Wesley van TilburgandClaude Opus 5.5
86039eeb9d
Defender's defaults left behavior monitoring off and every setting unmanaged. Ship /etc/opt/microsoft/mdatp/managed/mdatp_managed.json: real-time protection, behavior monitoring, PUA blocking, cloud-delivered protection at the high block level, automatic definition updates and sample submission, and scheduled scans (daily quick at 12:00, weekly full on Wednesday 12:30, low priority). Users can't change managed settings. The build fails if the file isn't valid JSON. Network protection (Insiders channels only) and tamper protection (audit-only preview on Linux) are left out. The compliance script and rules now also check behavior monitoring and cloud-delivered protection. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
30 lines
934 B
JSON
30 lines
934 B
JSON
{
|
|
"antivirusEngine": {
|
|
"enforcementLevel": "real_time",
|
|
"behaviorMonitoring": "enabled",
|
|
"scanAfterDefinitionUpdate": true,
|
|
"scanArchives": true,
|
|
"disallowedThreatActions": ["allow", "restore"],
|
|
"threatTypeSettingsMergePolicy": "admin_only",
|
|
"threatTypeSettings": [
|
|
{ "key": "potentially_unwanted_application", "value": "block" },
|
|
{ "key": "archive_bomb", "value": "audit" }
|
|
],
|
|
"scheduledScan": "enabled"
|
|
},
|
|
"scheduledScan": {
|
|
"dailyConfiguration": { "timeOfDay": 720 },
|
|
"weeklyConfiguration": { "dayOfWeek": 4, "scanType": "full", "timeOfDay": 750 },
|
|
"lowPriorityScheduledScan": true,
|
|
"checkForDefinitionsUpdate": true,
|
|
"randomizeScanStartTime": 2
|
|
},
|
|
"cloudService": {
|
|
"enabled": true,
|
|
"diagnosticLevel": "required",
|
|
"automaticSampleSubmissionConsent": "safe",
|
|
"automaticDefinitionUpdateEnabled": true,
|
|
"cloudBlockLevel": "high"
|
|
}
|
|
}
|