ATPHandler: Unexpected ConfigurationType, error when trying to onboard to Defender ATP using MECM
I am trying to onboard machines using the Microsoft Defender ATP Policies deployment. I specified the onboarding file which I downloaded from Defender ATP, and I also specified the workspace ID an workspace key. I defined both the file and key because I am targeting both up level and down level clients in my collection. In the ATPHandler.log file I see the following error messages: ATPHandler: Unexpected ConfigurationType, ATPHandler 16-12-2020 20:55:35 3552 (0x0DE0) ATPHandler: Failure in CATPHandler::HandleUIPolicy: 0x80070057 ATPHandler 16-12-2020 20:55:35 3552 (0x0DE0) This is on a down level client (Windows Server 2012 R2). I followed the recommended steps from this manual: https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/defender-advanced-threat-protection?redirectedfrom=MSDN Edit: on a 2016 machine I get the same error message. The site version is: 5.00.9012.1000 The client version is: 5.00.9012.1052 So far I tried to recreate the entire policy, I even did a fresh download of the onboarding file. What can I do to further troubleshoot this? There is not much information to be found about this error message. I found one forum post here, but that does not provide a solution for me.
Defender detected powershell_ise.exe as 'Trojan:PowerShell/Mountsi.A!ml'
One of our users is experiencing a problem when it comes to creating scripts in the powershell ISE, when they are autosaved to appdata, it blocks them on his machine and does not create an alert/incident in the defender ATP portal. However one has managed to appear in the portal (see screenshot). We only recently implemented Defender ATP so im not 100% sure how to interpret the alert, and since this behaviour isnt happening on anyone elses machine I dont know if white listing powershell_ise.exe is a good idea (i assume not), or if theres a better explanation for it? The current defender ATP settings are the stock standard for GPO as stated in the deployment guide. Appreciate any help with this!
Export Microsoft Defender event data to a log analytics workspace
In the Defender ATP portal (securitycenter.windows.com) it is possible to create custom detections, but the smallest time frame is 1 hour. Even though 1 hour is better than the mean time to detection of a breach reported via Ponemon, Verizon, etc. I'm trying to cut that down even further by piecing together different Azure cloud services i.e. Event Hubs, Blob Storage, Search Services, Log Analytics, etc. Is there a way to leverage the raw streaming API and perform searching with a log analytics workspace? This would speed up detection to within 5 minutes of an event occurring rather than 1 hour
Defender ATP GUI on servers
Hello, Have Defender ATP on all machines via Intune MEM and servers onboarded via Azure Security Center (Microsoft Monitoring Agent) Couldn't figure out how to do a full scan on servers, I found https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-on-windows-server-2016 not sure if this can work in parallel with Defender ATP as the GUI shows free AV.
Endpoint security settings (EDR, ASR etc.) applied to computer without group membership
Hello, we have an Azure AD group with a dynamic group membership. The filter were modified and because of this all except one computer were removed from the group. After that the group was linked to endpoint security policies. Now we can see two computer, which were in the group and are now no longer member of the group, getting configuration settings for Defender ATP. Does anyone know this problem?
