Brings SmartScreen protection to every process on a device, so Defender for Endpoint can stop outbound connections to IP or URL indicators and to domains with a poor reputation. It is part of attack surface reduction and acts once the TCP handshake has finished.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Network protection in context, with comparison tables and the common traps.
Terms in this definition
- Stop sequence
One of up to four strings that make the model halt generation; the sequence itself is not included in the output.
- URL
The web address of a resource, on which URL-based routing relies.
- Attack surface reduction
Protections in Defender for Endpoint that close off behaviour attackers like to abuse. Chief among them are ASR rules, which on Windows can stop Office programs spawning child processes or obfuscated scripts from running.
- TCP
A transport protocol that is connection-oriented.
Related terms
- Custom network indicators
Switch this Defender for Endpoint advanced setting on first, otherwise URL, domain and IP address indicators can't permit or block connections; network protection is what actually enforces them.
- DDoS IP Protection
One of the paid tiers of Azure DDoS Protection, charged for each individual public IP it covers. Mitigation works the same way as in the Network Protection tier; what's missing is rapid response support, the cost protection benefit and reduced WAF pricing.