TOC.yml

- name: Microsoft Defender for Endpoint
  href: index.yml
  expanded: true
  items:
  - name: Zero Trust with Defender for Endpoint
    href: zero-trust-with-microsoft-defender-endpoint.md
  - name: Overview
    items:
    - name: What is Microsoft Defender for Endpoint?
      items: 
      - name: Defender for Endpoint
        href: microsoft-defender-endpoint.md
      - name: Defender for Endpoint on macOS
        href: microsoft-defender-endpoint-mac.md
      - name: Defender for Endpoint on Linux
        href: microsoft-defender-endpoint-linux.md
      - name: Defender for Endpoint on Android
        href: microsoft-defender-endpoint-android.md
      - name: Defender for Endpoint on iOS
        href: microsoft-defender-endpoint-ios.md
      - name: Defender for Endpoint for US Government customers
        href: gov.md
      - name: Supported Defender for Endpoint capabilities by platform
        href: supported-capabilities-by-platform.md
      - name: Antivirus solution compatibility with Defender for Endpoint
        href: defender-compatibility.md
      - name: Defender for Endpoint Plan 1
        items:
        - name: Overview of Defender for Endpoint Plan 1
          href: defender-endpoint-plan-1.md
        - name: Setup and configuration
          href: mde-p1-setup-configuration.md
        - name: Get started
          href: mde-plan1-getting-started.md
    - name: What's new in Defender for Endpoint
      href: whats-new-in-microsoft-defender-endpoint.md
      items: 
      - name: MsSense versions (Windows)
        href: windows-whatsnew.md
      - name: Defender for Endpoint on macOS releases
        href: mac-whatsnew.md
      - name: Defender for Endpoint on Linux releases
        href: linux-whatsnew.md
      - name: What's new in Defender for Endpoint on Android
        href: android-whatsnew.md
      - name: What's new in Defender for Endpoint on iOS
        href: ios-whatsnew.md
      - name: Previous Defender for Endpoint releases (archive)
        href: whats-new-mde-archive.md
    - name: Trial user guide - Defender for Endpoint
      href: defender-endpoint-trial-user-guide.md
    - name: Pilot and deploy Defender for Endpoint
      href: /defender-xdr/pilot-deploy-defender-endpoint?toc=/defender-endpoint/TOC.json&bc=/defender-endpoint/breadcrumb/toc.json

    - name: Preview features
      href: /defender-xdr/preview
    - name: Data storage and privacy
      href: data-storage-privacy.md

  - name: Microsoft Defender for Endpoint demonstrations and evaluation
    items:
    - name: Evaluate Microsoft Defender Antivirus
      href: evaluate-microsoft-defender-antivirus.md
      items:
      - name: Guidance for pen testing and BAS scenarios
        href: guidance-for-pen-testing-and-bas.md
      - name: Evaluate Microsoft Defender Antivirus using PowerShell
        href: microsoft-defender-antivirus-using-powershell.md
      - name: Evaluate Microsoft Defender Antivirus using Microsoft Defender Endpoint Security Settings Management
        href: evaluate-mda-using-mde-security-settings-management.md
      - name: Evaluate Microsoft Defender Antivirus using Group Policy 
        href: evaluate-mdav-using-gp.md  
    - name: Demonstration scenarios
      href: defender-endpoint-demonstrations.md
      items:
      - name: AMSI demonstrations
        href: mde-demonstration-amsi.md
      - name: Antimalware validation demonstration
        href: validate-antimalware.md
      - name: Attack surface reduction rules demonstration
        href: defender-endpoint-demonstration-attack-surface-reduction-rules.md
      - name: App reputation demonstration
        href: defender-endpoint-demonstration-app-reputation.md
      - name: Behavior monitoring demonstration
        href: demonstration-behavior-monitoring.md
      - name: Cloud-delivered protection
        href: defender-endpoint-demonstration-cloud-delivered-protection.md
      - name: Controlled folder access (block script) demonstration
        href: defender-endpoint-demonstration-controlled-folder-access-test-tool.md
      - name: Controlled folder access (block ransomware) demonstration
        href: defender-endpoint-demonstration-controlled-folder-access.md
      - name: EDR detections demonstration
        href: edr-detection.md
      - name: Exploit protection demonstration
        href: defender-endpoint-demonstration-exploit-protection.md
      - name: Network protection demonstration
        href: defender-endpoint-demonstration-network-protection.md
      - name: Potentially unwanted applications demonstration
        href: defender-endpoint-demonstration-potentially-unwanted-applications.md
      - name: URL reputation demonstrations
        href: defender-endpoint-demonstration-smartscreen-url-reputation.md
 
  - name: Operationalize Microsoft Defender for Endpoint
    items:
      - name: Deploy Defender for Endpoint
        items:
        - name: Overview
          href: mde-planning-guide.md
        - name: Step 1 - Prepare for deployment
          href: production-deployment.md
        - name: Step 2 - Assign roles and permissions
          href: prepare-deployment.md
        - name: Step 3 - Identify your architecture and select a deployment method
          href: deployment-strategy.md
        - name: Step 4 - Onboard devices to Defender for Endpoint
          href: onboarding.md
        - name: Step 5 - Configure Defender for Endpoint capabilities
          href: onboard-configure.md

      - name: Onboard and configure devices
        items:
        - name: Configure service connections
          items:
            - name: Step 1 - Configure your network environment 
              href: configure-environment.md
            - name: Step 2 - Configure device proxy and Internet settings
              href: configure-proxy-internet.md
            - name: Step 3 - Verify client connectivity to service URLs
              href: verify-connectivity.md        
            - name: Onboard devices using streamlined method
              href: configure-device-connectivity.md            
            - name: Migrate devices to streamlined method
              href: migrate-devices-streamlined.md
            - name: Enable access to service URLs - US government            
              href: streamlined-device-connectivity-urls-gov.md                       
        - name: Onboard client devices
          items:
          - name: Onboard Windows devices using the Defender deployment tool
            href: defender-deployment-tool-windows.md
          - name: Onboard client devices running Windows or macOS
            href: onboard-client.md
          - name: Defender for Endpoint plug-in for WSL
            href: mde-plugin-wsl.md
          - name: Onboard Windows devices to Defender for Endpoint using Intune
            href: configure-endpoints-mdm.md
          - name: Onboard Windows devices to Defender for Endpoint using Microsoft Configuration Manager
            href: configure-endpoints-sccm.md
          - name: Onboard Windows devices to Defender for Endpoint using Group Policy
            href: configure-endpoints-gp.md
          - name: Onboard Windows devices to Defender for Endpoint using a local script
            href: configure-endpoints-script.md
          - name: Onboard non-persistent virtual desktop infrastructure (VDI) devices
            href: configure-endpoints-vdi.md
          - name: Onboard Windows 10 multi-session devices in Azure Virtual Desktop
            href: onboard-windows-multi-session-device.md
          - name: Onboard previous versions of Windows
            href: onboard-downlevel.md

        - name: Onboard server devices
          items:
          - name: Onboard servers through Defender for Endpoint's experience
            href: onboard-server.md
          - name: Onboard Windows devices using Configuration Manager
            href: configure-endpoints-sccm.md
          - name: Onboard Windows devices using Group Policy
            href: configure-endpoints-gp.md
          - name: Onboard Windows devices using a local script
            href: configure-endpoints-script.md
          - name: Onboard non-persistent virtual desktop infrastructure (VDI) devices
            href: configure-endpoints-vdi.md
          - name: Direct onboarding with Defender for Cloud
            href: /azure/defender-for-cloud/onboard-machines-with-defender-for-endpoint?toc=/defender-endpoint/toc.json&bc=/defender-endpoint/breadcrumb/toc.json
          - name: Defender for Endpoint on Windows Server with SAP
            href: mde-sap-windows-server.md
          - name: Deployment guidance for Defender for Endpoint on Linux for SAP
            href: mde-linux-deployment-on-sap.md
          - name: Use custom detection rules to protect SAPXPG
            href: mde-sap-custom-detection-rules.md

        - name: Defender for Endpoint on macOS
          items:
          - name: Deploy Defender for Endpoint on macOS
            items:
            - name: Microsoft Defender for Endpoint Prerequisites on macOS
              href: microsoft-defender-endpoint-mac-prerequisites.md
            - name: Deployment with Microsoft Intune
              href: mac-install-with-intune.md
            - name: JAMF Pro-based deployment
              items:
              - name: Deploying Microsoft Defender for Endpoint on macOS using Jamf Pro
                href: mac-install-with-jamf.md
              - name: Log in to Jamf Pro
                href: mac-install-jamfpro-login.md
              - name: Set up device groups
                href: mac-jamfpro-device-groups.md
              - name: Set up policies
                href: mac-jamfpro-policies.md
              - name: Enroll devices
                href: mac-jamfpro-enroll-devices.md        
            - name: Deployment with other Mobile Device Management (MDM) systems
              href: mac-install-with-other-mdm.md
            - name: Manual deployment
              href: mac-install-manually.md
          - name: Configure Defender for Endpoint on macOS
            items:
              - name: Configure and validate exclusions on Mac
                href: mac-exclusions.md
              - name: Set preferences on Mac
                href: mac-preferences.md 
              - name: Detect and block potentially unwanted applications on Mac
                href: mac-pua.md
              - name: Protect macOS security settings using tamper protection
                href: tamperprotection-macos.md
              - name: Configure offline security intelligence updates on Mac
                href: mac-support-offline-security-intelligence-update.md
              - name: Device control
                items:
                - name: Device control overview on Mac
                  href: mac-device-control-overview.md
                - name: JAMF examples
                  href: mac-device-control-jamf.md
                - name: Intune examples
                  href: mac-device-control-intune.md
                - name: macOS Device Control frequently asked questions (FAQ)
                  href: mac-device-control-faq.md
              - name: Schedule scans on Mac
                href: mac-schedule-scan.md
          - name: Update Defender for Endpoint on macOS
            href: mac-updates.md
          - name: Privacy for Microsoft Defender for Endpoint on macOS
            href: mac-privacy.md
          - name: Resources for Microsoft Defender for Endpoint on macOS
            href: mac-resources.md
          - name: Troubleshoot Microsoft Defender for Endpoint on macOS
            items:
            - name: Troubleshoot agent health issues
              href: mac-health-status.md
            - name: Troubleshooting mode on macOS
              href: mac-troubleshoot-mode.md
            - name: Troubleshoot macOS installation issues
              href: mac-support-install.md
            - name: Troubleshoot macOS configuration
              href: mac-support-configuration.md
            - name: Troubleshoot macOS performance issues overview
              href: mac-support-perf-overview.md
              displayName: Troubleshoot performance issues for Microsoft Defender for Endpoint on macOS
            - name: Troubleshoot performance issues
              href: mac-support-perf.md
            - name: Troubleshoot cloud connectivity
              href: troubleshoot-cloud-connect-mdemac.md
            - name: Troubleshoot license issues
              href: mac-support-license.md
            - name: Troubleshoot system extention issues
              href: mac-support-sys-ext.md
              items:
              - name: Intune
                href: manage-profiles-approve-sys-extensions-intune.md
              - name: JamF
                href: manage-sys-extensions-using-jamf.md
              - name: Manual deployment
                href: manage-sys-extensions-manual-deployment.md
           
        - name: Defender for Endpoint on Linux
          items:
          - name: Deploy Defender for Endpoint on Linux
            items:
            - name: Prerequisites
              href: mde-linux-prerequisites.md
            - name: Choose a deployment method                       
              items:
              - name: Enabling deployment to a custom location
                href: linux-custom-location-installation.md
              - name: Deployment tool based deployment
                href: linux-install-with-defender-deployment-tool.md
              - name: Installer script based deployment
                href: linux-installer-script.md
              - name: Ansible based deployment
                href: linux-install-with-ansible.md
              - name: Chef based deployment
                href: linux-deploy-defender-for-endpoint-with-chef.md
              - name: Puppet based deployment
                href: linux-install-with-puppet.md
              - name: Saltstack based deployment
                href: linux-install-with-saltack.md
              - name: Manual deployment
                href: linux-install-manually.md
              - name: Golden image based deployment
                href: linux-deploy-defender-for-endpoint-using-golden-images.md
              - name: Direct onboarding with Defender for Cloud
                href: /azure/defender-for-cloud/onboard-machines-with-defender-for-endpoint?toc=/defender-endpoint/toc.json&bc=/defender-endpoint/breadcrumb/toc.json
              - name: Deployment guidance for Defender for Endpoint on Linux for SAP
                href: mde-linux-deployment-on-sap.md
          - name: Configure Defender for Endpoint on Linux
            items:
            - name: Configure security policies and settings
              href: linux-preferences.md
            - name: Static proxy configuration
              href: linux-static-proxy-configuration.md
            - name: Configure antivirus scans
              items:
              - name: Configure Microsoft Defender Antivirus scans on Linux
                href: schedule-anti-virus-scans-linux.md
              - name: Schedule antivirus scans using Anacron
                href: schedule-antivirus-scan-anacron.md
              - name: Schedule antivirus scans using Crontab
                href: schedule-antivirus-scan-crontab.md
            - name: Network protection for Linux
              href: network-protection-linux.md
            - name: Configure and validate exclusions on Linux
              href: linux-exclusions.md
            - name: Configure eBPF-based sensor
              href: linux-support-ebpf.md 
            - name: Detect and block Potentially Unwanted Applications
              href: linux-pua.md
            - name: Configure Offline Security Intelligence Update
              href: linux-support-offline-security-intelligence-update.md
          - name: Update Defender for Endpoint on Linux
            items: 
            - name: Update Defender for Endpoint on Linux
              href: linux-updates.md
            - name: Schedule an update for Defender for Endpoint on Linux
              href: linux-update-mde-linux.md
          - name: Privacy for Defender for Endpoint on Linux
            href: linux-privacy.md
          - name: Additional resources for Defender for Endpoint on Linux
            href: linux-resources.md
        - name: Mobile Threat Defense
          items:
            - name: Mobile Threat Defense overview
              href: mtd.md
            - name: Deploy
              items:
              - name: Deployment on Android with Microsoft Intune
                href: android-intune.md
              - name: Deployment on iOS via Microsoft Intune
                href: ios-install.md
              - name: Deployment on iOS with Mobile Application Manager
                href: ios-install-unmanaged.md
            - name: Configure Mobile Threat Defense
              items:
              - name: User experiences in Defender for Endpoint on Android
                href: android-new-ux.md
              - name: User experiences in Defender for Endpoint on iOS
                href: ios-new-ux.md
              - name: Mobile device resources for Defender for Endpoint 
                href: mobile-resources-defender-endpoint.md
              - name: Configure Defender for Endpoint on Android features
                href: android-configure.md
              - name: Configure Defender for Endpoint on Android risk signals using app protection policy
                href: android-configure-mam.md
              - name: Privacy for Defender for Endpoint on Android
                href: android-privacy.md
              - name: Configure Defender for Endpoint on iOS features
                href: ios-configure-features.md
              - name: Privacy for Defender for Endpoint on iOS
                href: ios-privacy.md
        - name: Run a detection test on a newly onboarded Microsoft Defender for Endpoint
          href: run-detection-test.md

      - name: Configure portal settings
        items:
        - name: Configure general Defender for Endpoint settings
          href: preferences-setup.md
        - name: General
          items:
          - name: Configure alert notifications
            href: /defender-xdr/configure-email-notifications
          - name: Configure vulnerability email notifications
            href: configure-vulnerability-email-notifications.md
          - name: Configure advanced features
            href: advanced-features.md

        - name: Permissions
          items:
          - name: Use basic permissions to access the portal
            href: basic-permissions.md
          - name: Assign user access to the portal
            href: assign-portal-access.md
            items:
            - name: Create and manage roles
              href: user-roles.md
            - name: Create and manage device groups
              href: machine-groups.md
            - name: Create and manage device tags
              href: machine-tags.md
        - name: Rules and exclusions
          items:
          - name: Exclusions overview
            href: navigate-defender-endpoint-antivirus-exclusions.md
          - name: Manage suppression rules
            href: manage-suppression-rules.md
          - name: Indicators
            items:
            - name: Overview of indicators
              href: indicators-overview.md
            - name: Create indicators for files
              href: indicator-file.md
            - name: Create indicators for IPs and URLs/domains
              href: indicator-ip-domain.md
            - name: Create indicators for certificates
              href: indicator-certificates.md
            - name: Manage indicators
              href: indicator-manage.md
            - name: Manage automation file uploads
              href: manage-automation-file-uploads.md
            - name: Manage automation folder exclusions
              href: manage-automation-folder-exclusions.md

        - name: Device management
          items:
            - name: Onboarding devices
              href: onboarding.md
            - name: Offboarding devices
              href: offboard-machines.md
            - name: Ensure your devices are configured properly
              href: configure-machines.md
            - name: Monitor and increase device onboarding
              href: configure-machines-onboarding.md
            - name: Updating MMA on Windows devices
              href: update-agent-mma-windows.md

        - name: Configure time zone settings
          href: time-settings.md

      - name: Safeguard and manage your environment 
        items:
          - name: Managing exclusions reference
            href: managing-exclusions.md
          - name: Address unwanted behaviors with exclusions, indicators, and other techniques
            href: address-unwanted-behaviors-mde.md
          - name: Safe deployment practices
            href: mde-sdp-strategy.md

      - name: Defender for Endpoint Security Operations Guide 
        href: mde-sec-ops-guide.md
      - name: Troubleshoot
        items:
        - name: Troubleshoot antivirus scan issues
          href: troubleshoot-mdav-scan-issues.md
        - name: Troubleshoot onboarding issues
          items:
          - name: Troubleshoot issues during onboarding
            href: troubleshoot-onboarding.md
          - name: Troubleshoot subscription and portal access issues
            href: troubleshoot-onboarding-error-messages.md
          - name: Troubleshoot security configuration management onboarding issues
            href: troubleshoot-security-config-mgt.md
          - name: Troubleshoot problems with tamper protection
            href: troubleshoot-problems-with-tamper-protection.yml
          - name: Troubleshooting migration issues
            href: switch-to-mde-troubleshooting.md
        - name: Troubleshoot sensor state
          items:
          - name: Check sensor state
            href: check-sensor-status.md
          - name: Fix unhealthy sensors
            href: fix-unhealthy-sensors.md
          - name: Inactive devices
            href: fix-unhealthy-sensors.md#inactive-devices
          - name: Misconfigured devices
            href: fix-unhealthy-sensors.md#misconfigured-devices
          - name: Review sensor events and errors on machines using Event Viewer
            href: event-error-codes.md

        - name: Troubleshoot Microsoft Defender for Endpoint on macOS
          items:
          - name: Troubleshoot NetExt issues with Defender for Endpoint on Mac
            href: mac-troubleshoot-netext-mde.md
          - name: Troubleshooting mode on macOS
            href: mac-troubleshoot-mode.md
          - name: Troubleshoot macOS installation issues
            href: mac-support-install.md
          - name: Troubleshoot macOS performance issues overview
            href: mac-support-perf-overview.md
            displayName: Troubleshoot performance issues for Defender for Endpoint on macOS
          - name: Troubleshoot performance issues
            href: mac-support-perf.md
          - name: Troubleshoot cloud connectivity
            href: troubleshoot-cloud-connect-mdemac.md
          - name: Troubleshoot license issues
            href: mac-support-license.md
          - name: Troubleshoot system extention issues
            href: mac-support-sys-ext.md
            items:
            - name: Intune
              href: manage-profiles-approve-sys-extensions-intune.md
            - name: JamF
              href: manage-sys-extensions-using-jamf.md
            - name: Manual deployment
              href: manage-sys-extensions-manual-deployment.md

        - name: Troubleshoot Microsoft Defender for Endpoint on Linux
          items:
          - name: Troubleshoot Linux installation issues
            href: linux-support-install.md
          - name: Investigate agent health issues
            href: health-status.md
          - name: Troubleshoot cloud connectivity issues
            href: linux-support-connectivity.md
          - name: Troubleshoot performance issues
            href: linux-support-perf.md
          - name: Troubleshoot missing events issues
            href: linux-support-events.md

        - name: Troubleshoot Mobile Threat Defense
          items:
          - name: Troubleshoot Microsoft Defender for Endpoint on Android issues
            href: android-support-signin.md
          - name: Troubleshoot Microsoft Defender for Endpoint on iOS issues
            href: ios-troubleshoot.md

        - name: Troubleshoot sensor health issues using Client Analyzer
          items:
          - name: Client analyzer overview
            href: overview-client-analyzer.md
          - name: Run the client analyzer on Windows
            href: run-analyzer-windows.md
          - name: Run the client analyzer on Linux
            href: run-analyzer-linux.md
          - name: Run the client analyzer on macOS
            href: run-analyzer-macos.md
          - name: Diagnose issues with Client Analyzer
            href: use-client-analyzer.md        
          - name: Data collection for advanced troubleshooting on Windows
            href: data-collection-analyzer.md
          - name: Understand the analyzer HTML report
            href: analyzer-report.md
          - name: Provide feedback on the client analyzer tool
            href: analyzer-feedback.md

        - name: Troubleshoot Microsoft Defender for Endpoint service issues
          items:
          - name: Troubleshoot service issues
            href: troubleshoot-mdatp.md
          - name: Contact Microsoft Defender for Endpoint support
            href: contact-support.md
        - name: Troubleshoot live response issues
          href: troubleshoot-live-response.md
        - name: Collect support logs using LiveAnalyzer
          href: troubleshoot-collect-support-log.md
        - name: Run remote MDE Client Analyzer traces via live response
          href: troubleshoot-remotely-with-client-analyzer.md
        - name: Troubleshoot Microsoft Defender Antivirus settings
          href: troubleshoot-settings.md
        - name: Troubleshoot Microsoft Defender Antivirus Security intelligence not getting updated
          href: troubleshoot-security-intelligence-not-updated.md 
        - name: Troubleshooting Security Intelligence Updates from Microsoft Update source
          href: security-intelligence-update-tshoot.md
          displayName: Troubleshooting Security Intelligence Updates from Microsoft Update source
        - name: Troubleshoot attack surface reduction issues
          items:
          - name: Network protection
            href: troubleshoot-np.md
          - name: Attack surface reduction rules
            href: troubleshoot-asr.md
          - name: Migrate to Attack surface reduction rules
            href: migrating-asr-rules.md
    
  - name: How to guides
    items:
    - name: Integration with Microsoft Defender for Cloud
      href: azure-server-integration.md
    - name: Create an onboarding or offboarding notification rule
      href: onboarding-notification.md
    - name: Manage Microsoft Defender for Endpoint configuration settings on devices with Microsoft Intune
      href: /intune/intune-service/protect/mde-security-integration
    - name: Manage Defender for Endpoint P1/P2 across devices
      href: defender-endpoint-subscription-settings.md
    - name: Onboarding using Microsoft Configuration Manager
      href: onboarding-endpoint-configuration-manager.md
    - name: Onboarding using Microsoft Intune
      href: onboarding-endpoint-manager.md
    - name: Deploy Microsoft Defender for Endpoint prerelease builds on Android devices
      href: mobile-pretest-android.md   

  - name: Migration guides
    items:
    - name: Migration guides overview
      href: migration-guides.md
    - name: Considerations for side-by-side deployment
      href: mde-side-by-side.md
    - name: Migrate servers to Defender for Cloud
      href: migrating-mde-server-to-cloud.md
    - name: Migrate to Defender for Endpoint
      items:
      - name: Overview
        href: switch-to-mde-overview.md
      - name: Phase 1 - Prepare
        href: switch-to-mde-phase-1.md
      - name: Phase 2 - Setup
        href: switch-to-mde-phase-2.md
      - name: Phase 3 - Onboard
        href: switch-to-mde-phase-3.md
      - name: Server migration scenarios
        items:
        - name: Overview
          href: server-migration.md
        - name: Migrating servers from Microsoft Monitoring Agent to the unified solution
          href: application-deployment-via-mecm.md

  - name: Detect threats and protect endpoints
    items:
    - name: Microsoft Defender Vulnerability Management
      href: /defender-vulnerability-management
    - name: Device discovery
      items:
      - name: Device discovery overview
        href: device-discovery.md
      - name: Configure device discovery
        href: configure-device-discovery.md
      - name: Enterprise IoT security
        items:
        - name: Securing IoT devices in the enterprise
          href: /azure/defender-for-iot/organizations/concept-enterprise/
        - name: Enable Enterprise IoT security with Defender for Endpoint
          href: /azure/defender-for-iot/organizations/eiot-defender-for-endpoint/
        - name: Manage Defender for IoT plans
          href: /azure/defender-for-iot/organizations/manage-subscriptions-enterprise/
      - name: Device discovery FAQ
        href: device-discovery-faq.md  

    - name: Authenticated network scans
      href: network-devices.md
    - name: Devices
      items:
      - name: Device inventory
        href: machines-view-overview.md
      - name: Exclude devices
        href: exclude-devices.md
      - name: Identifying transient devices
        href: transient-device-tagging.md
      - name: Collect custom device data
        items:
        - name: Overview
          href: custom-data-collection.md
        - name: Create custom data collection rules
          href: create-custom-data-collection-rules.md
      - name: Internet facing devices
        href: internet-facing-devices.md
      - name: Device timeline
        href: device-timeline-event-flag.md
      - name: Manage device group and tags
        href: machine-tags.md

    - name: Tamper resiliency
      href: tamper-resiliency.md

    - name: Attack surface reduction
      items:
      - name: Attack surface reduction overview
        href: overview-attack-surface-reduction.md
      - name: Attack surface reduction rules
        items:
        - name: Learn about ASR rules
          href: attack-surface-reduction.md
        - name: Attack surface reduction rules deployment guide
          items:
          - name: Attack surface reduction rules deployment overview
            href: attack-surface-reduction-rules-deployment.md
          - name: Plan attack surface reduction rules deployment
            href: attack-surface-reduction-rules-deployment-plan.md
          - name: Test attack surface reduction rules
            href: attack-surface-reduction-rules-deployment-test.md
          - name: Enable attack surface reduction rules
            href: attack-surface-reduction-rules-deployment-implement.md
          - name: Operationalize attack surface reduction rules
            href: attack-surface-reduction-rules-deployment-operationalize.md
        - name: Attack surface reduction rules reference
          href: attack-surface-reduction-rules-reference.md
        - name: Troubleshoot attack surface reduction rules
          href: troubleshoot-asr-rules.md
        - name: Enable ASR rules alternate configuration methods
          href: enable-attack-surface-reduction.md
      - name: Attack surface reduction FAQ
        href: attack-surface-reduction-faq.yml
      - name: Controlled folder access
        items:
        - name: Protect folders
          href: controlled-folders.md
        - name: Evaluate controlled folder access
          href: evaluate-controlled-folder-access.md
        - name: Enable controlled folder access
          href: enable-controlled-folders.md
        - name: Customize controlled folder access
          href: customize-controlled-folders.md
      - name: Device Control
        items:
        - name: Overview of device control
          href: device-control-overview.md
        - name: Device control walkthroughs
          href: device-control-walkthroughs.md
        - name: Understand device control policies
          href: device-control-policies.md
        - name: Deploy and manage device control with Microsoft Intune
          href: device-control-deploy-manage-intune.md
        - name: Deploy and manage device control with Group Policy
          href: device-control-deploy-manage-gpo.md
        - name: Device control frequently asked questions
          href: device-control-faq.md
      - name: Exploit protection
        items:
        - name: Protect devices from exploits
          href: exploit-protection.md
        - name: Exploit protection evaluation
          href: evaluate-exploit-protection.md
        - name: Enable exploit protection
          href: enable-exploit-protection.md
        - name: Customize exploit protection
          href: customize-exploit-protection.md
        - name: Import, export, and deploy exploit protection configurations
          href: import-export-exploit-protection-emet-xml.md
        - name: Troubleshoot exploit protection mitigations
          href: troubleshoot-exploit-protection-mitigations.md
        - name: Exploit protection reference
          href: exploit-protection-reference.md
      - name: Network protection
        items:
        - name: Protect your network
          href: network-protection.md
        - name: Evaluate network protection
          href: evaluate-network-protection.md
        - name: Turn on network protection
          href: enable-network-protection.md
        - name: Network protection for MacOS
          href: network-protection-macos.md
      - name: Web protection
        items:
        - name: Web protection overview
          href: web-protection-overview.md
        - name: Web threat protection
          items:
          - name: Web threat protection overview
            href: web-threat-protection.md
          - name: Respond to web threats
            href: web-protection-response.md
        - name: Web content filtering
          href: web-content-filtering.md

    - name: Next-generation protection
      items:
      - name: Next-generation protection overview
        href: next-generation-protection.md
        items:
        - name: Overview of Microsoft Defender Antivirus
          href: microsoft-defender-antivirus-windows.md
        - name: Microsoft Defender Antivirus on Windows Server
          href: microsoft-defender-antivirus-on-windows-server.md
        - name: Enable and update Microsoft Defender Antivirus on Windows Server
          href: enable-update-mdav-to-latest-ws.md
        - name: Microsoft Defender Antivirus in the Windows Security app
          href: microsoft-defender-security-center-antivirus.md
        - name: Better together - Microsoft Defender Antivirus and Microsoft Defender for Endpoint
          href: why-use-microsoft-defender-antivirus.md
        - name: Better together - Microsoft Defender Antivirus and Office 365
          href: office-365-microsoft-defender-antivirus.md
      - name: Safety Scanner Download
        href: safety-scanner-download.md
      - name: Configure Microsoft Defender Antivirus features
        href: configure-microsoft-defender-antivirus-features.md
      - name: Cloud protection and Microsoft Defender Antivirus
        href: cloud-protection-microsoft-defender-antivirus.md
        items:
        - name: Turn on cloud protection
          href: enable-cloud-protection-microsoft-defender-antivirus.md
        - name: Specify the cloud protection level
          href: specify-cloud-protection-level-microsoft-defender-antivirus.md
        - name: Configure the cloud block timeout period
          href: configure-cloud-block-timeout-period-microsoft-defender-antivirus.md
        - name: Cloud protection and sample submission
          href: cloud-protection-microsoft-antivirus-sample-submission.md
      - name: Configure and validate Microsoft Defender Antivirus network connections
        href: configure-network-connections-microsoft-defender-antivirus.md
      - name: Tamper protection
        items:
        - name: Protect security settings with tamper protection
          href: prevent-changes-to-security-settings-with-tamper-protection.md
        - name: Manage tamper protection using Microsoft Defender XDR
          href: manage-tamper-protection-microsoft-365-defender.md
        - name: Manage tamper protection with Intune
          href: manage-tamper-protection-intune.md
        - name: Manage tamper protection with Configuration Manager
          href: manage-tamper-protection-configuration-manager.md
        - name: Manage tamper protection on an individual device
          href: manage-tamper-protection-individual-device.md
        - name: FAQs on tamper protection
          href: faqs-on-tamper-protection.yml
      - name: Turn on block at first sight
        href: configure-block-at-first-sight-microsoft-defender-antivirus.md
      - name: Antimalware Scan Interface (AMSI) integration
        href: amsi-on-mdav.md
      - name: Configure behavioral, heuristic, and real-time protection
        href: configure-protection-features-microsoft-defender-antivirus.md
      - name: Advanced technologies at the core of Microsoft Defender Antivirus
        href: adv-tech-of-mdav.md
      - name: Behavior monitoring with Microsoft Defender Antivirus
        href: behavior-monitor.md
      - name: Behavior monitoring with Microsoft Defender Antivirus on macOS
        href: behavior-monitor-macos.md
      - name: Detect and block potentially unwanted applications
        href: detect-block-potentially-unwanted-apps-microsoft-defender-antivirus.md
      - name: Enable and configure Microsoft Defender Antivirus always-on protection in Group Policy
        href: configure-real-time-protection-microsoft-defender-antivirus.md
      - name: Configure remediation for Microsoft Defender Antivirus detections
        href: configure-remediation-microsoft-defender-antivirus.md
      - name: About scheduled Microsoft Defender Antivirus scans
        href: schedule-antivirus-scans.md
        items:
        - name: Schedule scans using Group Policy
          href: schedule-antivirus-scans-group-policy.md
        - name: Schedule scans using PowerShell
          href: schedule-antivirus-scans-powershell.md
        - name: Schedule scans using WMI
          href: schedule-antivirus-scans-wmi.md
        - name: Full scan best practices
          href: mdav-scan-best-practices.md
      - name: Use limited periodic scanning in Microsoft Defender Antivirus
        href: limited-periodic-scanning-microsoft-defender-antivirus.md
      - name: Protect Dev Drive using performance mode
        href: microsoft-defender-endpoint-antivirus-performance-mode.md
      - name: Compatibility with other security products
        href: microsoft-defender-antivirus-compatibility.md
      - name: Defender for Endpoint passive mode
        href: microsoft-defender-passive-mode.md
      - name: Microsoft Defender Antivirus and third-party antivirus solutions without
          Defender for Endpoint
        href: defender-antivirus-compatibility-without-mde.md
        displayName: Microsoft Defender Antivirus and non-Microsoft
          antivirus/antimalware solutions, Antivirus protection without Defender for
          Endpoint
      - name: Find malware detection names for Microsoft Defender for Endpoint
        href: find-defender-malware-name.md

      - name: Microsoft Defender Antivirus security intelligence and product updates
        href: microsoft-defender-antivirus-updates.md
        items:
        - name: Previous versions for technical upgrade support only
          href: msda-updates-previous-versions-technical-upgrade-support.md
        - name: Manage the sources for Microsoft Defender Antivirus protection updates
          href: manage-protection-updates-microsoft-defender-antivirus.md
        - name: Manage the schedule for when protection updates should be downloaded and applied
          href: manage-protection-update-schedule-microsoft-defender-antivirus.md
        - name: Manage gradual rollout process for Microsoft Defender updates
          href: manage-gradual-rollout.md
        - name: Configure gradual rollout process for Microsoft Defender updates
          href: configure-updates.md
        - name: Ring deployment
          items:
          - name: Overview
            href: microsoft-defender-antivirus-ring-deployment.md
          - name: Intune and Microsoft Update
            href: microsoft-defender-antivirus-ring-deployment-intune-microsoft-update.md
          - name: Configuration Manager and WSUS
            href: microsoft-defender-antivirus-ring-deployment-sscm-wsus.md
          - name: Group Policy and Microsoft Update
            href: microsoft-defender-antivirus-ring-deployment-group-policy-microsoft-update.md
          - name: Group Policy and network share
            href: microsoft-defender-antivirus-ring-deployment-group-policy-network-share.md
          - name: Group Policy and WSUS
            items:
            - name: Pilot ring
              href: microsoft-defender-antivirus-pilot-ring-deployment-group-policy-wsus.md
            - name: Production ring
              href: microsoft-defender-antivirus-production-ring-deployment-group-policy-wsus.md
            - name: Appendices for ring deployment using Group Policy and Windows Server Update Services (WSUS)
              href: microsoft-defender-antivirus-ring-deployment-group-policy-wsus-appendices.md

        - name: Manage Microsoft Defender Antivirus updates and scans for endpoints that are out of date
          href: manage-outdated-endpoints-microsoft-defender-antivirus.md
        - name: Manage event-based forced updates
          href: manage-event-based-updates-microsoft-defender-antivirus.md
        - name: Manage updates for mobile devices and virtual machines (VMs)
          href: manage-updates-mobile-devices-vms-microsoft-defender-antivirus.md

      - name: Manage Microsoft Defender Antivirus for your organization
        href: configuration-management-reference-microsoft-defender-antivirus.md
        items:
        - name: Use Microsoft Intune to manage Microsoft Defender Antivirus
          href: use-intune-config-manager-microsoft-defender-antivirus.md
        - name: Use Microsoft Defender for Endpoint Security Settings Management to manage
            Microsoft Defender Antivirus
          href: mde-security-settings-management.md
          displayName: Use Microsoft Defender for Endpoint Security Settings Management to
            manage Microsoft Defender Antivirus MDE Attach MDE Attach v2
        - name: Use Group Policy settings to manage Microsoft Defender Antivirus
          href: use-group-policy-microsoft-defender-antivirus.md
        - name: Use PowerShell cmdlets to manage Microsoft Defender Antivirus
          href: use-powershell-cmdlets-microsoft-defender-antivirus.md
        - name: Use Windows Management Instrumentation (WMI) to manage Microsoft Defender Antivirus
          href: use-wmi-microsoft-defender-antivirus.md
        - name: Use the mpcmdrun.exe tool to manage Microsoft Defender Antivirus
          href: command-line-arguments-microsoft-defender-antivirus.md
        - name: Configure the notifications that appear on endpoints
          href: configure-notifications-microsoft-defender-antivirus.md
        - name: Specify whether users can locally modify Microsoft Defender Antivirus policy settings
          href: configure-local-policy-overrides-microsoft-defender-antivirus.md
        - name: Specify whether users can see or interact with Microsoft Defender Antivirus user interface
          href: prevent-end-user-interaction-microsoft-defender-antivirus.md

      - name: Deploy and report on Microsoft Defender Antivirus
        href: deploy-manage-report-microsoft-defender-antivirus.md
        items:
        - name: Configure Microsoft Defender Antivirus in a remote desktop or virtual desktop infrastructure environment
          href: deployment-vdi-microsoft-defender-antivirus.md

      - name: Scans and remediation
        href: review-scan-results-microsoft-defender-antivirus.md
        items:
        - name: Configure and run on-demand Microsoft Defender Antivirus scans
          href: run-scan-microsoft-defender-antivirus.md
        - name: Run and review the results of a Microsoft Defender Offline scan
          href: microsoft-defender-offline.md
        - name: Configure Microsoft Defender Antivirus scanning options
          href: configure-advanced-scan-types-microsoft-defender-antivirus.md
        - name: Restore quarantined files in Microsoft Defender Antivirus
          href: restore-quarantined-files-microsoft-defender-antivirus.md

      - name: Microsoft Defender Antivirus exclusions
        items:
        - name: Configure custom exclusions
          href: configure-exclusions-microsoft-defender-antivirus.md
        - name: Exclusions based on file extension and folder location
          href: configure-extension-file-exclusions-microsoft-defender-antivirus.md
        - name: Exclusions for files opened by processes
          href: configure-process-opened-file-exclusions-microsoft-defender-antivirus.md
        - name: Contextual file and folder exclusions
          href: configure-contextual-file-folder-exclusions-microsoft-defender-antivirus.md
        - name: Exclusions for Windows Server
          href: configure-server-exclusions-microsoft-defender-antivirus.md
        - name: Common mistakes to avoid
          href: common-exclusion-mistakes-microsoft-defender-antivirus.md

      - name: Troubleshooting mode for Defender for Endpoint
        items:
        - name: Get started with troubleshooting mode
          href: enable-troubleshooting-mode.md
        - name: Troubleshooting mode scenarios
          href: troubleshooting-mode-scenarios.md

      - name: Diagnostics for Microsoft Defender Antivirus
        items:
        - name: Microsoft Defender Core service overview
          href: microsoft-defender-core-service-overview.md
        - name: Microsoft Defender Core service configurations and experimentation 
          href: microsoft-defender-core-service-configurations-and-experimentation.md
        - name: Collect diagnostic data of Microsoft Defender Antivirus
          href: collect-diagnostic-data.md

      - name: Troubleshooting Microsoft Defender Antivirus
        items:
        - name: Troubleshoot performance issues related to real-time protection
          href: troubleshoot-performance-issues.md
          items: 
          - name: Performance analyzer for Microsoft Defender Antivirus
            href: tune-performance-defender-antivirus.md
          - name: Performance analyzer reference
            href: performance-analyzer-reference.md
          - name: Troubleshoot Microsoft Defender Antivirus performance issues with Process
              Monitor
            href: troubleshoot-av-performance-issues-with-procmon.md
          - name: Troubleshoot Microsoft Defender Antivirus performance issues with WPRUI
            href: troubleshoot-av-performance-issues-with-wprui.md
        - name: Troubleshoot Microsoft Defender Antivirus performance issues
          items:
          - name: Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus
            href: troubleshoot-microsoft-defender-antivirus.yml
          - name: Troubleshoot Microsoft Defender Antivirus while migrating from a third-party solution
            href: troubleshoot-microsoft-defender-antivirus-when-migrating.yml

      - name: Behavioral blocking and containment
        items:
        - name: Behavioral blocking and containment
          href: behavioral-blocking-containment.md
        - name: Client behavioral blocking
          href: client-behavioral-blocking.md
        - name: Feedback-loop blocking
          href: feedback-loop-blocking.md

      - name: UEFI scanning in Defender for Endpoint
        href: uefi-scanning-in-defender-for-endpoint.md
      - name: Run Microsoft Defender Antivirus in a sandbox
        href: sandbox-mdav.md
      - name: Early Launch Antimalware (ELAM) and Microsoft Defender Antivirus
        href: elam-on-mdav.md
        
    - name: Address false positives/negatives in Microsoft Defender for Endpoint
      href: defender-endpoint-false-positives-negatives.md

    - name: Manage device configuration
      items:

      - name: Manage endpoint security policies
        href: manage-security-policies.md
      - name: Deploy endpoint security policies from Intune
        href: /mem/intune/protect/mde-security-integration?toc=/defender-endpoint/toc.json&bc=/defender-endpoint/breadcrumb/toc.json
      - name: Increase compliance with the security baseline
        href: configure-machines-security-baseline.md
      - name: Optimize attack surface reduction rule deployment and detections
        href: configure-machines-asr.md
      - name: Built-in protection
        href: built-in-protection.md

  - name: Investigate and respond to threats
    items:
    - name: Endpoint detection and response
      items:
      - name: Endpoint detection and response overview
        href: overview-endpoint-detection-response.md
      - name: Submit files
        href: admin-submissions-mde.md
      - name: Incidents queue
        items:
        - name: View and organize the Incidents queue
          href: view-incidents-queue.md
        - name: Manage incidents
          href: manage-incidents.md
        - name: Investigate incidents
          href: investigate-incidents.md

      - name: Alerts queue
        items:
        - name: Alerts queue in Microsoft Defender XDR
          href: alerts-queue-endpoint-detection-response.md
        - name: View and organize the Alerts queue
          href: alerts-queue.md
        - name: Review alerts
          href: review-alerts.md
        - name: Manage alerts
          href: /defender-xdr/investigate-alerts?toc=/defender-endpoint/TOC.json&bc=/defender-endpoint/breadcrumb/toc.json
        - name: Investigate alerts
          href: investigate-alerts.md
        - name: Review and manage detected threats
          href: review-detected-threats.md
        - name: Investigate files
          href: investigate-files.md
        - name: Investigate devices
          href: investigate-machines.md
        - name: Investigate an IP address
          href: investigate-ip.md
          items:
          - name: Investigate connection events that occur behind forward proxies
            href: investigate-behind-proxy.md
        - name: Investigate a user account
          href: investigate-user.md

      - name: Take response actions
        items:
        - name: Take response actions on a device
          items:
          - name: Response actions on devices
            href: respond-machine-alerts.md
          - name: Manage tags
            href: respond-machine-alerts.md#manage-tags
          - name: Start an automated investigation
            href: respond-machine-alerts.md#initiate-automated-investigation
          - name: Start a Live Response session
            href: respond-machine-alerts.md#initiate-live-response-session
          - name: Collect investigation package
            href: respond-machine-alerts.md#collect-investigation-package-from-devices
          - name: Run antivirus scan
            href: respond-machine-alerts.md#run-microsoft-defender-antivirus-scan-on-devices
          - name: Restrict app execution
            href: respond-machine-alerts.md#restrict-app-execution
          - name: Isolate devices from the network
            href: respond-machine-alerts.md#isolate-devices-from-the-network
          - name: Isolation exclusions
            href: isolation-exclusions.md
          - name: Contain devices from the network
            href: respond-machine-alerts.md#contain-devices-from-the-network
          - name: Contain user from the network
            href: respond-machine-alerts.md#contain-user-from-the-network
          - name: Automatically apply GPO hardening (predictive shielding)
            href: respond-machine-alerts.md#gpo-hardening
          - name: Automatically apply Safeboot hardening (predictive shielding)
            href: respond-machine-alerts.md#safeboot-hardening                     
          - name: Consult a threat expert
            href: respond-machine-alerts.md#consult-a-threat-expert
          - name: Check activity details in Action center
            href: respond-machine-alerts.md#check-activity-details-in-action-center

        - name: Take response actions on a file
          items:
          - name: Response actions on files
            href: respond-file-alerts.md
          - name: Stop and quarantine files in your network
            href: respond-file-alerts.md#stop-and-quarantine-files-in-your-network
          - name: Restore file from quarantine
            href: respond-file-alerts.md#restore-file-from-quarantine
          - name: Add indicators to block or allow a file
            href: respond-file-alerts.md#add-indicator-to-block-or-allow-a-file
          - name: Check activity details in Action center
            href: respond-file-alerts.md#check-activity-details-in-action-center
          - name: Download or collect file
            href: respond-file-alerts.md#download-or-collect-file
          - name: Deep analysis
            href: respond-file-alerts.md#deep-analysis

      - name: View and approve remediation actions
        href: manage-auto-investigation.md
        items:
        - name: View details and results of automated investigations
          href: auto-investigation-action-center.md

      - name: Investigate entities using Live response
        items:
        - name: Investigate entities on devices
          href: live-response.md
        - name: Live response command examples
          href: live-response-command-examples.md

      - name: Use sensitivity labels to prioritize incident response
        href: information-protection-investigation.md    

    - name: Threat analytics
      items:
      - name: Overview
        href: /defender-xdr/threat-analytics?toc=/defender-endpoint/toc.json&bc=/defender-endpoint/breadcrumb/toc.json
      - name: Read the analyst report
        href: /defender-xdr/threat-analytics-analyst-reports?toc=/defender-endpoint/toc.json&bc=/defender-endpoint/breadcrumb/toc.json

    - name: EDR in block mode
      href: edr-in-block-mode.md
    - name: EDR in block mode FAQ
      href: edr-block-mode-faqs.yml

    - name: Automated investigation and response (AIR)
      items:
      - name: Overview of AIR
        href: automated-investigations.md
      - name: Automation levels in AIR
        href: automation-levels.md
      - name: Configure AIR capabilities
        href: configure-automated-investigations-remediation.md
      - name: View the details and results of an automated investigation
        href: autoir-investigation-results.md

    - name: Endpoint Attack Notifications
      href: endpoint-attack-notifications.md

    - name: Run and customize scheduled and on-demand scans
      href: customize-run-review-remediate-scans-microsoft-defender-antivirus.md

  - name: Reference
    items:
    - name: Reports
      items:
        - name: Microsoft Defender for Endpoint reports
          href: threat-protection-reports.md
        - name: Device health reports
          href: device-health-reports.md
          items:
          - name: Microsoft Defender Antivirus health report
            href: device-health-microsoft-defender-antivirus-health.md
          - name: Sensor health and OS report
            href: device-health-sensor-health-os.md
        - name: Host firewall reporting
          href: host-firewall-reporting.md
        - name: Web protection and monitoring reports
          href: web-protection-monitoring.md
        - name: Device control reports
          href: device-control-report.md
        - name: Attack surface reduction rules report
          href: attack-surface-reduction-rules-report.md                                                    
        - name: Aggregated reports
          href: aggregated-reporting.md
        - name: Create custom reports using Power BI
          href: api/api-power-bi.md                         
    - name: Configure integration with other Microsoft solutions
      items:
      - name: Configure Conditional Access
        href: configure-conditional-access.md
      - name: Configure Microsoft Defender for Cloud Apps integration
        href: microsoft-cloud-app-security-config.md
    - name: Management and APIs
      items:
      - name: Overview of management and APIs
        href: api/management-apis.md
      - name: API release notes
        href: api/api-release-notes.md
      - name: Microsoft Defender for Endpoint API
        items:
        - name: Get started
          items:
          - name: Microsoft Defender for Endpoint API license and terms
            href: /legal/microsoft-365/api-terms-of-use
          - name: Access the Microsoft Defender for Endpoint APIs
            href: /defender-endpoint/api/apis-intro
          - name: Hello World
            href: api/api-hello-world.md
          - name: Get access with application context
            href: api/exposed-apis-create-app-webapp.md
          - name: Get access with user context
            href: api/exposed-apis-create-app-nativeapp.md

        - name: Microsoft Defender for Endpoint APIs Schema
          items:
          - name: Supported Microsoft Defender for Endpoint APIs
            href: api/exposed-apis-list.md
          - name: Common REST API error codes
            href: api/common-errors.md
          - name: Advanced Hunting
            href: api/run-advanced-query-api.md

          - name: Alert
            items:
            - name: Alert properties
              href: api/alerts.md
            - name: List alerts
              href: api/get-alerts.md
            - name: Create alert
              href: api/create-alert-by-reference.md
            - name: Batch update alerts
              href: api/batch-update-alerts.md
            - name: Update Alert
              href: api/update-alert.md
            - name: Get alert information by ID
              href: api/get-alert-info-by-id.md
            - name: Get alert related domains information
              href: api/get-alert-related-domain-info.md
            - name: Get alert related file information
              href: api/get-alert-related-files-info.md
            - name: Get alert-related IPs information
              href: api/get-alert-related-ip-info.md
            - name: Get alert-related device information
              href: api/get-alert-related-machine-info.md
            - name: Get alert-related user information
              href: api/get-alert-related-user-info.md

          - name: Assessments of vulnerabilities and secure configurations
            items:
            - name: Export assessment methods and properties
              href: api/get-assessment-methods-properties.md
            - name: Export secure configuration assessment
              href: api/get-assessment-secure-config.md
            - name: Export software inventory assessment
              href: api/get-assessment-software-inventory.md
            - name: Export non product code software inventory assessment
              href: api/get-assessment-non-cpe-software-inventory.md
            - name: Export software vulnerabilities assessment
              href: api/get-assessment-software-vulnerabilities.md

          - name: Authenticated scan
            items:
            - name: Authenticated scan properties
              href: api/get-authenticated-scan-properties.md
            - name: Get all scan definitions
              href: api/get-all-scan-definitions.md
            - name: Add, delete or update a scan definition
              href: api/add-a-new-scan-definition.md
            - name: Get all scan agents
              href: api/get-all-scan-agents.md
            - name: Get scan agent by Id
              href: api/get-agent-details.md
            - name: Get scan history by definition
              href: api/get-scan-history-by-definition.md
            - name: Get scan history by session
              href: api/get-scan-history-by-session.md

          - name: Browser extensions
            items:
            - name: Export browser extensions assessment
              href: api/get-assessment-browser-extensions.md
            - name: Get browser extensions permission information
              href: api/get-browser-extensions-permission-info.md

          - name: Automated investigation
            items:
            - name: Investigation properties
              href: api/investigation.md
            - name: List Investigation
              href: api/get-investigation-collection.md
            - name: Get Investigation
              href: api/get-investigation-object.md
            - name: Start Investigation
              href: api/initiate-autoir-investigation.md

          - name: Device Health
            items:
            - name: Export device health methods and properties
              href: api/device-health-api-methods-properties.md
            - name: Export device antivirus health report
              href: api/device-health-export-antivirus-health-report-api.md

          - name: Certificate inventory
            items:
            - name: Export certificate inventory assessment
              href: api/export-certificate-inventory-assessment.md

          - name: Domain
            items:
            - name: Get domain related alerts
              href: api/get-domain-related-alerts.md
            - name: Get domain related machines
              href: api/get-domain-related-machines.md
            - name: Get domain statistics
              href: api/get-domain-statistics.md

          - name: File
            items:
            - name: File properties
              href: api/files.md
            - name: Get file information
              href: api/get-file-information.md
            - name: Get file related alerts
              href: api/get-file-related-alerts.md
            - name: Get file related machines
              href: api/get-file-related-machines.md
            - name: Get file statistics
              href: api/get-file-statistics.md

          - name: Indicators
            items:
            - name: Indicators properties
              href: api/ti-indicator.md
            - name: List Indicators
              href: api/get-ti-indicators-collection.md
            - name: Submit Indicator
              href: api/post-ti-indicator.md
            - name: Import Indicator
              href: api/import-ti-indicators.md
            - name: Delete Indicator
              href: api/delete-ti-indicator-by-id.md

            - name: Batch Delete Indicators
              href: api/batch-delete-ti-indicators.md
          - name: Information gathering
            items:
            - name: Export information gathering assessment
              href: api/get-assessment-information-gathering.md

          - name: IP
            items:
            - name: Get IP related alerts
              href: api/get-ip-related-alerts.md
            - name: Get IP statistics
              href: api/get-ip-statistics.md

          - name: Live response library
            items:
            - name: Live response library properties
              href: live-response-library-methods.md
            - name: List library files
              href: api/list-library-files.md
            - name: Upload to live response library
              href: api/upload-library.md
            - name: Delete from library
              href: api/delete-library.md

          - name: Machine
            items:
            - name: Machine properties
              href: api/machine.md
            - name: List machines
              href: api/get-machines.md
            - name: Get machine by ID
              href: api/get-machine-by-id.md
            - name: Get machine log on users
              href: api/get-machine-log-on-users.md
            - name: Get machine related alerts
              href: api/get-machine-related-alerts.md
            - name: Get installed software
              href: api/get-installed-software.md
            - name: Get discovered vulnerabilities
              href: api/get-discovered-vulnerabilities.md
            - name: Get security recommendations
              href: api/get-security-recommendations.md
            - name: Add or remove a machine tag
              href: api/add-or-remove-machine-tags.md
            - name: Add or remove a tag from multiple machines
              href: api/add-or-remove-multiple-machine-tags.md
            - name: Find machines by IP
              href: api/find-machines-by-ip.md
            - name: Find device information by internal IP
              href: api/find-machine-info-by-ip.md
            - name: Find machines by tag
              href: api/find-machines-by-tag.md
            - name: Get missing KBs
              href: api/get-missing-kbs-machine.md
            - name: Set device value
              href: api/set-device-value.md
            - name: Update machine
              href: api/update-machine-method.md

          - name: Machine Action
            items:
            - name: Machine Action properties
              href: api/machineaction.md
            - name: List Machine Actions
              href: api/get-machineactions-collection.md
            - name: Get Machine Action
              href: api/get-machineaction-object.md
            - name: Collect investigation package
              href: api/collect-investigation-package.md
            - name: Get investigation package SAS URI
              href: api/get-package-sas-uri.md
            - name: Get live response result
              href: api/get-live-response-result.md
            - name: Isolate machine
              href: api/isolate-machine.md
            - name: Release machine from isolation
              href: api/unisolate-machine.md
            - name: Restrict app execution
              href: api/restrict-code-execution.md
            - name: Remove app restriction
              href: api/unrestrict-code-execution.md
            - name: Run antivirus scan
              href: api/run-av-scan.md
            - name: Run live response
              href: api/run-live-response.md
            - name: Offboard machine
              href: api/offboard-machine-api.md
            - name: Stop and quarantine file
              href: api/stop-and-quarantine-file.md
            - name: Cancel machine action
              href: api/cancel-machine-action.md

          - name: Recommendation
            items:
            - name: Recommendation properties
              href: api/recommendation.md
            - name: List all recommendations
              href: api/get-all-recommendations.md
            - name: Get recommendation by ID
              href: api/get-recommendation-by-id.md
            - name: Get recommendation by software
              href: api/list-recommendation-software.md
            - name: List machines by recommendation
              href: api/get-recommendation-machines.md
            - name: List vulnerabilities by recommendation
              href: api/get-recommendation-vulnerabilities.md

          - name: Remediation activity
            items:
            - name: Remediation activity properties
              href: api/get-remediation-methods-properties.md
            - name: Get one remediation activity by ID
              href: api/get-remediation-one-activity.md
            - name: List all remediation activities
              href: api/get-remediation-all-activities.md
            - name: List exposed devices of one remediation activity
              href: api/get-remediation-exposed-devices-activities.md

          - name: Score
            items:
            - name: Score properties
              href: api/score.md
            - name: List exposure score by machine group
              href: api/get-machine-group-exposure-score.md
            - name: Get exposure score
              href: api/get-exposure-score.md
            - name: Get device secure score
              href: api/get-device-secure-score.md

          - name: Security baselines
            items:
            - name: Export security baselines assessment
              href: api/export-security-baseline-assessment.md
            - name: List security baselines assessment profiles
              href: api/get-security-baselines-assessment-profiles.md
            - name: Get baseline profile configurations
              href: api/get-security-baselines-assessment-configurations.md

          - name: Software
            items:
            - name: Software properties
              href: api/software.md
            - name: List software
              href: api/get-software.md
            - name: Get software by ID
              href: api/get-software-by-id.md
            - name: List software version distribution
              href: api/get-software-ver-distribution.md
            - name: List machines by software
              href: api/get-machines-by-software.md
            - name: List vulnerabilities by software
              href: api/get-vuln-by-software.md
            - name: Get missing KBs
              href: api/get-missing-kbs-software.md
          - name: User
            items:
            - name: Get user related alerts
              href: api/get-user-related-alerts.md
            - name: Get user related machines
              href: api/get-user-related-machines.md

          - name: Vulnerability
            items:
            - name: Vulnerability properties
              href: api/vulnerability.md
            - name: List vulnerabilities
              href: api/get-all-vulnerabilities.md
            - name: List vulnerabilities by machine and software
              href: api/get-all-vulnerabilities-by-machines.md
            - name: Get vulnerability by ID
              href: api/get-vulnerability-by-id.md
            - name: List machines by vulnerability
              href: api/get-machines-by-vulnerability.md

        - name: How to use APIs - Samples
          items:
          - name: Power Automate
            href: api-microsoft-flow.md
          - name: Power BI
            href: api/api-power-bi.md
          - name: Advanced Hunting using Python
            href: api/run-advanced-query-sample-python.md
          - name: Advanced Hunting using PowerShell
            href: api/run-advanced-query-sample-powershell.md
          - name: Using OData Queries
            href: api/exposed-apis-odata-samples.md
          - name: Advanced Hunting with PowerShell API Guide
            href: api/exposed-apis-full-sample-powershell.md

      - name: Raw data streaming API
        items:
        - name: Raw data streaming
          href: api/raw-data-export.md
        - name: Stream advanced hunting events to Azure Events hub
          href: api/raw-data-export-event-hub.md
        - name: Stream advanced hunting events to your storage account
          href: api/raw-data-export-storage.md

      - name: SIEM integration
        items:
        - name: Migrate from the MDE SIEM API to the Microsoft Defender XDR alerts API
          href: configure-siem.md
        - name: Troubleshoot SIEM tool integration issues
          href: troubleshoot-siem.md

      - name: Partners & APIs
        items:
        - name: Partner applications
          href: partner-applications.md
        - name: Connected applications
          href: connected-applications.md
        - name: API explorer
          href: api/api-explorer.md
    - name: Managed security service provider (MSSP) integration
      items:
      - name: Configure managed security service provider integration
        href: configure-mssp-support.md
      - name: Grant MSSP access to the portal
        href: grant-mssp-access.md
      - name: Access the MSSP customer portal
        href: access-mssp-portal.md
      - name: Configure alert notifications
        href: configure-mssp-notifications.md
      - name: Get partner application access
        href: api/exposed-apis-create-app-partners.md
      - name: Fetch alerts from customer tenant
        href: api/fetch-alerts-mssp.md
    - name: Partner integration scenarios
      items:
      - name: Technical partner opportunities
        href: partner-integration.md
      - name: Become a Microsoft Defender for Endpoint partner
        href: get-started-partner-integration.md
      - name: Professional security services that integrate with Defender for Endpoint
        href: professional-services.md
    - name: Integrations
      items:
      - name: Microsoft Defender for Endpoint integrations
        href: threat-protection-integration.md
      - name: Protect users, data, and devices with Conditional Access
        href: conditional-access.md
      - name: Microsoft Defender for Cloud Apps integration overview
        href: microsoft-cloud-app-security-integration.md
    - name: Microsoft Security Resources
      items: 
        - name: Threat actor naming
          href: /unified-secops-platform/microsoft-threat-actor-naming

        - name: Malware names
          href: /unified-secops-platform/malware-naming

        - name: How Microsoft identifies malware and PUA
          href: /defender-xdr/criteria
        - name: Submit files for analysis
          href: /unified-secops-platform/submission-guide

        - name: Troubleshoot MSI portal errors caused by admin block
          href: /defender-xdr/portal-submission-troubleshooting
        - name: Microsoft virus initiative
          href: /unified-secops-platform/virus-initiative-criteria

        - name: Software developer FAQ
          href: /defender-xdr/developer-faq        
    - name: Malware information
      items: 
       - name: Understanding malware
         href: malware/understanding-malware.md
       - name: Coinminers
         href: malware/coinminer-malware.md
       - name: Exploits and Exploit Kits
         href: malware/exploits-malware.md
       - name: Fileless threats
         href: malware/fileless-threats.md
       - name: Macro threats
         href: malware/macro-malware.md
       - name: Phishing trends
         href: malware/phishing-trends.md
       - name: Phishing
         href: malware/phishing.md
       - name: Prevent malware infection
         href: malware/prevent-malware-infection.md
       - name: Rootkits
         href: malware/rootkits-malware.md
       - name: Supply chain malware
         href: malware/supply-chain-malware.md
       - name: Support scams
         href: malware/support-scams.md
       - name: Trojans
         href: malware/trojans-malware.md
       - name: Unwanted software
         href: malware/unwanted-software.md
       - name: Worms
         href: malware/worms-malware.md
    - name: Understand threat intelligence concepts
      href: threat-indicator-concepts.md
    - name: Release notes archive
      items:
        - name: Android
          href: release-notes-archive-android.md
      
  - name: Microsoft Defender XDR docs
    items:
    - name: Microsoft Defender XDR
      href: /defender
    - name: Defender for Office 365
      href: /defender-office-365
    - name: Defender for Identity
      href: /defender-for-identity/
    - name: Defender for Cloud Apps
      href: /cloud-app-security/
    - name: Defender for Business
      href: /defender-business
    - name: Defender Vulnerability Management
      href: /defender-vulnerability-management