Enabling Network protection & Smartscreen in Defender for endpoint

In my previous post on How to enable and configure Web Content Filtering within Microsoft Defender for Endpoint, I touched upon some of the requirements that were needed for enabling Web Content filtering. One such requirement was enabling of Network Protection & Smart screen within Defender for endpoint.

Let' start with Network Protection and understand what it is all about.

Network protection is an attack surface reduction capability which helps in protecting devices from Internet-based events arising from accessing dangerous domains through applications, phishing scams, exploits, and other malicious content. With the help of Microsoft Defender SmartScreen, all outbound HTTP(s) traffic that attempt to connect to low-reputation sources (based on the domain or hostname) gets blocked.

Network protection also extends the protection to the operating system as a whole. It provides web protection functionality in Edge, other supported browsers and non-browser applications. Additionally, network protection can use custom indicators to provide visibility and blocking of indicators of compromise (IOCs) when used with Endpoint detection and response.

So how does Network Protection uses Microsoft Defender SmartScreen to protect from Internet-based events?

Microsoft Defender SmartScreen determines whether a site is potentially malicious by:

- Analyzing visited webpages looking for indications of suspicious behavior. If Microsoft Defender SmartScreen determines that a page is suspicious, it will show a warning page to advise caution.

- Checking the visited sites against a dynamic list of reported phishing sites and malicious software sites. If it finds a match, Microsoft Defender SmartScreen shows a warning to let the user know that the site might be malicious.

Microsoft Defender SmartScreen determines whether a downloaded app or app installer is potentially malicious by:

- Checking downloaded files against a list of reported malicious software sites and programs known to be unsafe. If it finds a match, Microsoft Defender SmartScreen shows a warning to let the user know that the site might be malicious.

- Checking downloaded files against a list of files that are well known and downloaded by many Windows users. If the file isn't on that list, Microsoft Defender SmartScreen shows a warning, advising caution.

Note: SmartScreen protects against malicious files from the internet. It does not protect against malicious files on internal locations or network shares, such as shared folders with UNC paths or SMB/CIFS shares.

Now that we have established what these features can do, lets look at the steps of enabling and configuring them.

Firstly, in order to use Network Protection, we need to enable Microsoft Defender Antivirus Realtime Protection and Cloud delivered protection.

a. Head over to Microsoft Endpoint Management Admin Center.

b. Navigate to Endpoint Security->Antivirus->Create Policy.

c. Select Windows 10 & later as platform.

d. Select Microsoft Defender Antivirus as Profile.

e. Give a name.

f. Provide the following values. Note: You do have the option to enable Network protection under Defender AV settings, however, to keep things in context for this blog post, I will configure it along with SmartScreen settings, all in one place.

Also, there are many other settings within Defender AV that you can configure, which you should consider. But again, keeping in line with the requirements of this blog post, I am only focusing on the relevant settings for now.

Next up is to enable & configure Network Protection and SmartScreen.

a. On Microsoft Endpoint Management Admin Center, navigate to Endpoint Security->Attack surface reduction>Create Policy.

c. Select Windows 10 & later as platform.

d. Select Web protection (Microsoft Edge Legacy) as Profile.

e. Give a name.

f. Provide the following values.

Note: It is advisable to configure Enable network protection in Audit mode first for analyzing Windows events to understand the potential impact of configuring the setting in enable mode.

Also, even though Microsoft Defender SmartScreen supports legacy IE, it is advisable to disable IE altogether. IE is outdated in every way and does not fit in the modern browsing experience. If you do have a requirement to use the legacy browser IE because of  compatibility issues involving older sites then considering using IE enterprise site list mode that I blogged about sometime ago.

With that said, if you are in a position to disable IE then you can easily do so by using the CSP DisableInternetExplorerApp.

Time for some testing

You can head over to https://demo.wd.microsoft.com and test various scenarios. I have captured some below -

You can also use Advanced hunting to pull data on network protection events.

Conclusion

Microsoft have given a great platform to strengthen the security for organizations. While there are a lot of moving parts involved in configuring Defender AV, Defender for endpoint, when configured correctly, one can get a lot of value of it. Until next time..