Microsoft Defender for Endpoint (MDE), Frequent Actions

Abstract

The aim of this text is to present fast entry to directions for typical administrative actions associated to antivirus software program.

Required Microsoft Defender for Cloud Plan 1 or Plan 2 Deployment to the suitable Digital Machine subscription.

System particulars: Home windows, Linux, and Azure Digital Machines. Not AKS Clusters, not digital machine scale units.

Home windows

• Get safety standing: Get-MpComputerStatus
• Get historical past of incidents: Get-MpThreat
• Run full scan: start-mpscan -ScanType FullScan
• Get historical past of safety: Get-MpThreatDetection
  Be aware. The distinction between the above two instructions is, whereas Get-MpThreat pulls up the menace historical past, the Get-MpThreatDetection command pulls up the safety historical past.
• Get scan configuration particulars: Get-MpPreference
• Disable realtime safety: Set-MpPreference -DisableRealtimeMonitoring $true
• Allow realtime safety: Set-MpPreference -DisableRealtimeMonitoring $false
• Drive replace definitions: Replace-MpSignature
• Efficiency troubleshooting: https://study.microsoft.com/en-us/microsoft-365/safety/defender-endpoint/tune-performance-defender-antivirus?view=o365-worldwide

Linux

View safety alerts

1. Log into the Azure Portal.
2. Within the high search field, sort defender for the cloud.
3. Choose Defender for Cloud
   
4. On the left, choose Safety Alerts.