrations +## Device discovery Integration -To address the challenge of gaining enough visibility to locate, identify, and secure your complete OT/IOT asset inventory Microsoft Defender for Endpoint now supports the following integrations: --- **Corelight**: Microsoft has partnered with Corelight to receive data from Corelight network appliances. This provides Microsoft 365 Defender with increased visibility into the network activities of unmanaged devices, including communication with other unmanaged devices or external networks. for more information, see [Enable Corelight data integration](corelight-integration.md).+To address the challenge of gaining enough visibility to locate, identify, and secure your complete OT/IOT asset inventory Microsoft Defender for Endpoint now supports the following integration: - **Microsoft Defender for IoT**: This integration combines Microsoft Defender for Endpoint's device discovery capabilities, with the agentless monitoring capabilities of Microsoft Defender for IoT, to secure enterprise IoT devices connected to an IT network (for example, Voice over Internet Protocol (VoIP), printers, and smart TVs). For more information, see [Enable Enterprise IoT security with Defender for Endpoint](/azure/defender-for-iot/organizations/eiot-defender-for-endpoint/). |
| security | Mac Whatsnew | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/mac-whatsnew.md | Apple has fixed an issue on macOS [Ventura upgrade](<https://developer.apple.com Microsoft Defender for Endpoint no longer supports macOS Catalina (10.15) as Apple ended support for Catalina (10.15) in December 2022. </br> +### Aug-2023 (Build: 101.23062.0016 | Release version: 20.123062.16.0) ++| Build: | **101.23062.0016** | +|--|--| +| Release version: | **20.123062.16.0** | +| Engine version: | **1.1.23050.3** | +| Signature version: | **1.395.436.0** | ++##### What's new ++- Bug and performance fixes +- Fix: macOS complains that uninstall background task is from unidentified developer + ### Jul-2023 (Build: 101.23052.0004 | Release version: 20.123052.4.0) | Build: | **101.23052.0004** | |
| security | Machines View Overview | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/machines-view-overview.md | From the **Network devices** and **IoT devices** tabs, you'll also see informati  > [!NOTE]-> Device discovery Integrations with [Microsoft Defender for IoT](/azure/defender-for-iot/organizations/) and [Corelight](https://corelight.com/integrations/iot-security) are available to help locate, identify, and secure your complete OT/IOT asset inventory. Devices discovered with these integrations will appear on the **IoT devices** tab. For more information, see [Device discovery integrations](device-discovery.md#device-discovery-integrations). +> Device discovery Integration with [Microsoft Defender for IoT](/azure/defender-for-iot/organizations/) is available to help locate, identify, and secure your complete OT/IOT asset inventory. Devices discovered with this integration will appear on the **IoT devices** tab. For more information, see [Device discovery integration](device-discovery.md#device-discovery-integration). > > When Defender for IoT is configured, you also can view the devices there. See [Manage your IoT devices with the device inventory for organizations](/azure/defender-for-iot/organizations/how-to-manage-device-inventory-for-organizations). |
| security | Partner Applications | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/partner-applications.md | Logo|Partner name|Description :|:|: |[Aruba ClearPass Policy Manager](https://go.microsoft.com/fwlink/?linkid=2127544)|Ensure Defender for Endpoint is installed and updated on each endpoint before allowing access to the network |[Blue Hexagon for Network](/training/modules/explore-malware-threat-protection/)|Blue Hexagon has built the industry's first real-time deep learning platform for network threat protection-| [Corelight](https://corelight.com/integrations/iot-security)| Using data, sent from Corelight network appliances, Microsoft 365 Defender gains increased visibility into the network activities of unmanaged devices, including communication with other unmanaged devices or external networks. |[CyberMDX](https://go.microsoft.com/fwlink/?linkid=2135620)|Cyber MDX integrates comprehensive healthcare assets visibility, threat prevention and repose into your Defender for Endpoint environment |[HYAS Protect](https://go.microsoft.com/fwlink/?linkid=2156763)|HYAS Protect utilizes authoritative knowledge of attacker infrastructure to proactively protect Microsoft Defender for Endpoint endpoints from cyberattacks |[Vectra Network Detection and Response (NDR)](https://go.microsoft.com/fwlink/?linkid=866934)|Vectra applies AI & security research to detect and respond to cyber-attacks in real time |
| security | Technological Partners | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/technological-partners.md | The following are the solution's categories: |[HYAS Protect](https://www.hyas.com/hyas-protect)|HYAS|HYAS Protect utilizes authoritative knowledge of attacker infrastructure to proactively protect MDE endpoints from cyber attacks.| |[Better Mobile Security Platform](https://go.microsoft.com/fwlink/?linkid=2202043)|Better Mobile Security Inc.|Provides solution for Threat, Phishing and Privacy Protection and Simulation.| |[Vulnerability Control](https://go.microsoft.com/fwlink/?linkid=2201965)|Skybox security|Global security posture management leader with solutions for vulnerability management and network security policy management.|-|[Open NDR](https://go.microsoft.com/fwlink/?linkid=2201964)|Corelight|Augment device inventory in Microsoft 365 Defender with network evidence for complete visibility.| ### Identity security |
| security | Whats New In Microsoft Defender Endpoint | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md | For more information on Microsoft Defender for Endpoint on specific operating sy - [Built-in protection](built-in-protection.md) is now generally available. Built-in protection helps protect your organization from ransomware and other threats with default settings that help ensure your devices are protected. -- Zeek is now generally available as a component of Microsoft Defender for Endpoint.-- Microsoft has partnered with [Corelight](https://corelight.com/company/zeek-now-component-of-microsoft-windows), a leader in open source Network Detection and Response (NDR), to provide a new open-source integration with [Zeek](https://corelight.com/about-zeek/how-zeek-works) for Defender for Endpoint. With this integration, organizations can super-charge their investigation efforts with rich network signals and reduce the time it takes to detect network-based threats by having unprecedented visibility into network traffic from the endpoints' perspective. -- The new Zeek integration is available in the latest version of the Defender for Endpoint agent via the following knowledge base articles: - - [KB5016691](https://support.microsoft.com/topic/august-25-2022-kb5016691-os-build-22000-918-preview-59097044-915a-49a0-8870-49823236adbd) - - [KB5016693](https://support.microsoft.com/topic/august-16-2022-kb5016693-os-build-20348-946-preview-ee90d0bc-c162-4124-b7c6-f963ee7b17ed) - - [KB5016688](https://support.microsoft.com/topic/august-26-2022-kb5016688-os-builds-19042-1949-19043-1949-and-19044-1949-preview-ec31ebdc-067d-44dd-beb0-eabcc984d843) - - [KB5016690](https://support.microsoft.com/topic/august-23-2022-kb5016690-os-build-17763-3346-preview-b81d1ac5-75c7-42c1-b638-f13aa4242f42) -- > [!NOTE] - > This integration doesn't currently support the use of custom scripts to gain visibility into extra signals. -- ## October 2022 - [Network protection C2 detection and remediation is now generally available](network-protection.md#block-command-and-control-attacks). <br/>Attackers often compromise existing internet-connected servers to become their command and control servers. Attackers can use the compromised servers to hide malicious traffic and deploy malicious bots that are used to infect endpoints. Network protection detection and remediation will help improve the time it takes security operations (SecOps) teams to pinpoint and respond to malicious network threats that are looking to compromise endpoints. |
| security | How Policies And Protections Are Combined | https://github.com/MicrosoftDocs/microsoft-365-docs/commits/public/microsoft-365/security/office-365-security/how-policies-and-protections-are-combined.md | The following table describes how conflicts are resolved if an email is affected |Block entries for spoofed senders in the Tenant Allow/Block List|**Tenant wins**: Spoof intelligence action in the applicable anti-phishing policy|**Tenant wins**: Spoof intelligence action in the applicable anti-phishing policy| |Advanced delivery policy|**User wins**: Email delivered to mailbox|**Tenant wins**: Email delivered to mailbox| |Block settings in anti-spam policies|**User wins**: Email delivered to mailbox|**User wins**: Email delivered to user's Junk Email folder|+|Blocks by mail flow rules|**User wins**: Email delivered to mailbox|**User wins**: Email delivered to user's Junk Email folder| |Allows by: <ul><li>Mail flow rules</li><li>IP Allow List (connection filter policy)</li><li>Allowed sender and domain list (anti-spam policies)</li><li>Tenant Allow/Block List</li></ul>|**User wins**: Email delivered to mailbox|**User wins**: Email delivered to user's Junk Email folder| |