THOR with Microsoft Defender ATP Integration Guide

Contents:

• 1. Requirements
  • 1.1. Supported Operating Systems
  • 1.2. Enable „Live Response“ Feature
  • 1.3. Hardware Requirements
  • 1.4. Network Connections
• 2. Retrieve and Configure THOR Seed
  • 2.1. Download THOR Seed using Voucher Trials
  • 2.2. Download THOR Seed in Customer Portal
  • 2.3. Configure THOR Seed (Optional)
• 3. Start a THOR Scan
  • 3.1. Start a Live Response Session
  • 3.2. Upload THOR Seed
  • 3.3. Run THOR Seed
  • 3.4. Interrupted THOR Seed Sessions
  • 3.5. Retrieve the Results
  • 3.6. Cleanup
• 4. FAQs
  • 4.1. Why does my scan suddenly terminate?
  • 4.2. Why can’t I see a progress indicator?
  • 4.3. I cannot start a new THOR scan due to old log files?
  • 4.4. I can’t start a scan and get the error “THOR already running”, why?
  • 4.5. Does each scan use up one of my licenses?
  • 4.6. Can I use my own IOCs and YARA signatures with THOR Seed?
• 5. Links and References

Indices and tables

• Search Page