Skip to content
ATO Pathways
  Log In

Microsoft Defender Antivirus Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to not allow override of behavior monitoring.

    &lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration of behavior monitoring. This setting can only be set by...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • SRG-APP-000276

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to check in real time with MAPS before content is run or accessed.

    &lt;VulnDiscussion&gt;This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certa...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to join Microsoft MAPS.

    &lt;VulnDiscussion&gt;This policy setting allows joining Microsoft MAPS. Microsoft MAPS is the online community that helps in choosing how to respo...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to only send safe samples for MAPS telemetry.

    &lt;VulnDiscussion&gt;This policy setting configures behavior of samples submission when opt-in for MAPS telemetry is set. Possible options are: ...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured for protocol recognition for network protection.

    &lt;VulnDiscussion&gt;This policy setting allows the configuration of protocol recognition for network protection against exploits of known vulnera...
    Rule Medium Severity
    Show

  • SRG-APP-000112

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to not allow local override of monitoring for file and program activity.

    &lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration of monitoring for file and program activity on your com...
    Rule Medium Severity
    Show

  • SRG-APP-000112

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV Group Policy settings must take priority over the local preference settings.

    &lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration to turn on real-time protection. This setting can only ...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must monitor for incoming and outgoing files.

    &lt;VulnDiscussion&gt;This policy setting allows the configuration of monitoring for incoming and outgoing files without having to turn off monitor...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to monitor for file and program activity.

    &lt;VulnDiscussion&gt;This policy setting allows configuration of monitoring for file and program activity. If this setting is enabled or not confi...
    Rule Medium Severity
    Show

  • SRG-APP-000209

    <GroupDescription></GroupDescription>
    Group
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules