Skip to content
ATO Pathways
  Log In

III - Administrative Sensitive

Rules and Groups employed by this XCCDF Profile

  • SRG-APP-000279

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to automatically take action on all detected tasks.

    &lt;VulnDiscussion&gt;This policy setting allows Microsoft Defender configuration to automatically take action on all detected threats. The action ...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to run and scan for malware and other potentially unwanted software.

    &lt;VulnDiscussion&gt;This policy setting turns off Microsoft Defender Antivirus. If this policy setting is enabled, Microsoft Defender Antivirus d...
    Rule High Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to not exclude files for scanning.

    &lt;VulnDiscussion&gt;This policy setting allows disabling of scheduled and real-time scanning for files under the paths specified or for the fully...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to not exclude files opened by specified processes.

    &lt;VulnDiscussion&gt;This policy setting allows the disabling of scheduled and real-time scanning for any file opened by any of the specified proc...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to enable the Automatic Exclusions feature.

    &lt;VulnDiscussion&gt;This setting allows an administrator to specify if Automatic Exclusions feature for Server SKUs should be turned off.&lt;/Vul...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to disable local setting override for reporting to Microsoft MAPS.

    &lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to check in real time with MAPS before content is run or accessed.

    &lt;VulnDiscussion&gt;This feature ensures the device checks in real time with the Microsoft Active Protection Service (MAPS) before allowing certa...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to join Microsoft MAPS.

    &lt;VulnDiscussion&gt;This policy setting allows joining Microsoft MAPS. Microsoft MAPS is the online community that helps in choosing how to respo...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to only send safe samples for MAPS telemetry.

    &lt;VulnDiscussion&gt;This policy setting configures behavior of samples submission when opt-in for MAPS telemetry is set. Possible options are: ...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured for protocol recognition for network protection.

    &lt;VulnDiscussion&gt;This policy setting allows the configuration of protocol recognition for network protection against exploits of known vulnera...
    Rule Medium Severity
    Show

  • SRG-APP-000112

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to not allow local override of monitoring for file and program activity.

    &lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration of monitoring for file and program activity on your com...
    Rule Medium Severity
    Show

  • SRG-APP-000112

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to not allow override of monitoring for incoming and outgoing file activity.

    &lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration of monitoring for incoming and outgoing file activity. ...
    Rule Medium Severity
    Show

  • SRG-APP-000209

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to not allow override of scanning for downloaded files and attachments.

    &lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration of scanning for all downloaded files and attachments. T...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to not allow override of behavior monitoring.

    &lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration of behavior monitoring. This setting can only be set by...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV Group Policy settings must take priority over the local preference settings.

    &lt;VulnDiscussion&gt;This policy setting configures a local override for the configuration to turn on real-time protection. This setting can only ...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must monitor for incoming and outgoing files.

    &lt;VulnDiscussion&gt;This policy setting allows the configuration of monitoring for incoming and outgoing files without having to turn off monitor...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to monitor for file and program activity.

    &lt;VulnDiscussion&gt;This policy setting allows configuration of monitoring for file and program activity. If this setting is enabled or not confi...
    Rule Medium Severity
    Show

  • SRG-APP-000209

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to scan all downloaded files and attachments.

    &lt;VulnDiscussion&gt;This policy setting allows configuration of scanning for all downloaded files and attachments. If this setting is enabled or ...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to always enable real-time protection.

    &lt;VulnDiscussion&gt;This policy setting turns off real-time protection prompts for known malware detection. Microsoft Defender Antivirus alerts ...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to enable behavior monitoring.

    &lt;VulnDiscussion&gt;This policy setting allows configuration of behavior monitoring. If this setting is enabled or not configured, behavior monit...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to process scanning when real-time protection is enabled.

    &lt;VulnDiscussion&gt;This policy setting allows the configuration of process scanning when real-time protection is turned on. This helps to catch ...
    Rule Medium Severity
    Show

  • SRG-APP-000278

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to scan archive files.

    &lt;VulnDiscussion&gt;This policy setting allows the configuration of scans for malicious software and unwanted software in archive files such as ....
    Rule Medium Severity
    Show

  • SRG-APP-000073

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to scan removable drives.

    &lt;VulnDiscussion&gt;This policy setting allows the management of whether or not to scan for malicious software and unwanted software in the conte...
    Rule Medium Severity
    Show

  • SRG-APP-000277

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to perform a weekly scheduled scan.

    &lt;VulnDiscussion&gt;This policy setting allows specifying the day of the week on which to perform a scheduled scan. The scan can also be configur...
    Rule Medium Severity
    Show

  • SRG-APP-000210

    <GroupDescription></GroupDescription>
    Group
    Show

  • Microsoft Defender AV must be configured to turn on e-mail scanning.

    &lt;VulnDiscussion&gt;This policy setting allows the configuration of e-mail scanning. When e-mail scanning is enabled, the engine will parse the m...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules