MT.1165 - Network Protection should be enabled.
Overview
Checks that Network Protection is enabled in block or audit mode in the assigned Microsoft Defender Antivirus policies.
Disabled network protection allows web-based threats and malicious IP connections, exposing endpoints to phishing sites and command-and-control traffic.
Remediation action:
- Open Microsoft Endpoint Manager > Endpoint Security > Antivirus
- Edit the relevant Microsoft Defender Antivirus policy
- Set Network Protection to Enabled or Audit mode
If your antivirus settings are split across several policies, this setting only needs to be set in one of them, as long as that policy is assigned to every device that needs it. No other assigned policy should set a different value: Intune does not merge this setting, so a device that receives both values may end up with either one, or none.
Related links
- Policy merge and conflicts for Antivirus policy settings
- Configure Microsoft Defender Antivirus
- Microsoft Endpoint Manager
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1165 |
| Severity | High |
| Suite | Maester |
| Product | Defender |
| Related products | Intune |
| Feature | Endpoint antivirus |
| Area | Devices and endpoints |
| Resource type | Policy |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1204.001 Malicious Link, T1189 Drive-by Compromise, T1071 Application Layer Protocol |
| Supports controls | nist-800-53-r5:SI-3 |
| PowerShell test | Test-MtMdeNetworkProtection |
| Services | Graph |
Source
- Test:
tests/maester/defender/Test.MT.1165.ps1 - Documentation:
tests/maester/defender/Test.MT.1165.md