From 01785b6ba18a4fcc422bba4c5f66ea15f8f7ffc5 Mon Sep 17 00:00:00 2001 From: Dolcita Montemayor Date: Wed, 29 Aug 2018 01:28:50 +0000 Subject: [PATCH] Updated investigate-incidents-windows-defender-advanced-threat-protection.md --- ...-incidents-windows-defender-advanced-threat-protection.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md index 0ba5358b49..a1b7428d8e 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md @@ -41,9 +41,8 @@ Select **Investigations** to see all the automatic investigations launched by th ![Image of investigations tab in incident details page](images/atp-incident-investigations-tab.png) ## Going through the evidence -It helps your organization to see a summary and the status of the evidence collated through the incident. - -Your team lead, for example, can take a quick look at the Evidence page to know how many has been analyzed or remediated so far, out of all the evidence collated. +Windows Defender Advanced Threat Protection automatically investigates all the incidents' supported events and suspicious entities in the alerts, providing you with auto-response and information about the important files, processes, services, and more. This helps quickly detect and block potential threats in the incident. +Each of the analyzed entities will be marked as infected, remediated, or suspicious. ![Image of evidence tab in incident details page](images/atp-incident-evidence-tab.png)