攻擊面管理 (ASM)
While traditional antivirus software focuses on blocking known and file-based threats on endpoints, such as desktops, laptops, and servers, etc. by relying on pre-defined signatures, Endpoint Detection and Response (EDR) solution extends this capability by applying behavioural analysis to continuously monitor activities, detect suspicious behaviour, identify both known and advanced attacks (e.g. ransomware, fileless malware, and zero-day exploits), investigate incidents, and support threat response. It provides visibility and faster response capability which helps to reduce the impact of attacks.
Available to
Departments
Service Charge and Application
Free; no application required
Service Availability
24 x 7
Support
Email: edr-support@cuhk.edu.hk
What is Microsoft Defender for Endpoint (MDE)?
It is an Endpoint Detection and Response (EDR) solution which is used to protect managed endpoints – including servers, desktop PCs and laptop – against known and unknown malicious attacks.
Unlike traditional anti-virus software which only provide which only provides signature-based detection, EDR solution provides border prevention, continuous monitoring, behavioural detection, investigation and faster response.
Briefing Notes (For LAN Administrator only):
- Heads-up on the EDR Deployment
- Technical Sharing on MDE Deployment and Management [coming soon]
- General User Guide
- Technical User Guide: (for MDE Administrators)
-
- About Prerequisites
- Hardware Prerequisities:
- Network Prerequisites:
- Outgoing Traffic Prerequisites:
- Microsoft Defender for Endpoint streamlined connectivity URLs – commercial
- Azure IP Ranges (Select “MicrosoftDefenderForEndpoint” from the drop-down field)
- About Prerequisites
-
- About Deployment
- Create Tag Option (Device Tags):
- Microsoft Defender Antivirus issues:
- About Deployment
- About Remediation
- Live Response Command List:
© 2026 香港中文大學 版權所有