You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: microsoft-365/security/defender-endpoint/whats-new-in-microsoft-defender-endpoint.md
+1-79Lines changed: 1 addition & 79 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ ms.pagetype: security
11
11
ms.author: macapara
12
12
author: mjcaparas
13
13
ms.localizationpriority: medium
14
-
ms.date: 07/19/2023
14
+
ms.date: 08/08/2023
15
15
manager: dansimp
16
16
audience: ITPro
17
17
ms.collection:
@@ -61,84 +61,6 @@ For more information on Microsoft Defender for Endpoint on specific operating sy
61
61
- [What's new in Defender for Endpoint on iOS](ios-whatsnew.md)
62
62
- [What's new in Defender for Endpoint on Linux](linux-whatsnew.md)
63
63
64
-
## August 2023
65
-
66
-
- **Data completeness**
67
-
68
-
- Extended file attributes and registry monitoring capabilities to enhance investigation and detection experience.
69
-
70
-
- Conditional Access - Expanding integration between Microsoft Defender for Endpoint and Intune to support additional Azure Active Directory (AAD) joined scenarios to deploy conditional access policies in your environment and enable Zero Trust policies to better protect your network against adversaries.
71
-
72
-
- Engine bugfixes and improvements.
73
-
74
-
75
-
76
-
- **Platform**
77
-
78
-
- Enabled safer deployment of features through rings and containment mechanism enhancements.
79
-
80
-
- Consolidate the billing and alert experiences of customers that are onboarded to both Microsoft Defender for Endpoint and Microsoft Defender for Cloud in cloud environments by collecting machine identifiers that allow de-duplication on cloud side.
81
-
82
-
83
-
84
-
- **Hardening**
85
-
86
-
- General hardening improvements.
87
-
88
-
89
-
- **Response**
90
-
91
-
- Device Isolation improvements. For more information, see [Take response actions on a device](respond-machine-alerts.md)
92
-
93
-
- Strengthen the resilience of device isolation permit and block rules.
94
-
95
-
- Allow a device that is disconnected from a Command and Control channel using offline signed command to be removed from isolation.
96
-
97
-
- Improved performance for [Live Response](live-response.md) commands when executed concurrently with automatic investigation.
98
-
99
-
- Send command status events for isolate and IR commands through Command and Control channel to improve performance, support future design changes, and easier monitoring.
100
-
101
-
- Custom Exclusion for Isolation - exclusion of apps, allow list of IP addresses and ports, and users.
102
-
103
-
- Isolation hardening is a measure taken against a technique known as process hollowing. Implementing this hardening approach, a system can establish stronger isolation rules that significantly enhance security when dealing with code injection tactics.
104
-
105
-
106
-
- Reduce device disconnections for isolated device caused by third-party inspection drivers. For more information, see [Take response actions on a device](respond-machine-alerts.md).
107
-
108
-
109
-
110
-
- **Vulnerability management**
111
-
112
-
- Replaces some of the current threat vulnerability collections and adds new much requested user installed packages collector.
113
-
114
-
- New and higher-performing (both CPU and memory) vulnerabilities collector.
115
-
116
-
- Changes on devices will be reflected in a timelier manner to the portal, enabling them to take action against threats faster.
- Lateral Movement Firewall - Addressing advanced attacks inflicting customers (Human Operated Ransomware) by expanding identity-oriented response capabilities known to be gaps in our current protection story.
125
-
126
-
- Supporting force close active SMB sessions for incriminated users as part of Lateral Movement Firewall to disrupt and terminate active malicious sessions.
127
-
128
-
129
-
- Device Contain - Introducing new Windows Filtering Platform (WFP) network filter to allow telemetry & audit-mode capabilities to network connections enforcements. For more information, see - [Take response actions on a device in Microsoft Defender for Endpoint](respond-machine-alerts.md#contain-devices-from-the-network).
130
-
131
-
132
-
- Anti-tampering - Addressing tampering gaps in Defender for Endpoint authentication flow by hardening protection of the cryptographic key used to register clients with Defender for Endpoint's authentication service. This is done by storing the key in an AV-protected registry key.
0 commit comments