Please enable JavaScript.

Coggle requires JavaScript to display documents.

Indicators/Exclusions that are identified by SOC/SIRT as part of…

- - - - If the Category is Allowed
        
        We can proceed for adding the indicators in Destination List --> Global Block List along with the ticket number
      - If the category is already blocked
        
        No Action Required
- - - - If Microsoft has coverage for the Indicator
        
        No Action required
      - If Microsoft doesn't have converge for that Indicator
        
        Add the indicator to the MDATP Console
        
        Actions that can be performed while adding Indicators
        
        Block and remediate - the IoC will not be allowed to run, and a remediation action will be applied to the IoC.
        
        Allow – The IoC will be allowed to run on your devices.
        
        Audit – An alert will be triggered when the IoC runs.
        
        Warn – The IoC will prompt a warning that the user can bypass.
        
        Block execution - The IoC will not be allowed to run.
  - - - Identify what kind of exclusions that can be applied for this use case
        
        MDATP - IOC
        Settings -> Endpoints -> Indicators
        
        File Hash / Domain / URL's / IP Address / Certificate
        
        Allow
        
        MDATP - Folder Exclusions
        Settings -> Endpoints -> Automated Folder Exclusions
        
        Here folder Path / Filename and File extensions can be applied
        
        This will apply to all hosts and no group can be specified
        
        Managed by Intune/SCCM
        
        Intune
        
        1. Defender Processes to exclude
        
        2. File extensions to exclude from scans and real-time protection
        
        3. Defender Files And Folders To Exclude
        
        SCCM
        
        File Path based Exclusions
- - - - If CrowdStrike has coverage for the Indicator
        
        No Action Required
      - If CrowdStrike doesn't have converge for that Indicator
        
        Add the indicator to the CrowdStrike Console
        
        Actions that can be performed while adding Indicators
        
        Block - Add the indicator to your blocklist and show it as a detection.
        
        Block, hide detection - Block and detect the indicator, but hide it from Activity > Detections. Discover this activity by searching for the indicator value in Investigate.
        
        Detect only - Show the indicator as a detection and take no other action.
        
        Allow - Add the indicator to your allow list and do not detect it.
        
        No Action - Save the indicator for future use but take no action.
  - - - Identify what kind of exclusions that can be applied for this use case
        
        Machine Learning Exclusion (ML)
        
        Typical AV Detection
        
        Hash/File Path - Can be applied either to Group /All hosts based on use case
        
        Indicators of Attack Exclusion (IOA)
        
        Behavioral Detection
        
        Invocation Structure (File Path and Command Line) - Regex - Can be applied either to Group /All hosts based on use case
        
        Sensor Visibility Exclusion
        
        This is to ignore complete visibility of a specified file path to CS Cloud
        
        File Paths - Can be applied either to Group /All hosts based on use case