What does Intrusion Prevention setting in Antivirus policy do?

Question

In Microsoft Endpoint Manager admin center - Endpoint Security - Antivirus policy under Real-time Protection there's an option to enable Intrusion Prevention: ![81255-intrusion-prevention.png][1] [1]: /api/attachments/81255-intrusion-prevention.png?platform=QnA The Learn More link takes you to Network Protection, https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-enablenetworkprotection Is that the same thing? If not, is there a list of intrusion prevention signatures and/or can you customize it somehow? Thanks

Answer 1

@Joachim Lassus Thanks for posting in our Q&A.

For this issue, they are not the same thing. It seems that “Learn More” of Intune Portal is an incorrect link. Intrusion Prevention is corresponding to the CSP:Defender/AllowIntrusionPreventionSystem. We can read the following article as a reference.
https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#defender-allowintrusionpreventionsystem

For the incorrect link, I will try my best to feedback.

Thank you for your careful discovery of this problem.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

@Lu Dai-MSFT , thank you for you quick answer.