Creating custom Network Indicator rules in Defender for Endpoint

Picking up from my last post that covers details on enabling & creating Web Content Filtering rule in Defender for Endpoint, I will now cover the process for creating custom network indicator rules that can be used to supersede the Web Content Filtering categories.

What are Indicators anyway?

Defender for Endpoint can block malicious IPs/URLs through Windows Defender SmartScreen for Microsoft browsers, and through Network Protection for non-Microsoft browsers or calls made outside of a browser based on Microsoft's own threat intelligence data.

By creating indicators for IPs and URLs or domains, you can now allow or block IPs, URLs, or domains based on your organization's own threat intelligence.

What are the pre-requisites for Indicators?

Before one can go about setting up the rules, following pre-requisites must be met.

1. Network Protection to be enabled in block mode.

2. The Antimalware client version must be 4.18.1906.x or later.

3. Supported on machines on Windows 10, version 1709 or later.

4. Ensure that Custom network indicators is enabled in Microsoft 365 Defender.

First and foremost, lets see how to enable Network indicators in Microsoft 365 Defender Portal.

1. Navigate to Microsoft 365 Defender Portal > Settings > Endpoints > Advanced features > Custom network indicators.

2. Toggle the setting between On and Off and select Save preferences.

Creating custom network indicator rules

To create rules, follow the process below -

1. Navigate to Microsoft 365 Defender Portal > Settings > Endpoints > Indicators (under Rules)

2. Select the IP addresses or URLs/Domains tab.

3. Select Add item.

4. Specify the following details:

Indicator - Specify the entity details and define the expiration of the indicator.

Action - Specify the action to be taken and provide a description.

Scope - Define the scope of the machine group.

5. Review the details in the Summary tab, then click Save.

If you are dealing with multiple entries like I am, then you have the option to import a csv as well.

1. Navigate to Microsoft 365 Defender Portal > Settings > Endpoints > Indicators (under Rules)

2. Under IP or URLs/Domain tab select Import.

3. A new side window will open where you can import your csv. If you need to create the format for the csv file then Microsoft provides a sample csv file that you can use as a template. Note that the values have to be added in the csv in the exact format or the import will fail.

4. After a successful import, the rules will auto-populate.

End user experience

When a user tries to access any of the URLs added in the allowed\blocked list in Indicators, Windows Defender SmartScreen will block the URL on the Microsoft browsers. For non-Microsoft browsers, Network Protection will swing in.

Amazon.co.uk from allowed rules list went through, but a URL from the blocked rules list was blocked.

You can also head over to Reports in Defender 365 Portal and access the Web Protection Card to see the rules in action.

Conclusion

While Web Content Filtering categories are a great way to restrict access to Web content which are based on Microsoft's threat intelligence data, with the option of Indicators, organizations can now add their own rules to allow or block URLs\IPs based on their own intelligence data. This level of flexibility creates a perfect blend and allows organizations to introduce controls around accessing of malicious URLs and IPs.

References

Web content filtering | Microsoft Docs

Web protection | Microsoft Docs