Network protection layers and controls

Let’s dive into network protection (NP), another feature under the MDE umbrella, specifically within the ASR space. Before we get into it all the wonderful things it can do, let’s talk a little bit about its history and where it started out!

NP was not Windows Defender’s original attempt at this type of protection—that was the network resource inspection/network inspection system (NRI/NIS). This was a very powerful feature that allowed our researchers to leverage custom protocol parsers and signatures; the issue was that it was a bit unreliable and seemingly overcomplicated.

Cold snack

Some of these parsers failed routinely, each failure sending a Microsoft Active Protection Service (MAPS) report. At one point, a particular failure was the cause of nearly 40% of all MAPS traffic. Let’s just say, that was expensive.

Around the arrival of Windows 10 version 1709, or RS3, the NP team and the Microsoft...