`. Make sure to verify that the finished payload contains `
` before you use it in a simulation.
+
+During simulation creation, if you scan the QR code or you use **Send a Test** to review the payload, the QR code points to the base phishing URL that you selected.
+
+When the payload is used in a simulation, the service replaces the QR code with a dynamically generated QR code to track click and compromise metrics. The size, position, and shape of the QR code matches the configuration options you configured in the payload. Scanning the QR code during an actual simulation takes you to the configured landing page.
+
+### Q: I'm trying to create a payload in HTML, but the payload editor seems to remove certain content from my design?
+
+A: Currently, the following HTML tags aren't supported in the payload editor: `applet, base, basefont, command, embed, frame, frameset, iframe, keygen, link, meta, noframes, noscript, param, script, object, title`.
diff --git a/defender-office-365/attack-simulation-training-insights.md b/defender-office-365/attack-simulation-training-insights.md
index 88f45b6736..e04fcffd46 100644
--- a/defender-office-365/attack-simulation-training-insights.md
+++ b/defender-office-365/attack-simulation-training-insights.md
@@ -459,7 +459,7 @@ How user activity signals are captured is described in the following table.
|Opened Attachment|A user opened the attachment.|The signal comes from the client (for example, Outlook or Word).|
|Read Message|The user read the simulation message.|Message read signals might experience issues in the following scenarios:
- The user reported the message as phishing in Outlook without leaving the reading pane, and **Mark items as read when viewed in the Reading Pane** wasn't configured (default).
- The user reported the unread message as phishing in Outlook, the message was deleted, and **Mark messages as read when deleted** wasn't configured (default).
|
|Out of Office|Determines whether the user is out of office.|Currently calculated by the Automatic replies setting from Outlook.|
-|Compromised User|The user was compromised. The compromise signal varies based on the social engineering technique.|
- **Credential Harvest**: The user entered their credentials on the login page (credentials aren't stored by Microsoft).¹
- **Malware Attachment**: The user opened the payload attachment and selected **Enable Editing** in [Protected View](https://support.microsoft.com/office/d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653).
- **Link in Attachment**: The user opened the attachment and clicked on the payload link.
- **Link to Malware**: The user clicked on the payload link and entered their credentials.
- **Drive by URL**: The user clicked on the payload link (entering credentials isn't required).¹
- **OAuth Consent Grant**: The user clicked on the payload link and accepted the prompt to share permissions.¹
|
+|Compromised User|The user was compromised. The compromise signal varies based on the social engineering technique.|
- **Credential Harvest**: The user entered their credentials on the login page (credentials aren't stored by Microsoft).¹
- **Malware Attachment**: The user opened the payload attachment and selected **Enable Editing** in [Protected View](https://support.microsoft.com/office/d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653).
- **Link in Attachment**: The user opened the attachment and entered their credentials after clicking on the payload link.
- **Link to Malware**: The user clicked on the payload link and entered their credentials.
- **Drive by URL**: The user clicked on the payload link (entering credentials isn't required).¹
- **OAuth Consent Grant**: The user clicked on the payload link and accepted the prompt to share permissions.¹
|
|Clicked Message Link|The user clicked on the payload link in the simulation message.|The URL in the simulation is unique for each user, which allows individual user activity tracking. Third-party filtering services or email forwarding can lead to false positives. For more information, see [I see clicks or compromise events from users who insist they didn't click the link in the simulation message](attack-simulation-training-faq.md#i-see-clicks-or-compromise-events-from-users-who-insist-they-didnt-click-the-link-in-the-simulation-message).|
|Forwarded Message|The user forwarded the message.||
|Replied to Message|The user replied to the message.||
diff --git a/defender-office-365/defender-for-office-365-whats-new.md b/defender-office-365/defender-for-office-365-whats-new.md
index db53d025b9..877a29ebdc 100644
--- a/defender-office-365/defender-for-office-365-whats-new.md
+++ b/defender-office-365/defender-for-office-365-whats-new.md
@@ -49,7 +49,7 @@ For more information on what's new with other Microsoft Defender security produc
- **Tenant Allow/Block List in Microsoft 365 GCC, GCC High, DoD, and Office 365 operated by 21Vianet environments**: The [Tenant Allow/Block List](tenant-allow-block-list-about.md) is now available these environments. They are on parity with the WW commercial experiences.
-- **45 days after last used date**: The value **Remove allow entry after** \> **45 days after last used date** is now the default on new allow entries from submissions and existing allow entries in the [Tenant Allow/Block List](tenant-allow-block-list-about.md). The allow entry is triggered and the **LastUsedDate** property is updated when the entity is encountered and identified as malicious during mail flow or at time of click. After the filtering system determines that the entity is clean, the allow entry is automatically removed after 45 days. By default, allow entries for spoofed senders never expire.
+- **45 days after last used date**: The value **Remove allow entry after** \> **45 days after last used date** is now the default on new allow entries from submissions. The existing allow entries in the [Tenant Allow/Block List](tenant-allow-block-list-about.md) can also be modified to include the value **Remove allow entry after** \> **45 days after last used date**. The allow entry is triggered and the **LastUsedDate** property is updated when the entity is encountered and identified as malicious during mail flow or at time of click. After the filtering system determines that the entity is clean, the allow entry is automatically removed after 45 days. By default, allow entries for spoofed senders never expire.
- (GA) Learning hub resources have moved from the Microsoft Defender portal to [learn.microsoft.com](https://go.microsoft.com/fwlink/?linkid=2273118). Access Microsoft Defender XDR Ninja training, learning paths, training modules and more. Browse the [list of learning paths](/training/browse/?products=m365-ems-cloud-app-security%2Cdefender-for-cloud-apps%2Cdefender-identity%2Cm365-information-protection%2Cm365-threat-protection%2Cmdatp%2Cdefender-office365&expanded=m365%2Coffice-365), and filter by product, role, level, and subject.
diff --git a/defender-office-365/submissions-admin.md b/defender-office-365/submissions-admin.md
index ffc22c1fa2..89e858b64d 100644
--- a/defender-office-365/submissions-admin.md
+++ b/defender-office-365/submissions-admin.md
@@ -306,7 +306,7 @@ After a few moments, the associated allow entries appear on the **Domains & addr
> - If the sender email address is not found to be malicious by our filtering system, submitting the email message to Microsoft won't create an allow entry in the Tenant Allow/Block List.
> - When an allowed domain or email address, spoofed sender, URL, or file (_entity_) is encountered again, all filters that are associated with the entity are skipped. For email messages, all other entities are still evaluated by the filtering system before making a decision.
> - During mail flow, if messages from the allowed domain or email address pass other checks in the filtering stack, the messages are delivered. For example, if a message passes [email authentication checks](email-authentication-about.md), a message from an allowed sender email address are delivered.
-> - By default, allow entries for domains and email addresses exist for 30 days. During those 30 days, Microsoft learns from the allow entries and [removes them or automatically extends them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages from those domains or email addresses are delivered, unless something else in the message is detected as malicious. By default, allow entries for spoofed senders never expire.
+> - By default, allow entries for domains and email addresses are kept for 45 days after the filtering system determines that the entity is clean, and then the allow entry is removed. Or you can set allow entries to expire up to 30 days after you create them. By default, allow entries for spoofed senders never expire.
> - For messages that were incorrectly blocked by [domain or user impersonation protection](anti-phishing-policies-about.md#impersonation-settings-in-anti-phishing-policies-in-microsoft-defender-for-office-365), the allow entry for the domain or sender is not created in the Tenant Allow/Block List. Instead, the domain or sender is added to the **Trusted senders and domains** section in the [anti-phishing policy](anti-phishing-policies-mdo-configure.md#use-the-microsoft-defender-portal-to-modify-anti-phishing-policies) that detected the message.
> - When you override the verdict in the spoof intelligence insight, the spoofed sender becomes a manual allow or block entry that only appears on the **Spoofed senders** on the **Tenant Allow/Block Lists** page at
.
@@ -362,7 +362,7 @@ After a few moments, the allow entry is available on the **Files** tab on the **
> [!IMPORTANT]
>
-> - By default, allow entries for files exist for 30 days. During those 30 days, Microsoft learns from the allow entries and [removes them or automatically extends them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those files are delivered, unless something else in the message is detected as malicious.
+> - By default, allow entries for files are kept for 45 days after the filtering system determines that the entity is clean, and then the allow entry is removed. Or you can set allow entries to expire up to 30 days after you create them.
> - When the file is encountered again during mail flow, [Safe Attachments](safe-attachments-about.md) detonation or file reputation checks and all other file-based filters are overridden. If the filtering system determines that all other entities in the email message are clean, the message are delivered.
> - During selection, all file-based filters, including [Safe Attachments](safe-attachments-about.md) detonation or file reputation checks are overridden, allowing user access to the file.
@@ -420,7 +420,7 @@ After a few moments, the allow entry is available on the **URL** tab on the **Te
> [!NOTE]
>
-> - By default, allow entries for URLs exist for 30 days. During those 30 days, Microsoft learns from the allow entries and [removes them or automatically extends them](https://techcommunity.microsoft.com/t5/microsoft-defender-for-office/automatic-tenant-allow-block-list-expiration-management-is-now/ba-p/3723447). After Microsoft learns from the removed allow entries, messages that contain those URLs are delivered, unless something else in the message is detected as malicious.
+> - By default, allow entries for URLs are kept for 45 days after the filtering system determines that the entity is clean, and then the allow entry is removed. Or you can set allow entries to expire up to 30 days after you create them.
> - When the URL is encountered again during mail flow, [Safe Links](safe-links-about.md) detonation or URL reputation checks and all other URL-based filters are overridden. If the filtering system determines that all other entities in the email message are clean, the message are delivered.
> - During selection, all URL-based filters, including [Safe Links](safe-links-about.md) detonation or URL reputation checks are overridden, allowing user access to content at the URL.
diff --git a/defender-office-365/tenant-allow-block-list-about.md b/defender-office-365/tenant-allow-block-list-about.md
index e35b588224..eaa00be14b 100644
--- a/defender-office-365/tenant-allow-block-list-about.md
+++ b/defender-office-365/tenant-allow-block-list-about.md
@@ -8,7 +8,7 @@ manager: deniseb
audience: ITPro
ms.topic: how-to
ms.localizationpriority: medium
-ms.date: 07/18/2024
+ms.date: 09/19/2024
search.appverid:
- MET150
ms.collection:
@@ -34,7 +34,7 @@ In Microsoft 365 organizations with mailboxes in Exchange Online or standalone E
The Tenant Allow/Block List in the Microsoft Defender portal gives you a way to manually override the Defender for Office 365 or EOP filtering verdicts. The list is used during mail flow for incoming messages from external senders.
-The Tenant Allow/Block List doesn't apply to internal messages sent within the organization. But block entries for **Domains and email addresses** also prevent users in the organization from *sending* email to those blocked domains and addresses.
+Entries for **Domains and email addresses** and **Spoofed senders** apply to internal messages sent within the organization. Block entries for **Domains and email addresses** also prevent users in the organization from *sending* email to those blocked domains and addresses.
The Tenant Allow/Block list is available in the Microsoft Defender portal at **Email & collaboration** \> **Policies & rules** \> **Threat Policies** \> **Rules** section \> **Tenant Allow/Block Lists**. Or, to go directly to the **Tenant Allow/Block Lists** page, use .
diff --git a/defender-vulnerability-management/defender-vulnerability-management-capabilities.md b/defender-vulnerability-management/defender-vulnerability-management-capabilities.md
index bc8fa609da..57aca63b1c 100644
--- a/defender-vulnerability-management/defender-vulnerability-management-capabilities.md
+++ b/defender-vulnerability-management/defender-vulnerability-management-capabilities.md
@@ -2,8 +2,8 @@
title: Compare Microsoft Defender Vulnerability Management plans and capabilities
description: Compare Defender Vulnerability Management Offerings. Learn about the differences between the plans and select the plan that suits your organization's needs.
search.appverid: MET150
-author: siosulli
-ms.author: siosulli
+author: denisebmsft
+ms.author: deniseb
manager: deniseb
audience: ITPro
ms.topic: overview
diff --git a/defender-vulnerability-management/defender-vulnerability-management-faq.md b/defender-vulnerability-management/defender-vulnerability-management-faq.md
index 02a51fe1b5..c07c8595dd 100644
--- a/defender-vulnerability-management/defender-vulnerability-management-faq.md
+++ b/defender-vulnerability-management/defender-vulnerability-management-faq.md
@@ -4,8 +4,8 @@ description: Find answers to frequently asked questions (FAQs) about MDVM
ms.service: defender-vuln-mgmt
f1.keywords:
- NOCSH
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/defender-vulnerability-management-trial.md b/defender-vulnerability-management/defender-vulnerability-management-trial.md
index ada86fd595..2c83eacd95 100644
--- a/defender-vulnerability-management/defender-vulnerability-management-trial.md
+++ b/defender-vulnerability-management/defender-vulnerability-management-trial.md
@@ -4,8 +4,8 @@ description: Learn about the Microsoft Defender Vulnerability Management trial
ms.service: defender-vuln-mgmt
f1.keywords:
- NOCSH
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/defender-vulnerability-management.md b/defender-vulnerability-management/defender-vulnerability-management.md
index 3fa65300e1..966ccb95f2 100644
--- a/defender-vulnerability-management/defender-vulnerability-management.md
+++ b/defender-vulnerability-management/defender-vulnerability-management.md
@@ -1,8 +1,8 @@
---
title: Microsoft Defender Vulnerability Management
description: Microsoft Defender Vulnerability Management uses a risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.
-author: siosulli
-ms.author: siosulli
+author: denisebmsft
+ms.author: deniseb
manager: deniseb
ms.topic: overview
ms.service: defender-vuln-mgmt
diff --git a/defender-vulnerability-management/device-restart-status.md b/defender-vulnerability-management/device-restart-status.md
index 500c466c8b..cbfea21436 100644
--- a/defender-vulnerability-management/device-restart-status.md
+++ b/defender-vulnerability-management/device-restart-status.md
@@ -3,8 +3,8 @@ title: Device restart status
description: Learn about the device restart status tag in Microsoft Defender Vulnerability Management
ms.service: defender-vuln-mgmt
ms.pagetype: security
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/fixed-reported-inaccuracies.md b/defender-vulnerability-management/fixed-reported-inaccuracies.md
index b6e849d211..6964ed8323 100644
--- a/defender-vulnerability-management/fixed-reported-inaccuracies.md
+++ b/defender-vulnerability-management/fixed-reported-inaccuracies.md
@@ -4,8 +4,8 @@ description: List the reported inaccuracies that were fixed
search.appverid: MET150
ms.service: defender-vuln-mgmt
ms.pagetype: security
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
manager: deniseb
audience: ITPro
ms.collection:
@@ -13,7 +13,7 @@ ms.collection:
- tier2
ms.localizationpriority: medium
ms.topic: troubleshooting
-ms.date: 07/02/2024
+ms.date: 09/19/2024
---
# Vulnerability support in Microsoft Defender Vulnerability Management
@@ -42,6 +42,8 @@ The following tables present the relevant vulnerability information organized by
| 61457 | Fixed inaccurate detections in Mozilla Firefox | 03-Sept-24 |
| - | Fixed inaccuracy in Microsoft Visual Studio 2015 | 03-Sept-24 |
| - | Fixed inaccurate detections in Microsoft Teams by excluding downloads file path | 08-Sept-24 |
+| - | Fixed inaccuracy in Suse Kernel-Default-Devel | 09-Sept-24 |
+| 73287 | Fixed inaccuracy in CVE-2024-2800 | 09-Sept-24 |
| - | Fixed inaccuracy in Python vulnerability - CVE-2024-7592 | 10-Sept-24 |
| 54061 | Defender Vulnerability Management doesn't currently support Flock | 10-Sept-24 |
| 68097 | Fixed inaccuracy in OpenSSL vulnerabilities - CVE-2024-4603, CVE-2024-4741 & CVE-2024-5535 | 10-Sept-24 |
@@ -54,6 +56,10 @@ The following tables present the relevant vulnerability information organized by
| 71626 | Fixed inaccuracy in MongoDB vulnerability - CVE-2024-7553 | 10-Sept-24 |
| - | Fixed inaccuracy in Cisco Anyconnect Secure Mobility Client vulnerabilities - CVE-2023-20241 & CVE-2023-20240 | 10-Sept-24 |
| - | Fixed inaccuracy in Plantronics vulnerability - CVE-2024-27460 | 10-Sept-24 |
+| 72402 | Fixed inaccurate detections in FileZilla by excluding server.app path | 10-Sept-24 |
+| - | Added Microsoft Defender Vulnerability Management support to Kusto Explorer | 11-Sept-24 |
+| - | Fixed bad detections in Greenshot | 11-Sept-24 |
+| 71056 | Fixed inaccuracy in ExpressVPN | 11-Sept-24 |
## August 2024
diff --git a/defender-vulnerability-management/get-defender-vulnerability-management.md b/defender-vulnerability-management/get-defender-vulnerability-management.md
index b4e17e2adf..08ab3897d6 100644
--- a/defender-vulnerability-management/get-defender-vulnerability-management.md
+++ b/defender-vulnerability-management/get-defender-vulnerability-management.md
@@ -2,8 +2,8 @@
title: Sign up for Microsoft Defender Vulnerability Management
description: Get Microsoft Defender Vulnerability Management
search.appverid: MET150
-author: siosulli
-ms.author: siosulli
+author: denisebmsft
+ms.author: deniseb
manager: deniseb
audience: Admin
ms.topic: overview
diff --git a/defender-vulnerability-management/index.yml b/defender-vulnerability-management/index.yml
index 07420ba14b..c608df8dae 100644
--- a/defender-vulnerability-management/index.yml
+++ b/defender-vulnerability-management/index.yml
@@ -12,8 +12,8 @@ metadata:
- essentials-navigation
- tier1
ms.custom: intro-hub-or-landing
- author: siosulli
- ms.author: siosulli
+ author: denisebmsft
+ ms.author: deniseb
ms.date: 03/03/2022
# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | sample | tutorial | video | whats-new
diff --git a/defender-vulnerability-management/mdvm-onboard-devices.md b/defender-vulnerability-management/mdvm-onboard-devices.md
index d255e2400a..a030a3e984 100644
--- a/defender-vulnerability-management/mdvm-onboard-devices.md
+++ b/defender-vulnerability-management/mdvm-onboard-devices.md
@@ -1,8 +1,8 @@
---
title: Onboard to Microsoft Defender Vulnerability Management
description: Learn how to onboard endpoints to Microsoft Defender Vulnerability Management service
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/threat-and-vuln-mgt-event-timeline.md b/defender-vulnerability-management/threat-and-vuln-mgt-event-timeline.md
index d133d048d1..5eef27a8d0 100644
--- a/defender-vulnerability-management/threat-and-vuln-mgt-event-timeline.md
+++ b/defender-vulnerability-management/threat-and-vuln-mgt-event-timeline.md
@@ -2,8 +2,8 @@
title: Event timeline
description: Event timeline is a risk news feed that helps you interpret how risk is introduced into the organization, and which mitigations happened to reduce it.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/trial-user-guide-defender-vulnerability-management.md b/defender-vulnerability-management/trial-user-guide-defender-vulnerability-management.md
index 802ed26af1..e175fd3863 100644
--- a/defender-vulnerability-management/trial-user-guide-defender-vulnerability-management.md
+++ b/defender-vulnerability-management/trial-user-guide-defender-vulnerability-management.md
@@ -2,8 +2,8 @@
title: Trial user guide - Microsoft Defender Vulnerability Management
description: Learn how Microsoft Defender Vulnerability Management can help you protect all your users and data.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-assign-device-value.md b/defender-vulnerability-management/tvm-assign-device-value.md
index 5a4ca68418..462d38a616 100644
--- a/defender-vulnerability-management/tvm-assign-device-value.md
+++ b/defender-vulnerability-management/tvm-assign-device-value.md
@@ -2,8 +2,8 @@
title: Assign device value
description: Learn how to assign a low, normal, or high value to a device to help you differentiate between asset priorities.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-block-vuln-apps.md b/defender-vulnerability-management/tvm-block-vuln-apps.md
index b61bc48597..67e877cccb 100644
--- a/defender-vulnerability-management/tvm-block-vuln-apps.md
+++ b/defender-vulnerability-management/tvm-block-vuln-apps.md
@@ -3,8 +3,8 @@ title: Block vulnerable applications.
description: Use Microsoft Defender Vulnerability Management to block vulnerable applications.
ms.service: defender-vuln-mgmt
ms.pagetype: security
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-browser-extensions.md b/defender-vulnerability-management/tvm-browser-extensions.md
index 897dc6b65b..c50af6ee31 100644
--- a/defender-vulnerability-management/tvm-browser-extensions.md
+++ b/defender-vulnerability-management/tvm-browser-extensions.md
@@ -3,8 +3,8 @@ title: Browser extensions assessment
description: Find out about the browsers extensions installed in your environment
ms.service: defender-vuln-mgmt
ms.pagetype: security
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-certificate-inventory.md b/defender-vulnerability-management/tvm-certificate-inventory.md
index 0d9b80fb8e..1d2620ad37 100644
--- a/defender-vulnerability-management/tvm-certificate-inventory.md
+++ b/defender-vulnerability-management/tvm-certificate-inventory.md
@@ -2,8 +2,8 @@
title: Certificate inventory
description: Find out about the certificates installed in your environment.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-dashboard-insights.md b/defender-vulnerability-management/tvm-dashboard-insights.md
index e6cf2c146a..5adcfb08aa 100644
--- a/defender-vulnerability-management/tvm-dashboard-insights.md
+++ b/defender-vulnerability-management/tvm-dashboard-insights.md
@@ -2,8 +2,8 @@
title: Microsoft Defender Vulnerability Management dashboard
description: The Microsoft Defender Vulnerability Management dashboard can help SecOps and security admins address cybersecurity threats and build their organization's security resilience.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-end-of-support-software.md b/defender-vulnerability-management/tvm-end-of-support-software.md
index 78385dda90..38e1e9367d 100644
--- a/defender-vulnerability-management/tvm-end-of-support-software.md
+++ b/defender-vulnerability-management/tvm-end-of-support-software.md
@@ -2,8 +2,8 @@
title: Plan for end-of-support software and software versions
description: Discover and plan for software and software versions that are no longer supported and won't receive security updates.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-exception.md b/defender-vulnerability-management/tvm-exception.md
index 79b98ea0b6..d3a3730080 100644
--- a/defender-vulnerability-management/tvm-exception.md
+++ b/defender-vulnerability-management/tvm-exception.md
@@ -2,8 +2,8 @@
title: Create and view exceptions for security recommendations
description: Create and monitor exceptions for security recommendations in Microsoft Defender Vulnerability Management.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-exposure-score.md b/defender-vulnerability-management/tvm-exposure-score.md
index 89e3a84fff..7889bc3853 100644
--- a/defender-vulnerability-management/tvm-exposure-score.md
+++ b/defender-vulnerability-management/tvm-exposure-score.md
@@ -2,8 +2,8 @@
title: Exposure score in Defender Vulnerability Management
description: The Microsoft Defender Vulnerability Management exposure score reflects how vulnerable your organization is to cybersecurity threats.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-hardware-and-firmware.md b/defender-vulnerability-management/tvm-hardware-and-firmware.md
index de308b4c14..23f176b0aa 100644
--- a/defender-vulnerability-management/tvm-hardware-and-firmware.md
+++ b/defender-vulnerability-management/tvm-hardware-and-firmware.md
@@ -2,8 +2,8 @@
title: Firmware and hardware assessment
description: Find out about the firmware and hardware installed in your environment
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-hunt-exposed-devices.md b/defender-vulnerability-management/tvm-hunt-exposed-devices.md
index 41d0840bb1..32833390c0 100644
--- a/defender-vulnerability-management/tvm-hunt-exposed-devices.md
+++ b/defender-vulnerability-management/tvm-hunt-exposed-devices.md
@@ -2,8 +2,8 @@
title: Hunt for exposed devices
description: Learn how Microsoft Defender Vulnerability Management can be used to help security admins, IT admins, and SecOps collaborate.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-manage-Log4shell-guidance.md b/defender-vulnerability-management/tvm-manage-Log4shell-guidance.md
index e28378794b..f5dffd9d6c 100644
--- a/defender-vulnerability-management/tvm-manage-Log4shell-guidance.md
+++ b/defender-vulnerability-management/tvm-manage-Log4shell-guidance.md
@@ -4,8 +4,8 @@ description: Learn how to mitigate the Log4Shell vulnerability in Microsoft Defe
ms.service: defender-vuln-mgmt
f1.keywords:
- NOCSH
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-microsoft-secure-score-devices.md b/defender-vulnerability-management/tvm-microsoft-secure-score-devices.md
index 6550d525bd..c135489dd7 100644
--- a/defender-vulnerability-management/tvm-microsoft-secure-score-devices.md
+++ b/defender-vulnerability-management/tvm-microsoft-secure-score-devices.md
@@ -2,8 +2,8 @@
title: Microsoft Secure Score for Devices
description: Your score for devices shows the collective security configuration state of your devices across application, operating system, network, accounts, and security controls.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-network-share-assessment.md b/defender-vulnerability-management/tvm-network-share-assessment.md
index dcec6253f5..37b5d47b37 100644
--- a/defender-vulnerability-management/tvm-network-share-assessment.md
+++ b/defender-vulnerability-management/tvm-network-share-assessment.md
@@ -2,8 +2,8 @@
title: Network share configuration assessment
description: Learn review recommendations related to network shares in your environment through vulnerability management.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-prerequisites.md b/defender-vulnerability-management/tvm-prerequisites.md
index 627b282978..f2170f487a 100644
--- a/defender-vulnerability-management/tvm-prerequisites.md
+++ b/defender-vulnerability-management/tvm-prerequisites.md
@@ -2,8 +2,8 @@
title: Prerequisites & permissions for Microsoft Defender Vulnerability Management
description: Before you begin using Microsoft Defender Vulnerability Management, make sure you have the relevant configurations and permissions.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-remediation.md b/defender-vulnerability-management/tvm-remediation.md
index 10e97306fd..23b55dcfe4 100644
--- a/defender-vulnerability-management/tvm-remediation.md
+++ b/defender-vulnerability-management/tvm-remediation.md
@@ -2,8 +2,8 @@
title: Remediate vulnerabilities
description: Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in defender vulnerability management.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-security-baselines.md b/defender-vulnerability-management/tvm-security-baselines.md
index 168f8117e3..3c3909372f 100644
--- a/defender-vulnerability-management/tvm-security-baselines.md
+++ b/defender-vulnerability-management/tvm-security-baselines.md
@@ -2,8 +2,8 @@
title: Security baselines assessment
description: Find out about the security baselines in your environment
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-security-recommendation.md b/defender-vulnerability-management/tvm-security-recommendation.md
index 732c633afe..e6a34ed3d3 100644
--- a/defender-vulnerability-management/tvm-security-recommendation.md
+++ b/defender-vulnerability-management/tvm-security-recommendation.md
@@ -2,8 +2,8 @@
title: Security recommendations
description: Get actionable security recommendations prioritized by threat, likelihood to be breached, and value, in vulnerability management.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-software-inventory.md b/defender-vulnerability-management/tvm-software-inventory.md
index b74222f004..3f15ddccfd 100644
--- a/defender-vulnerability-management/tvm-software-inventory.md
+++ b/defender-vulnerability-management/tvm-software-inventory.md
@@ -2,8 +2,8 @@
title: Software inventory
description: The software inventory page for Microsoft Defender for Endpoint's Vulnerability Management shows how many weaknesses and vulnerabilities have been detected in software.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-supported-os.md b/defender-vulnerability-management/tvm-supported-os.md
index 5258d46196..c840c0ab98 100644
--- a/defender-vulnerability-management/tvm-supported-os.md
+++ b/defender-vulnerability-management/tvm-supported-os.md
@@ -2,8 +2,8 @@
title: Supported operating systems platforms and capabilities
description: Ensure that you meet the operating system or platform requisites for Microsoft Defender Vulnerability Management, so the activities in your all devices are properly accounted for.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.reviewer: yongrhee
ms.localizationpriority: medium
manager: deniseb
diff --git a/defender-vulnerability-management/tvm-usage-insights.md b/defender-vulnerability-management/tvm-usage-insights.md
index 60bb38d66d..65a5f815f7 100644
--- a/defender-vulnerability-management/tvm-usage-insights.md
+++ b/defender-vulnerability-management/tvm-usage-insights.md
@@ -2,8 +2,8 @@
title: Software usage insights
description: Use Microsoft Defender Vulnerability Management to assess software usage
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-vulnerable-components.md b/defender-vulnerability-management/tvm-vulnerable-components.md
index 51c22b2524..ad80e09d4c 100644
--- a/defender-vulnerability-management/tvm-vulnerable-components.md
+++ b/defender-vulnerability-management/tvm-vulnerable-components.md
@@ -2,8 +2,8 @@
title: Vulnerable components
description: The Vulnerable components page lists components with known critical vulnerabilities.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-vulnerable-devices-report.md b/defender-vulnerability-management/tvm-vulnerable-devices-report.md
index aa019e87c9..e648393a16 100644
--- a/defender-vulnerability-management/tvm-vulnerable-devices-report.md
+++ b/defender-vulnerability-management/tvm-vulnerable-devices-report.md
@@ -2,8 +2,8 @@
title: Vulnerable devices report
description: A report showing vulnerable device trends and current statistics so you can understand the breath and scope of your device exposure.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/tvm-weaknesses-security-advisories.md b/defender-vulnerability-management/tvm-weaknesses-security-advisories.md
index 89615a2999..b3c1cfd438 100644
--- a/defender-vulnerability-management/tvm-weaknesses-security-advisories.md
+++ b/defender-vulnerability-management/tvm-weaknesses-security-advisories.md
@@ -2,8 +2,8 @@
title: Security advisories
description: Lists the firmware security advisories for devices in your organization. Discovered by the Microsoft Defender vulnerability management capabilities.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
@@ -12,12 +12,12 @@ ms.collection:
- Tier1
ms.topic: conceptual
search.appverid: met150
-ms.date: 01/25/2024
+ms.date: 09/20/2024
---
# Security advisories
-Security advisories provide an efficient way to view, track, and monitor firmware advisories for affected devices. You can filter on exposed devices and view advisories that affect specific devices. By monitoring these advisories, security teams can take action more quickly to prevent attackers from targeting firmware vulnerabilities.
+Security advisories provide an efficient way to view, track, and monitor firmware advisories for affected devices. You can filter on exposed devices and view advisories that affect specific devices. With these advisories, security teams can take action more quickly to prevent attackers from targeting firmware vulnerabilities.
> [!NOTE]
> This capability is currently available in public preview and may be substantially modified before it's commercially released.
@@ -42,7 +42,7 @@ To view firmware security advisories:
:::image type="content" alt-text="Screenshot of the security advisory filtered view." source="/defender/media/defender-vulnerability-management/security-advisory-view.png" lightbox="/defender/media/defender-vulnerability-management/security-advisory-view.png":::
-Security advisories include information about specific version of affected devices or software in your organization that are affected and, if available, instructions for how to update the firmware to address the vulnerability.
+Security advisories include information about specific versions of affected devices or software in your organization that are affected and, if available, instructions for how to update the firmware to address the vulnerability.
> [!NOTE]
> Security Advisories are available for the following vendors: Lenovo, Dell, HP.
diff --git a/defender-vulnerability-management/tvm-weaknesses.md b/defender-vulnerability-management/tvm-weaknesses.md
index 9af9070bb7..1d0662e736 100644
--- a/defender-vulnerability-management/tvm-weaknesses.md
+++ b/defender-vulnerability-management/tvm-weaknesses.md
@@ -2,8 +2,8 @@
title: Vulnerabilities in my organization
description: Lists the common vulnerabilities and exposures (CVE) ID of weaknesses found in the software running in your organization. Discovered by the Microsoft Defender vulnerability management capabilities.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
@@ -12,7 +12,7 @@ ms.collection:
- Tier1
ms.topic: conceptual
search.appverid: met150
-ms.date: 07/31/2024
+ms.date: 09/24/2024
---
# Vulnerabilities in my organization
@@ -81,7 +81,7 @@ If you select a CVE from the weaknesses page, a flyout panel opens with more inf
For each CVE, you can see a list of the exposed devices and the affected software.
-## Exploit Prediction Scoring System (EPSS)
+## Exploit Prediction Scoring System (EPSS)
The Exploit Prediction Scoring System (EPSS) generates a data-driven score for the probability of a known software vulnerability being exploited in the wild. EPSS uses current threat information from the CVE and real-world exploit data. For each CVE, the EPSS model produces a probability score between 0 and 1 (0% and 100%). The higher the score, the greater the probability that a vulnerability will be exploited. Learn more about [EPSS](https://www.first.org/epss/).
@@ -96,7 +96,7 @@ When the EPSS is greater than 0.9, the **Threats** column tooltip is updated wit
:::image type="content" source="/defender/media/defender-vulnerability-management/tvm-weaknesses-epss-tip.png" alt-text="Screenshot of the weaknesses epss score in the threat tooltip." lightbox="/defender/media/defender-vulnerability-management/tvm-weaknesses-epss-tip.png":::
> [!NOTE]
- > Note that if the EPSS score is smaller than 0.001, it’s considered to be 0.
+> Note that if the EPSS score is smaller than 0.001, it’s considered to be 0.
You can use the [Vulnerability API](/defender-endpoint/api/vulnerability) to see the EPSS score.
@@ -126,9 +126,12 @@ You can request for support to be added to Defender Vulnerability Management for
1. Select the CVE from the [Weaknesses](https://security.microsoft.com/vulnerabilities/cves) page in the Microsoft Defender portal
2. Select **Please support this CVE** from the Vulnerability details tab
-The request is sent to Microsoft and will assist us in prioritizing this CVE among others in our system.
+ The request is sent to Microsoft and will assist us in prioritizing this CVE among others in our system.
-:::image type="content" alt-text="Weakness flyout with support CVE button example." source="/defender/media/defender-vulnerability-management/weaknesses-support-cve.png" lightbox="/defender/media/defender-vulnerability-management/weaknesses-support-cve.png":::
+ > [!NOTE]
+ > Request CVE support functionality is not available for GCC, GCC High and DoD customers.
+
+ :::image type="content" alt-text="Weakness flyout with support CVE button example." source="/defender/media/defender-vulnerability-management/weaknesses-support-cve.png" lightbox="/defender/media/defender-vulnerability-management/weaknesses-support-cve.png":::
## View Common Vulnerabilities and Exposures (CVE) entries in other places
@@ -136,7 +139,7 @@ The request is sent to Microsoft and will assist us in prioritizing this CVE amo
1. Go to the [Defender Vulnerability Management dashboard](tvm-dashboard-insights.md) and scroll down to the **Top vulnerable software** widget. You'll see the number of vulnerabilities found in each software, along with threat information and a high-level view of device exposure over time.
-:::image type="content" alt-text="Top vulnerable software card." source="/defender/media/defender-vulnerability-management/tvm-top-vulnerable-software500.png" lightbox="/defender/media/defender-vulnerability-management/tvm-top-vulnerable-software500.png":::
+ :::image type="content" alt-text="Top vulnerable software card." source="/defender/media/defender-vulnerability-management/tvm-top-vulnerable-software500.png" lightbox="/defender/media/defender-vulnerability-management/tvm-top-vulnerable-software500.png":::
2. Select the software you want to investigate.
3. Select the **Discovered vulnerabilities** tab.
@@ -161,9 +164,9 @@ To see the detection logic:
2. Select **Open device page** and select **Discovered vulnerabilities** from the device page.
3. Select the vulnerability you want to investigate.
-A flyout opens and the **Detection logic** section shows the detection logic and source.
+ A flyout opens and the **Detection logic** section shows the detection logic and source.
-:::image type="content" alt-text="Detection Logic example that lists the software detected on the device and the KBs." source="/defender/media/defender-vulnerability-management/tvm-cve-detection-logic.png":::
+ :::image type="content" alt-text="Detection Logic example that lists the software detected on the device and the KBs." source="/defender/media/defender-vulnerability-management/tvm-cve-detection-logic.png":::
The "OS Feature" category is also shown in relevant scenarios. This is when a CVE would affect devices that run a vulnerable OS if a specific OS component is enabled. For example, if Windows Server 2019 or Windows Server 2022 has vulnerability in its DNS component we only attach this CVE to the Windows Server 2019 and Windows Server 2022 devices with the DNS capability enabled in their OS.
@@ -177,7 +180,7 @@ Report a false positive when you see any vague, inaccurate, or incomplete inform
4. Fill in the requested details about the inaccuracy. This varies depending on the issue you're reporting.
5. Select **Submit**. Your feedback is immediately sent to the Microsoft Defender Vulnerability Management experts.
-:::image type="content" alt-text="Report inaccuracy options." source="/defender/media/defender-vulnerability-management/report-inaccuracy-software.png" lightbox="/defender/media/defender-vulnerability-management/report-inaccuracy-software.png":::
+ :::image type="content" alt-text="Report inaccuracy options." source="/defender/media/defender-vulnerability-management/report-inaccuracy-software.png" lightbox="/defender/media/defender-vulnerability-management/report-inaccuracy-software.png":::
## Related articles
diff --git a/defender-vulnerability-management/tvm-zero-day-vulnerabilities.md b/defender-vulnerability-management/tvm-zero-day-vulnerabilities.md
index ce03e4805a..1e03e41003 100644
--- a/defender-vulnerability-management/tvm-zero-day-vulnerabilities.md
+++ b/defender-vulnerability-management/tvm-zero-day-vulnerabilities.md
@@ -2,8 +2,8 @@
title: Mitigate zero-day vulnerabilities
description: Learn how to find and mitigate zero-day vulnerabilities in your environment through Microsoft Defender Vulnerability Management.
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/whats-new-in-microsoft-defender-vulnerability-management.md b/defender-vulnerability-management/whats-new-in-microsoft-defender-vulnerability-management.md
index 1ae21f3718..e528179f3b 100644
--- a/defender-vulnerability-management/whats-new-in-microsoft-defender-vulnerability-management.md
+++ b/defender-vulnerability-management/whats-new-in-microsoft-defender-vulnerability-management.md
@@ -3,8 +3,8 @@ title: What's new in Microsoft Defender Vulnerability Management
description: See what features are available in the latest release of Microsoft Defender for Vulnerability Management
search.appverid: met150
ms.service: defender-vuln-mgmt
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-vulnerability-management/windows-authenticated-scan.md b/defender-vulnerability-management/windows-authenticated-scan.md
index 21057ba96f..cade6c9012 100644
--- a/defender-vulnerability-management/windows-authenticated-scan.md
+++ b/defender-vulnerability-management/windows-authenticated-scan.md
@@ -2,14 +2,14 @@
title: Authenticated scan for Windows in Defender Vulnerability Management
description: Find out about how to create Authenticated scans for Windows
search.appverid: MET150
-author: siosulli
-ms.author: siosulli
+author: denisebmsft
+ms.author: deniseb
manager: deniseb
audience: Admin
ms.topic: conceptual
ms.service: defender-vuln-mgmt
ms.localizationpriority: medium
-ms.date: 05/12/2022
+ms.date: 09/20/2024
ms.collection:
- m365-security
- Tier1
diff --git a/defender-xdr/TOC.yml b/defender-xdr/TOC.yml
index fffadbb7bf..54256a18bd 100644
--- a/defender-xdr/TOC.yml
+++ b/defender-xdr/TOC.yml
@@ -444,6 +444,8 @@
href: copilot-in-defender-file-analysis.md
- name: Generate device summaries
href: copilot-in-defender-device-summary.md
+ - name: Summarize identities
+ href: security-copilot-defender-identity-summary.md
- name: Use guided responses
href: security-copilot-m365d-guided-response.md
- name: Generate KQL queries
diff --git a/defender-xdr/advanced-hunting-deviceevents-table.md b/defender-xdr/advanced-hunting-deviceevents-table.md
index 551e3805c7..d019f452a9 100644
--- a/defender-xdr/advanced-hunting-deviceevents-table.md
+++ b/defender-xdr/advanced-hunting-deviceevents-table.md
@@ -68,7 +68,7 @@ For information on other tables in the advanced hunting schema, [see the advance
| `InitiatingProcessSHA1` | `string` | SHA-1 of the process (image file) that initiated the event |
| `InitiatingProcessSHA256` | `string` | SHA-256 of the process (image file) that initiated the event. This field is usually not populated — use the SHA1 column when available. |
| `InitiatingProcessMD5` | `string` | MD5 hash of the process (image file) that initiated the event |
-| `InitiatingProcessFileName` | `string` | Name of the process that initiated the event |
+| `InitiatingProcessFileName` | `string` | Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead |
| `InitiatingProcessFileSize` | `long` | Size of the file that ran the process responsible for the event |
| `InitiatingProcessFolderPath` | `string` | Folder containing the process (image file) that initiated the event |
| `InitiatingProcessId` | `long` | Process ID (PID) of the process that initiated the event |
diff --git a/defender-xdr/advanced-hunting-devicefileevents-table.md b/defender-xdr/advanced-hunting-devicefileevents-table.md
index df030d31e2..ef1ec0ab1c 100644
--- a/defender-xdr/advanced-hunting-devicefileevents-table.md
+++ b/defender-xdr/advanced-hunting-devicefileevents-table.md
@@ -60,7 +60,7 @@ For information on other tables in the advanced hunting schema, [see the advance
| `InitiatingProcessSHA1` | `string` | SHA-1 of the process (image file) that initiated the event |
| `InitiatingProcessSHA256` | `string` | SHA-256 of the process (image file) that initiated the event. This field is usually not populated — use the SHA1 column when available. |
| `InitiatingProcessFolderPath` | `string` | Folder containing the process (image file) that initiated the event |
-| `InitiatingProcessFileName` | `string` | Name of the process that initiated the event |
+| `InitiatingProcessFileName` | `string` | Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead |
| `InitiatingProcessFileSize` | `long` | Size of the process (image file) that initiated the event |
| `InitiatingProcessVersionInfoCompanyName` | `string` | Company name from the version information of the process (image file) responsible for the event |
| `InitiatingProcessVersionInfoProductName` | `string` | Product name from the version information of the process (image file) responsible for the event |
diff --git a/defender-xdr/advanced-hunting-deviceimageloadevents-table.md b/defender-xdr/advanced-hunting-deviceimageloadevents-table.md
index 9b2d775cda..3e82cf76c3 100644
--- a/defender-xdr/advanced-hunting-deviceimageloadevents-table.md
+++ b/defender-xdr/advanced-hunting-deviceimageloadevents-table.md
@@ -56,7 +56,7 @@ For information on other tables in the advanced hunting schema, [see the advance
| `InitiatingProcessSHA1` | `string` | SHA-1 of the process (image file) that initiated the event |
| `InitiatingProcessSHA256` | `string` | SHA-256 of the process (image file) that initiated the event. This field is usually not populated — use the SHA1 column when available. |
| `InitiatingProcessMD5` | `string` | MD5 hash of the process (image file) that initiated the event |
-| `InitiatingProcessFileName` | `string` | Name of the process that initiated the event |
+| `InitiatingProcessFileName` | `string` | Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead |
| `InitiatingProcessFileSize` | `long` | Size of the file that ran the process responsible for the event |
| `InitiatingProcessVersionInfoCompanyName` | `string` | Company name from the version information of the process (image file) responsible for the event |
| `InitiatingProcessVersionInfoProductName` | `string` | Product name from the version information of the process (image file) responsible for the event |
diff --git a/defender-xdr/advanced-hunting-devicelogonevents-table.md b/defender-xdr/advanced-hunting-devicelogonevents-table.md
index ccb36bb3cf..5a7cf10ad7 100644
--- a/defender-xdr/advanced-hunting-devicelogonevents-table.md
+++ b/defender-xdr/advanced-hunting-devicelogonevents-table.md
@@ -64,7 +64,7 @@ For information on other tables in the advanced hunting schema, [see the advance
| `InitiatingProcessSHA1` | `string` | SHA-1 hash of the process (image file) that initiated the event |
| `InitiatingProcessSHA256` | `string` | SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available. |
| `InitiatingProcessMD5` | `string` | MD5 hash of the process (image file) that initiated the event |
-| `InitiatingProcessFileName` | `string` | Name of the process that initiated the event |
+| `InitiatingProcessFileName` | `string` | Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead|
| `InitiatingProcessFileSize` | `long` | Size of the file that ran the process responsible for the event |
| `InitiatingProcessVersionInfoCompanyName` | `string` | Company name from the version information of the process (image file) responsible for the event |
| `InitiatingProcessVersionInfoProductName` | `string` | Product name from the version information of the process (image file) responsible for the event |
diff --git a/defender-xdr/advanced-hunting-devicenetworkevents-table.md b/defender-xdr/advanced-hunting-devicenetworkevents-table.md
index 388c1cd589..4d27a073ef 100644
--- a/defender-xdr/advanced-hunting-devicenetworkevents-table.md
+++ b/defender-xdr/advanced-hunting-devicenetworkevents-table.md
@@ -53,7 +53,7 @@ For information on other tables in the advanced hunting schema, [see the advance
| `InitiatingProcessSHA1` | `string` | SHA-1 of the process (image file) that initiated the event |
| `InitiatingProcessSHA256` | `string` | SHA-256 of the process (image file) that initiated the event. This field is usually not populated — use the SHA1 column when available. |
| `InitiatingProcessMD5` | `string` | MD5 hash of the process (image file) that initiated the event |
-| `InitiatingProcessFileName` | `string` | Name of the process that initiated the event |
+| `InitiatingProcessFileName` | `string` | Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead |
| `InitiatingProcessFileSize` | `long` | Size of the file that ran the process responsible for the event |
| `InitiatingProcessVersionInfoCompanyName` | `string` | Company name from the version information of the process (image file) responsible for the event |
| `InitiatingProcessVersionInfoProductName` | `string` | Product name from the version information of the process (image file) responsible for the event |
diff --git a/defender-xdr/advanced-hunting-deviceprocessevents-table.md b/defender-xdr/advanced-hunting-deviceprocessevents-table.md
index 17d1fb9087..979b5485e6 100644
--- a/defender-xdr/advanced-hunting-deviceprocessevents-table.md
+++ b/defender-xdr/advanced-hunting-deviceprocessevents-table.md
@@ -76,7 +76,7 @@ For information on other tables in the advanced hunting schema, [see the advance
| `InitiatingProcessSHA1` | `string` | SHA-1 hash of the process (image file) that initiated the event |
| `InitiatingProcessSHA256` | `string` | SHA-256 of the process (image file) that initiated the event. This field is usually not populated — use the SHA1 column when available. |
| `InitiatingProcessMD5` | `string` | MD5 hash of the process (image file) that initiated the event |
-| `InitiatingProcessFileName` | `string` | Name of the process that initiated the event |
+| `InitiatingProcessFileName` | `string` | Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead |
| `InitiatingProcessFileSize` | `long` | Size of the file that ran the process responsible for the event |
| `InitiatingProcessVersionInfoCompanyName` | `string` | Company name from the version information of the process (image file) responsible for the event |
| `InitiatingProcessVersionInfoProductName` | `string` | Product name from the version information of the process (image file) responsible for the event |
diff --git a/defender-xdr/advanced-hunting-deviceregistryevents-table.md b/defender-xdr/advanced-hunting-deviceregistryevents-table.md
index a7e8dd620a..33d6bfaf57 100644
--- a/defender-xdr/advanced-hunting-deviceregistryevents-table.md
+++ b/defender-xdr/advanced-hunting-deviceregistryevents-table.md
@@ -55,7 +55,7 @@ For information on other tables in the advanced hunting schema, [see the advance
| `InitiatingProcessSHA1` | `string` | SHA-1 of the process (image file) that initiated the event |
| `InitiatingProcessSHA256` | `string` | SHA-256 of the process (image file) that initiated the event. This field is usually not populated — use the SHA1 column when available. |
| `InitiatingProcessMD5` | `string` | MD5 hash of the process (image file) that initiated the event |
-| `InitiatingProcessFileName` | `string` | Name of the process that initiated the event |
+| `InitiatingProcessFileName` | `string` | Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead |
| `InitiatingProcessFileSize` | `long` | Size of the file that ran the process responsible for the event |
| `InitiatingProcessVersionInfoCompanyName` | `string` | Company name from the version information of the process (image file) responsible for the event |
| `InitiatingProcessVersionInfoProductName` | `string` | Product name from the version information of the process (image file) responsible for the event |
diff --git a/defender-xdr/compare-rbac-roles.md b/defender-xdr/compare-rbac-roles.md
index 49aa8df59d..ef1b023ccf 100644
--- a/defender-xdr/compare-rbac-roles.md
+++ b/defender-xdr/compare-rbac-roles.md
@@ -2,8 +2,8 @@
title: Map Microsoft Defender XDR Unified role-based access control (RBAC) permissions
description: Compare permissions and access to Microsoft Defender XDR Security portal experiences using role-based access control (RBAC)
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
diff --git a/defender-xdr/configure-asset-rules.md b/defender-xdr/configure-asset-rules.md
index 19c6303a02..ce96a9bba9 100644
--- a/defender-xdr/configure-asset-rules.md
+++ b/defender-xdr/configure-asset-rules.md
@@ -2,8 +2,8 @@
title: Asset rule management - Dynamic rules
description: You can use Microsoft Defender for Endpoint to configure dynamic tagging
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
diff --git a/defender-xdr/copilot-in-defender-device-summary.md b/defender-xdr/copilot-in-defender-device-summary.md
index 44013a91b5..ac971b4f71 100644
--- a/defender-xdr/copilot-in-defender-device-summary.md
+++ b/defender-xdr/copilot-in-defender-device-summary.md
@@ -53,7 +53,7 @@ You can access the device summary capability through the following ways:
:::image type="content" source="/defender/media/copilot-in-defender/device-summary/copilot-defender-device-summary-device-page-small.png" alt-text="Screenshot of the device summary results in Copilot in Defender." lightbox="/defender/media/copilot-in-defender/device-summary/copilot-defender-device-summary-device-page.png":::
-- From an incident page, you can choose a device on the incident graph and then select **Device details** (1). On the device pane, select **Summarize** (2) to generate the device summary. The summary is displayed in the Copilot pane.
+- From an incident page, you can choose a device on the incident graph and then (1) select **Device details**. On the device pane, (2) select **Summarize** to generate the device summary. The summary is displayed in the Copilot pane.
:::image type="content" source="/defender/media/copilot-in-defender/device-summary/copilot-defender-device-summary-device-page-small.png" alt-text="Screenshot highlighting the steps to access the device summary in an incident page in Copilot in Defender." lightbox="/defender/media/copilot-in-defender/device-summary/copilot-defender-device-summary-device-page-small.png":::
diff --git a/defender-xdr/custom-permissions-details.md b/defender-xdr/custom-permissions-details.md
index 8d3a9b5ba5..8cf7688092 100644
--- a/defender-xdr/custom-permissions-details.md
+++ b/defender-xdr/custom-permissions-details.md
@@ -2,8 +2,8 @@
title: Details of custom permissions in Microsoft Defender XDR Unified role-based access control (RBAC)
description: Learn about the custom permissions available in Microsoft Defender XDR Security role-based access control (RBAC)
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
diff --git a/defender-xdr/microsoft-secure-score-history-metrics-trends.md b/defender-xdr/microsoft-secure-score-history-metrics-trends.md
index f26f93e05d..d0cfd171c8 100644
--- a/defender-xdr/microsoft-secure-score-history-metrics-trends.md
+++ b/defender-xdr/microsoft-secure-score-history-metrics-trends.md
@@ -6,8 +6,8 @@ ms.mktglfcycl: deploy
ms.localizationpriority: medium
f1.keywords:
- NOCSH
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
manager: dansimp
audience: ITPro
ms.collection:
diff --git a/defender-xdr/microsoft-secure-score-improvement-actions.md b/defender-xdr/microsoft-secure-score-improvement-actions.md
index fe169972d8..5c5cccda08 100644
--- a/defender-xdr/microsoft-secure-score-improvement-actions.md
+++ b/defender-xdr/microsoft-secure-score-improvement-actions.md
@@ -5,8 +5,8 @@ ms.service: defender-xdr
ms.localizationpriority: medium
f1.keywords:
- NOCSH
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
manager: dansimp
audience: ITPro
ms.collection:
diff --git a/defender-xdr/microsoft-secure-score.md b/defender-xdr/microsoft-secure-score.md
index 27c9bc1708..23b3703876 100644
--- a/defender-xdr/microsoft-secure-score.md
+++ b/defender-xdr/microsoft-secure-score.md
@@ -5,8 +5,8 @@ ms.service: defender-xdr
ms.localizationpriority: medium
f1.keywords:
- NOCSH
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
manager: dansimp
audience: ITPro
ms.collection:
diff --git a/defender-xdr/mto-advanced-hunting.md b/defender-xdr/mto-advanced-hunting.md
index feca96fb0f..f6a5a4a539 100644
--- a/defender-xdr/mto-advanced-hunting.md
+++ b/defender-xdr/mto-advanced-hunting.md
@@ -3,8 +3,8 @@ title: Advanced hunting in Microsoft Defender multitenant management
description: Learn about advanced hunting in Microsoft Defender multitenant management
search.appverid: met150
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
diff --git a/defender-xdr/mto-dashboard.md b/defender-xdr/mto-dashboard.md
index 0a7ece5868..b6128ba094 100644
--- a/defender-xdr/mto-dashboard.md
+++ b/defender-xdr/mto-dashboard.md
@@ -3,8 +3,8 @@ title: Vulnerability management in multitenant management
description: Learn about the capabilities of the vulnerability management dashboard in multitenant management in Microsoft Defender XDR
search.appverid: met150
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
diff --git a/defender-xdr/mto-incidents-alerts.md b/defender-xdr/mto-incidents-alerts.md
index 55d9e3d9fd..2390e19294 100644
--- a/defender-xdr/mto-incidents-alerts.md
+++ b/defender-xdr/mto-incidents-alerts.md
@@ -3,8 +3,8 @@ title: View and manage incidents and alerts in Microsoft Defender multitenant ma
description: Learn about incidents and alerts in Microsoft Defender multitenant management
search.appverid: met150
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
diff --git a/defender-xdr/mto-overview.md b/defender-xdr/mto-overview.md
index a656a66486..e219434bab 100644
--- a/defender-xdr/mto-overview.md
+++ b/defender-xdr/mto-overview.md
@@ -2,8 +2,8 @@
title: Microsoft Defender multitenant management
description: Learn about multitenant management for Microsoft Defender XDR and Microsoft Sentinel in the Microsoft unified security operations platform.
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
diff --git a/defender-xdr/mto-requirements.md b/defender-xdr/mto-requirements.md
index 384f743949..43d824bce5 100644
--- a/defender-xdr/mto-requirements.md
+++ b/defender-xdr/mto-requirements.md
@@ -2,8 +2,8 @@
title: Set up Microsoft Defender multitenant management
description: Learn what steps you need to take to get started with multitenant management for Microsoft Defender XDR and the Microsoft unified security operations platform.
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
diff --git a/defender-xdr/mto-tenant-devices.md b/defender-xdr/mto-tenant-devices.md
index 53e8ba829c..13432580c4 100644
--- a/defender-xdr/mto-tenant-devices.md
+++ b/defender-xdr/mto-tenant-devices.md
@@ -3,8 +3,8 @@ title: Devices in multitenant management
description: Learn about multitenant device view in multitenant management of the Microsoft Defender XDR.
search.appverid: met150
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
diff --git a/defender-xdr/mto-tenants.md b/defender-xdr/mto-tenants.md
index cb476bf8ba..db5d101cf4 100644
--- a/defender-xdr/mto-tenants.md
+++ b/defender-xdr/mto-tenants.md
@@ -3,8 +3,8 @@ title: Manage tenants with Microsoft Defender multitenant management
description: Learn about the tenant list in Microsoft Defender multitenant management
search.appverid: met150
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
diff --git a/defender-xdr/secure-score-data-storage-privacy.md b/defender-xdr/secure-score-data-storage-privacy.md
index 7c159916de..400578a534 100644
--- a/defender-xdr/secure-score-data-storage-privacy.md
+++ b/defender-xdr/secure-score-data-storage-privacy.md
@@ -2,8 +2,8 @@
title: Microsoft Secure score data storage and privacy
description: Learn about how Microsoft Secure score handles privacy and data that it collects.
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: dansimp
audience: ITPro
diff --git a/defender-xdr/security-copilot-defender-identity-summary.md b/defender-xdr/security-copilot-defender-identity-summary.md
new file mode 100644
index 0000000000..081d3fb2a2
--- /dev/null
+++ b/defender-xdr/security-copilot-defender-identity-summary.md
@@ -0,0 +1,88 @@
+---
+title: Summarize identity information with Microsoft Copilot in Microsoft Defender
+description: Summarize an identity information with Microsoft Copilot in Microsoft Defender to investigate identities.
+ms.service: defender-xdr
+f1.keywords:
+ - NOCSH
+ms.author: diannegali
+author: diannegali
+ms.localizationpriority: medium
+manager: deniseb
+audience: ITPro
+ms.collection:
+ - m365-security
+ - tier1
+ - security-copilot
+ms.topic: conceptual
+search.appverid:
+ - MOE150
+ - MET150
+ms.date: 09/23/2024
+appliesto:
+- Microsoft Defender XDR
+- Microsoft Sentinel in the unified security operations center (SOC) platform
+---
+
+# Summarize identity information with Microsoft Copilot in Microsoft Defender
+
+[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
+
+Security operations teams investigating users can easily understand identity information with the identity summary capability in [Microsoft Copilot for Security](/security-copilot/microsoft-security-copilot) in Microsoft Defender. Through generative AI and harnessing the power of Microsoft Defender for Identity, Copilot creates contextual insights about an identity in an organization, helping analysts quickly understand important data to speed up their investigation.
+
+With the identity summary capability, analysts can immediately identify suspicious or risky identity-related changes and actions that can negatively impact an organization. The summary also includes potential misconfigurations that affects an identity. Using natural language, Copilot delivers clear and actionable user information that analysts can use in their incident investigation activities. The capability currently focuses on users and will include service accounts in its next iteration.
+
+The identity summary contains essential information about an identity, including:
+
+- The date when a user account is created, and whether the user account is of high, medium, or low criticality
+- Any unusual behavioral patterns related to sign in locations, sign in frequency, or frequency of failed sign in attempts
+- A user’s current role, including their department and position, and whether there are notable role changes compared to the user’s job title and department to highlight inconsistencies
+- Data about a user’s last sign in to a device, whether or not the device is associated to the user, in the last 30 days
+- Authentication methods and applications used
+- Risks associated with a user based on Microsoft Entra ID
+- General information like a user’s professional title and contact information, department, and their manager’s contact information
+
+The identity summary capability is available in the Microsoft Defender portal for customers who have provisioned access to Copilot for Security. Users who access the Copilot for Security standalone portal can use this capability through the Microsoft Defender XDR plugin. Know more about [preinstalled plugins in Copilot for Security](/security-copilot/manage-plugins#preinstalled-plugins).
+
+This guide describes what the script analysis capability is and how it works, including how you can provide feedback on the results generated.
+
+## Summarize identity information
+
+You can access the identity summary capability in the following ways:
+
+- From an incident page, choose an identity on the incident graph and then (1) select **User details**. In the user details pane, (2) select **Summarize**. The results are displayed in the Copilot side panel.
+
+ :::image type="content" source="/defender/media/copilot-in-defender/identity-summary/identity-summary-incident-small.png" alt-text="Screenshot showing the Summarize option in the user details pane." lightbox="/defender/media/copilot-in-defender/identity-summary/identity-summary-incident.png":::
+
+- Alternatively, you can select **Go to user page** on the bottom of the user details pane to open the user page. Copilot automatically generates the identity summary and displays the side panel upon opening the user page.
+
+- You can also access the identity summary capability by choosing a user in the **Assets** tab of an incident. Select **Summarize** in the user details pane to generate the identity summary.
+
+ :::image type="content" source="/defender/media/copilot-in-defender/identity-summary/identity-summary-assets-small.png" alt-text="Screenshot showing the Assets tab and a user account highlighted." lightbox="/defender/media/copilot-in-defender/identity-summary/identity-summary-assets.png":::
+
+- In an alert page, select a user then select **Summarize** in the user details pane to generate the identity summary.
+
+- In the advanced hunting page, you can access the identity summary capability by selecting a user in the results table, then selecting the link to the user page. Copilot automatically generates the identity summary and displays the side panel upon opening the user page.
+
+- From the main menu, navigate to **Assets > Identities**. Select a username from the list, then select **View user page** to open the user page. Copilot automatically generates the identity summary and displays the side panel upon opening the user page.
+
+ :::image type="content" source="/defender/media/copilot-in-defender/identity-summary/identity-summary-viewuser-small.png" alt-text="Screenshot highlighting the view user page option in an username search within Identities." lightbox="/defender/media/copilot-in-defender/identity-summary/identity-summary-viewuser.png":::
+
+- Type a username in the Microsoft Defender portal’s **search box** then select the username from the search results. In the user details side panel, select **Summarize** to generate the identity summary.
+
+Review the identity summary results. You can copy the results to clipboard, regenerate the results, or open Security Copilot by selecting the More actions ellipsis (...) on top of the identity summary card. You can extend your investigation of identity using prompts and other plugins in the Copilot for Security portal.
+
+> [!TIP]
+> When investigating users in the Copilot for Security portal, Microsoft recommends including the word ***Defender*** in your prompts to ensure that the identity summary capability delivers the results. For example, you can use the prompt *Show the Defender summary of this user in the last {time frame}* to generate the identity summary of a user account within the time frame indicated. You can specify up to 120 days on the time frame, with the default being 30 days when you don’t indicate one.
+
+Microsoft highly encourages you to provide feedback to Copilot, as it’s crucial for a capability’s continuous improvement. To provide feedback, navigate to the bottom of the Copilot side panel and select the feedback icon .
+
+ :::image type="content" source="/defender/media/copilot-in-defender/identity-summary/feedback-textbox.png" alt-text="Screenshot that shows the Feedback text box where you can share your feedback.":::
+
+Fill in the dedicated text box to share your thoughts, experiences, and requests. Microsoft values your feedback and takes it seriously in our commitment to enhance Copilot’s performance and user experience.
+
+## See also
+
+- [Get started with Microsoft Copilot for Security](/security-copilot/get-started-security-copilot)
+- [Learn about other Copilot for Security embedded experiences](/security-copilot/experiences-security-copilot)
+
+[!INCLUDE [Microsoft Defender XDR rebranding](../includes/defender-m3d-techcommunity.md)]
\ No newline at end of file
diff --git a/defender-xdr/security-copilot-in-microsoft-365-defender.md b/defender-xdr/security-copilot-in-microsoft-365-defender.md
index 091b05c74a..ab1051062c 100644
--- a/defender-xdr/security-copilot-in-microsoft-365-defender.md
+++ b/defender-xdr/security-copilot-in-microsoft-365-defender.md
@@ -17,17 +17,18 @@ ms.topic: conceptual
search.appverid:
- MOE150
- MET150
-ms.date: 08/20/2024
+ms.date: 09/23/2024
+appliesto:
+- Microsoft Defender XDR
+- Microsoft Sentinel in the Microsoft Defender portal
---
# Microsoft Copilot in Microsoft Defender
[!INCLUDE [Microsoft Defender XDR rebranding](../includes/microsoft-defender.md)]
-**Applies to:**
-
-- Microsoft Defender XDR
-- Microsoft Sentinel in the Microsoft Defender portal
+> [!NOTE]
+> Microsoft Defender XDR provides a unified XDR experience for Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Defender for Office 365, Microsoft Defender for Cloud Apps, and Microsoft Defender for Vulnerability Management. Learn more about this pre- and post-breach defense suite in [What is Microsoft Defender XDR?](microsoft-365-defender.md)
[Microsoft Copilot for Security](/security-copilot/microsoft-security-copilot) brings together the power of AI and human expertise to help security teams respond to attacks faster and more effectively. Copilot for Security is embedded in the Microsoft Defender portal to enable security teams to efficiently summarize incidents, analyze scripts and codes, analyze files, summarize device information, use guided responses to resolve incidents, generate KQL queries, and create incident reports.
@@ -73,6 +74,12 @@ Copilot helps security teams quickly assess and understand suspicious files with
:::image type="content" source="/defender/media/copilot-in-defender/file-analysis/copilot-defender-file-analysis-hide-small.png" alt-text="Screenshot of the file analysis results in Copilot in Defender with the Hide details option highlighted." lightbox="/defender/media/copilot-in-defender/file-analysis/copilot-defender-file-analysis-hide.png":::
+### Investigate identities immediately
+
+Quickly assess a user’s risk by generating an [identity summary](security-copilot-defender-identity-summary.md) with Copilot. Identify when an identity is at risk or suspicious with contextualized information about a user’s role and role changes, sign in behaviors, devices signed in to, and relevant contact information.
+
+:::image type="content" source="/defender/media/copilot-in-defender/identity-summary/identity-incident-graph-small.png" alt-text="Screenshot showing the Summarize option in the user details pane." lightbox="/defender/media/copilot-in-defender/identity-summary/identity-incident-graph.png":::
+
### Write incident reports efficiently
Security operations teams usually write reports to record important information, including what response actions were taken and the corresponding results, the team members involved, and other information to aid future security decisions and learning. Oftentimes, documenting incidents can be time-consuming. For an incident report to be effective, it must contain an incident's summary along with the actions taken, including what actions were taken by whom and when. Copilot [generates an incident report](security-copilot-m365d-create-incident-report.md) by quickly consolidating these pieces of information.
@@ -108,9 +115,9 @@ Because of its continuing evolution, Copilot might miss some things. Reviewing a
All Copilot in Defender capabilities have an option for providing feedback. To provide feedback, perform the following steps:
1. Select the feedback icon  located at the bottom of any results card in the Copilot side panel.
-2. Select **Confirmed, it looks great** if the results are accurate based on your assessment. You can provide more information in the next dialog box.
-3. Select **Off-target, inaccurate** if any detail is incorrect or incomplete based on your assessment. You can provide more information about your assessment in the next dialog box and submit this assessment to Microsoft.
-4. You can also report the results if it contains questionable or ambiguous information by selecting **Potentially harmful, inappropriate**. Provide more information about the results in the next dialog box and select Submit.
+2. Select **Looks right** if you deem the results accurate. You can provide more information in the next dialog box.
+3. Select **Needs improvement** if you assessed the result as lacking or incomplete. You can provide more information about your assessment in the next dialog box and submit this assessment to Microsoft.
+4. You can also report the results if it contains questionable or ambiguous information by selecting **Inappropriate**. Provide more information about the results in the next dialog box and select Submit.
diff --git a/defender-xdr/whats-new-in-microsoft-defender-urbac.md b/defender-xdr/whats-new-in-microsoft-defender-urbac.md
index 666446b39f..ecd44ea302 100644
--- a/defender-xdr/whats-new-in-microsoft-defender-urbac.md
+++ b/defender-xdr/whats-new-in-microsoft-defender-urbac.md
@@ -3,8 +3,8 @@ title: What's new in Microsoft Defender XDR Unified role-based access control (R
description: See what features are available in the latest release of Microsoft Defender XDR Unified role-based access control (RBAC)
search.appverid: met150
ms.service: defender-xdr
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.localizationpriority: medium
manager: deniseb
audience: ITPro
diff --git a/defender-xdr/whats-new.md b/defender-xdr/whats-new.md
index 81a40db042..4a130507f9 100644
--- a/defender-xdr/whats-new.md
+++ b/defender-xdr/whats-new.md
@@ -6,7 +6,7 @@ ms.service: defender-xdr
ms.author: diannegali
author: diannegali
ms.localizationpriority: medium
-ms.date: 08/12/2024
+ms.date: 09/23/2024
manager: dansimp
audience: ITPro
ms.collection:
@@ -31,6 +31,7 @@ You can also get product updates and important notifications through the [messag
## September 2024
+- (GA) Copilot in Defender now includes the identity summary capability, providing instant insights into a user's risk level, sign in activity, and more. For more information, see [Summarize identity information with Copilot in Defender](security-copilot-defender-identity-summary.md).
- [Microsoft Defender Threat Intelligence](/defender/threat-intelligence/what-is-microsoft-defender-threat-intelligence-defender-ti) customers can now view the [latest featured threat intelligence articles](/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal#featured-threat-intelligence-articles-widget) in the Microsoft Defender portal home page. The **Intel explorer** page now also has an [article digest](/defender/threat-intelligence/learn-how-to-access-microsoft-defender-threat-intelligence-and-make-customizations-in-your-portal#article-digest) that notifies them of the number of new Defender TI articles that were published since they last accessed the Defender portal.
- [Microsoft Defender XDR Unified RBAC permissions](experts-on-demand.md#required-permissions-for-using-ask-defender-experts) are added to submit inquiries and view responses from [Microsoft Defender Experts](experts-on-demand.md). You can also [view responses](experts-on-demand.md#where-to-view-responses-from-defender-experts) to inquires submitted to Ask Defender Experts through your listed email addresses when submitting your inquiry or in the Defender portal by navigating to **Reports** > **Defender Experts messages**.
- (GA) **Advanced hunting context panes** are now available in more experiences. This allows you to access the advanced hunting feature without leaving your current workflow.
diff --git a/defender/media/copilot-in-defender/identity-summary/feedback-textbox.png b/defender/media/copilot-in-defender/identity-summary/feedback-textbox.png
new file mode 100644
index 0000000000..4f3cea78d7
Binary files /dev/null and b/defender/media/copilot-in-defender/identity-summary/feedback-textbox.png differ
diff --git a/defender/media/copilot-in-defender/identity-summary/identity-summary-assets-small.png b/defender/media/copilot-in-defender/identity-summary/identity-summary-assets-small.png
new file mode 100644
index 0000000000..98d83b289e
Binary files /dev/null and b/defender/media/copilot-in-defender/identity-summary/identity-summary-assets-small.png differ
diff --git a/defender/media/copilot-in-defender/identity-summary/identity-summary-assets.png b/defender/media/copilot-in-defender/identity-summary/identity-summary-assets.png
new file mode 100644
index 0000000000..b218765b95
Binary files /dev/null and b/defender/media/copilot-in-defender/identity-summary/identity-summary-assets.png differ
diff --git a/defender/media/copilot-in-defender/identity-summary/identity-summary-incident-small.png b/defender/media/copilot-in-defender/identity-summary/identity-summary-incident-small.png
new file mode 100644
index 0000000000..9f84a2d68d
Binary files /dev/null and b/defender/media/copilot-in-defender/identity-summary/identity-summary-incident-small.png differ
diff --git a/defender/media/copilot-in-defender/identity-summary/identity-summary-incident.png b/defender/media/copilot-in-defender/identity-summary/identity-summary-incident.png
new file mode 100644
index 0000000000..ed69787469
Binary files /dev/null and b/defender/media/copilot-in-defender/identity-summary/identity-summary-incident.png differ
diff --git a/defender/media/copilot-in-defender/identity-summary/identity-summary-viewuser-small.png b/defender/media/copilot-in-defender/identity-summary/identity-summary-viewuser-small.png
new file mode 100644
index 0000000000..a96fb05f96
Binary files /dev/null and b/defender/media/copilot-in-defender/identity-summary/identity-summary-viewuser-small.png differ
diff --git a/defender/media/copilot-in-defender/identity-summary/identity-summary-viewuser.png b/defender/media/copilot-in-defender/identity-summary/identity-summary-viewuser.png
new file mode 100644
index 0000000000..ab679f8916
Binary files /dev/null and b/defender/media/copilot-in-defender/identity-summary/identity-summary-viewuser.png differ
diff --git a/defender/threat-intelligence/security-copilot-and-defender-threat-intelligence.md b/defender/threat-intelligence/security-copilot-and-defender-threat-intelligence.md
index a335bd362c..58b46ba8d2 100644
--- a/defender/threat-intelligence/security-copilot-and-defender-threat-intelligence.md
+++ b/defender/threat-intelligence/security-copilot-and-defender-threat-intelligence.md
@@ -53,13 +53,16 @@ This article introduces you to Copilot and includes sample prompts that can help
- In the **Manage sources** pop-up window that appears, under **Plugins**, confirm that the **Microsoft Defender Threat Intelligence** toggle is turned on, then close the window.
-
- 
+ In the **Manage sources** pop-up window that appears, under **Plugins**, confirm that the **Microsoft Threat Intelligence** toggle is turned on, then close the window.
> [!NOTE]
> Some roles can turn the toggle on or off for plugins like Defender TI. For more information, read [Manage plugins in Microsoft Copilot for Security](/security-copilot/manage-plugins).
+
+
+
3. Enter your prompt in the prompt bar.
### Built-in system features
diff --git a/defender/threat-intelligence/using-copilot-threat-intelligence-defender-xdr.md b/defender/threat-intelligence/using-copilot-threat-intelligence-defender-xdr.md
index 56af7d2eb9..2cbaa08c37 100644
--- a/defender/threat-intelligence/using-copilot-threat-intelligence-defender-xdr.md
+++ b/defender/threat-intelligence/using-copilot-threat-intelligence-defender-xdr.md
@@ -26,7 +26,7 @@ ms.date: 04/01/2024
Microsoft Copilot in Defender applies the capabilities of [Microsoft Copilot for Security](/security-copilot/microsoft-security-copilot) to deliver Microsoft Defender Threat Intelligence (Defender TI) information about threat actors and tools, as well as contextual threat intelligence, directly into the Microsoft Defender portal. Based on threat analytics reports, intel profiles, and other available Defender TI content, you can use Copilot in Defender to summarize the latest threats affecting your organization, know which threats to prioritize based on your exposure level, or gain more knowledge about your organization's or the global threat landscape.
> [!NOTE]
-> Defender TI capabilities are also available in Copilot for Security standalone experience through the Microsoft Defender Threat Intelligence plugin. [Learn more about Defender TI integration with Copilot for Security](security-copilot-and-defender-threat-intelligence.md)
+> Defender TI capabilities are also available in Copilot for Security standalone experience through the Microsoft Threat Intelligence plugin. [Learn more about Defender TI integration with Copilot for Security](security-copilot-and-defender-threat-intelligence.md)
## Technical requirements
diff --git a/exposure-management/predefined-classification-rules-and-levels.md b/exposure-management/predefined-classification-rules-and-levels.md
index 7c76f526c2..24e93d8d70 100644
--- a/exposure-management/predefined-classification-rules-and-levels.md
+++ b/exposure-management/predefined-classification-rules-and-levels.md
@@ -40,6 +40,7 @@ Current asset types are:
| Network Admin Device | Device | Medium | Critical devices used to configure, manage, and monitor the network assets within the organization are vital for network administration and are at high risk of cyber threats. They require top-level security to prevent unauthorized access. |
| VMware ESXi | Device | High | The VMware ESXi hypervisor is essential for running and managing virtual machines within your infrastructure. As a bare-metal hypervisor, it's providing the foundation for creating and managing virtual resources. |
| VMware vCenter | Device | High | The VMware vCenter Server is crucial for managing virtual environments. It provides centralized management of virtual machines and ESXi hosts. If it fails, it could disrupt the administration and control of your virtual infrastructure, including provisioning, migration, load balancing of virtual machines, and datacenter automation. However, as there are often redundant vCenter Servers and High Availability configurations, the immediate halt of all operations might not occur. Its failure could still cause significant inconvenience and potential performance issues |
+| Hyper-V Server | Device | High | The Hyper-V hypervisor is essential for running and managing virtual machines within your infrastructure, serving as the core platform for their creation and management. If the Hyper-V host fails, it can lead to the unavailability of hosted virtual machines, potentially causing downtime and disrupting business operations. Moreover, it can result in significant performance degradation and operational challenges. Ensuring the reliability and stability of Hyper-V hosts is therefore critical for maintaining seamless operations in a virtual environment. |
##### Identity
diff --git a/exposure-management/whats-new.md b/exposure-management/whats-new.md
index db2cac67fa..9040f3eb50 100644
--- a/exposure-management/whats-new.md
+++ b/exposure-management/whats-new.md
@@ -27,6 +27,14 @@ Security Exposure Management is currently in public preview.
## September 2024
+### New predefined classifications
+
+The following predefined classification rule was added to the critical assets list:
+
+| Classification | Description |
+| ------------------------------------------------------------ | ------------------------------------------------------------ |
+| **Hyper-V Server** | This rule applies to devices identified as Hyper-V servers within a domain. These servers are essential for running and managing virtual machines within your infrastructure, serving as the core platform for their creation and management. |
+
### Enhanced visibility for scoped users
This change now allows users who have been granted access to only some of the organization's devices to see the list of affected assets in metrics, recommendations, events, and initiative history within their specific scope.
diff --git a/includes/mde-automated-setup-guide.md b/includes/mde-automated-setup-guide.md
index 5553d647a8..d2116a5256 100644
--- a/includes/mde-automated-setup-guide.md
+++ b/includes/mde-automated-setup-guide.md
@@ -4,8 +4,8 @@ description: Learn about the Defender for Endpoint automated setup guide.
ms.reviewer:
ms.date: 05/28/2024
manager: deniseb
-ms.author: siosulli
-author: siosulli
+ms.author: deniseb
+author: denisebmsft
ms.service: microsoft-365-security
ms.subservice: mdo
search.appverid: met150