This guide will show an administrator how to block access to specified external IPs for MDE enrolled devices.
Role Requirements
Procedure Scope: Administrators
Required Group Membership: Admin.Security
Handbook Reference
Package: Device Security
Domain: Endpoint Indicator Management
Modifies: Unsanctioned IP Addresses
Defender for Endpoint IP Address IOC Block
- Navigate to the IP Addresses – Microsoft Defender portal, select Add Item.
- In the IP Address input box, specify an IP address. Click Next.
- For the response action, select Block Execution. If an alert should be generated when executed, check Generate Alert and fill in the Alert Title and Alert Severity. At the bottom of the page, fill in the Description with the intent of giving future context if the rule is to be reviewed at a later date. Click Next.
- Click Save on the next page after reviewing the IOC. Actions should take effect in less than 4 hours.
Need Assistance?
Reach out to your Customer Success Manager to discuss how a Sittadel cybersecurity analyst can assist in managing these tasks for you. New to our services? Inquire about arranging a consultation to explore optimizing your Azure environment for painless management.