Microsoft Defender for Endpoint (MDE), Widespread Actions

Beneath is a collage of widespread antivirus actions one would need to carry out on a consumer.

Home windows

1. Get Safety Standing: Get-MpComputerStatus.
   • This command retrieves the present standing of the pc’s safety, offering insights into the security measures which can be enabled and their operational standing. It contains info on real-time safety, antivirus model, and final scan time.
2. Get Historical past of Incidents: Get-MpThreat.
   • This command pulls up a historical past of threats which have been detected and dealt with by Microsoft Defender. It helps in auditing and understanding previous incidents on the machine.
3. Run full Scan: start-mpscan -ScanType FullScan.
   • Initiates a full system scan, which totally checks all information and applications on the system for any malicious exercise.
4. Get Historical past of Safety: Get-MpThreatDetection.
   • Notice. The distinction between the above two instructions is, that whereas Get-MpThreat pulls up the menace historical past, the Get-MpThreatDetection command pulls up the safety historical past.
5. Get Scan Configuration Particulars: Get-MpPreference
   • Shows the present configuration settings for Microsoft Defender, together with scheduled scans, exclusion paths, and actions taken on detections.
6. Disable Realtime Safety: Set-MpPreference -DisableRealtimeMonitoring $true
   • Disables real-time safety, Ought to be used with warning because it leaves the system weak.
7. Allow Realtime Safety: Set-MpPreference -DisableRealtimeMonitoring $false
   • Permits real-time safety to make sure ongoing safety monitoring.
8. Pressure Replace Definitions: Replace-MpSignature
   • Manually triggers an replace of the antivirus definitions, guaranteeing the most recent menace intelligence is used.
9. Efficiency Troubleshooting: https://be taught.microsoft.com/en-us/microsoft-365/safety/defender-endpoint/tune-performance-defender-antivirus?view=o365-worldwide
   • This information supplies detailed steps and issues for optimizing Microsoft Defender’s efficiency in your system.

Linux

1. Get Safety Standing: mdatp well being
   • Retrieves the present well being standing of the Microsoft Defender for Endpoint service, together with its operational state and final replace time.
2. Get Historical past of Incidents: mdatp menace record
   • Lists all threats detected on the system, offering an summary of previous safety incidents.
3. Run full Scan: mdatp scan full
   • ​​​​​​​Initiates a complete scan of all the system to detect and mitigate threats.
4. Connectivity Check: mdatp connectivity check
   • ​​​​​​​Checks the connectivity of the Microsoft Defender service to its cloud parts, guaranteeing that updates and menace intelligence are being obtained.
5. Superior Matters and efficiency diag: https://be taught.microsoft.com/en-us/microsoft-365/safety/defender-endpoint/comprehensive-guidance-on-linux-deployment?view=o365-worldwide
   • This information covers superior deployment subjects and efficiency tuning for Microsoft Defender on Linux.
6. Pressure Replace Definitions: mdatp definitions replace
   • ​​​​​​​Forces an replace of the antivirus definitions to make sure the most recent safety is utilized.
7. Create False Optimistic incident: wget “https://safe.eicar.org/eicar.com.txt”
   • ​​​​​​​Downloads a textual content file that’s universally acknowledged as a innocent virus by antivirus merchandise. This can be utilized to confirm the right functioning of the antivirus software program.

View Safety Alerts

• Log into the Azure Portal.
• Within the prime search field, kind defender for the cloud.
• Choose Defender for Cloud.
  
• On the left, choose Safety Alerts.
  ​​​​​​​

Associated Documentation