Hi all,
Struggling with opening least-privilege outbound permit rules for on-premise systems running (or to-be running) MS Defender for Endpoints (MDE). Most ports are 80 or 443, so client systems generally don't have any issue; internal servers are a different matter.
MS provides the endpoints to which MDE-enabled systems need to connect here: Configure device proxy and Internet connection settings | Microsoft Docs (URL current as of writing, filename mde-urls.xlsx). However, there are many wildcarded entries, eg
*.wd.microsoft.com
*.oms.opinsights.azure.com
...in logs, I see test MDE boxes connecting to sub-sub-domains, eg europe.cp.wd.microsoft.com, and I'm not sure Domain objects, (non-FQDN) would work efficiently (or at all?) with sub-sub-domains, nor that reverse look-ups will always work.
I'd (obviously) prefer to use built-in Updateable Objects, but the only apparently appropriate EU one is "Azure Advanced Threat Protection Public Services" - which the description states is derived from https://download.microsoft.com/download/7/1/D/71D86715-5596-4529-9B13-DA13A5DE5B63/ServiceTags_Publi... - (>80k line JSON...)
After a while of successful testing, I note drops from test boxes, despite the Allow to "Azure Advanced Threat Protection Public Services" - I suspect that there are IPs in the MDE requirements that are not in the Azure list; it may be considered a completely different service (Defender docs are a mess, generally, and the interaction with Azure is obscure).
Questions
- Is there a command I can use to dump the current contents (ie the specific IPs/ranges) in an Updateable Object?
- Is there (or will there be) an UO specific for Defender for Endpoints which will maintain/support the requirements in the first URL above?
Thanks if you got this far.
Cheers,
auto
