search

microsoft / mdatp-devicecontrol

Microsoft Defender for Endpoint Device Control tools, samples, and resources.
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/device-control-removable-storage-protection?view=o365-worldwide
MIT License
43 stars 36 forks source link

Add DC on macOS schema support for and, or, and not #11

Closed bryan-lipinski closed 1 year ago

bryan-lipinski commented 1 year ago

Update the device_control_policy_schema.json to include support for a negation operator, as well as aliases to existing operators that better match boolean logic.

Query Type description notes
and A device will be included in the group if all clauses and subqueries match Alias for the existing 'all' operator
or A device will be included in the group if any of the clauses or subqueries match Alias for the existing 'any' operator
not A device will be included in the group if it is not matched by the subquery New