mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-28 13:17:23 +00:00
update to machines list from view
This commit is contained in:
parent
b5d7af8a9f
commit
0a24c5ea4f
@ -55,7 +55,7 @@ This tile shows you a list of machines with the highest number of active alerts.
|
||||
|
||||
Click the name of the machine to see details about that machine. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](investigate-machines-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
You can also click **Machines view** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](investigate-machines-windows-defender-advanced-threat-protection.md).
|
||||
You can also click **Machines list** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](investigate-machines-windows-defender-advanced-threat-protection.md).
|
||||
|
||||
## Users at risk
|
||||
The tile shows you a list of user accounts with the most active alerts. The total number of alerts for each user is shown in a circle next to the user account, and then further categorized by severity levels at the far end of the tile (hover over each severity bar to see its label).
|
||||
|
@ -25,7 +25,7 @@ localizationpriority: high
|
||||
|
||||
You can review event IDs in the [Event Viewer](https://msdn.microsoft.com/library/aa745633(v=bts.10).aspx) on individual endpoints.
|
||||
|
||||
For example, if endpoints are not appearing in the **Machines view** list, you might need to look for event IDs on the endpoints. You can then use this table to determine further troubleshooting steps.
|
||||
For example, if endpoints are not appearing in the **Machines list** list, you might need to look for event IDs on the endpoints. You can then use this table to determine further troubleshooting steps.
|
||||
|
||||
> [!NOTE]
|
||||
> It can take several days for endpoints to begin reporting to the Windows Defender ATP service.
|
||||
|
@ -11,7 +11,7 @@ author: mjcaparas
|
||||
localizationpriority: high
|
||||
---
|
||||
|
||||
# View and organize the Windows Defender ATP Machines view
|
||||
# View and organize the Windows Defender ATP Machines list
|
||||
|
||||
**Applies to:**
|
||||
|
||||
@ -21,19 +21,19 @@ localizationpriority: high
|
||||
- Windows 10 Pro Education
|
||||
- Windows Defender Advanced Threat Protection (Windows Defender ATP)
|
||||
|
||||
The **Machines view** shows a list of the machines in your network, the domain of each machine, when it last reported and the local IP Address it reported on, its **Health state**, the number of active alerts on each machine categorized by alert severity level, and the number of active malware detections. This view allows viewing machines ranked by risk or sensor health state, and keeping track of all machines that are reporting sensor data in your network.
|
||||
The **Machines list** shows a list of the machines in your network, the domain of each machine, when it last reported and the local IP Address it reported on, its **Health state**, the number of active alerts on each machine categorized by alert severity level, and the number of active malware detections. This view allows viewing machines ranked by risk or sensor health state, and keeping track of all machines that are reporting sensor data in your network.
|
||||
|
||||
Use the Machines view in these main scenarios:
|
||||
|
||||
- **During onboarding**</br>
|
||||
During the onboarding process, the **Machines view** is gradually populated with endpoints as they begin to report sensor data. Use this view to track your onboarded endpoints as they come online. Sort and filter by time of last report, **Active malware category**, or **Sensor health state**, or download the complete endpoint list as a CSV file for offline analysis.
|
||||
During the onboarding process, the **Machines list** is gradually populated with endpoints as they begin to report sensor data. Use this view to track your onboarded endpoints as they come online. Sort and filter by time of last report, **Active malware category**, or **Sensor health state**, or download the complete endpoint list as a CSV file for offline analysis.
|
||||
- **Day-to-day work**
|
||||
The **Machines view** enables easy identification of machines most at risk in a glance. High-risk machines have the greatest number and highest-severity alerts; **Sensor health state** provides another dimension to rank machines. Sorting machines by **Active alerts**, and then by **Sensor health state** helps identify the most vulnerable machines and take action on them.
|
||||
The **Machines list** enables easy identification of machines most at risk in a glance. High-risk machines have the greatest number and highest-severity alerts; **Sensor health state** provides another dimension to rank machines. Sorting machines by **Active alerts**, and then by **Sensor health state** helps identify the most vulnerable machines and take action on them.
|
||||
|
||||
## Sort, filter, and download the list of machines from the Machines view
|
||||
You can sort the **Machines view** by clicking on any column header to sort the view in ascending or descending order.
|
||||
You can sort the **Machines list** by clicking on any column header to sort the view in ascending or descending order.
|
||||
|
||||
Filter the **Machines view** by time period, **Active malware categories**, or **Sensor health state** to focus on certain sets of machines, according to the desired criteria.
|
||||
Filter the **Machines list** by time period, **Active malware categories**, or **Sensor health state** to focus on certain sets of machines, according to the desired criteria.
|
||||
|
||||
You can also download the entire list in CSV format using the **Export to CSV** feature.
|
||||
|
||||
@ -71,7 +71,7 @@ You can download a full list of all the machines in your organization, in CSV f
|
||||
Exporting the list in CSV format displays the data in an unfiltered manner. The CSV file will include all machines in the organization, regardless of any filtering applied in the view itself.
|
||||
|
||||
## Sort the Machines view
|
||||
You can sort the **Machines view** by the following columns:
|
||||
You can sort the **Machines list** by the following columns:
|
||||
|
||||
- **Machine name** - Name or GUID of the machine
|
||||
- **Last seen** - Date and time when the machine last reported sensor data
|
||||
|
@ -40,7 +40,7 @@ This machine isolation feature disconnects the compromised machine from the netw
|
||||
|
||||
- **Dashboard** - Select the machine name from the Top machines with active alerts section.
|
||||
- **Alerts queue** - Select the machine name beside the machine icon from the alerts queue.
|
||||
- **Machines view** - Select the machine name from the list of machines.
|
||||
- **Machines list** - Select the machine name from the list of machines.
|
||||
- **Search box** - Select Machine from the drop-down menu and enter the machine name.
|
||||
|
||||
2. Open the **Actions** menu and select **Isolate machine**.
|
||||
@ -102,7 +102,7 @@ CollectionSummaryReport.xls | This file is a summary of the investigation packag
|
||||
|
||||
- **Dashboard** - Select the machine name from the Top machines with active alerts section.
|
||||
- **Alerts queue** - Select the machine name beside the machine icon from the alerts queue.
|
||||
- **Machines view** - Select the heading of the machine name from the machines view.
|
||||
- **Machines list** - Select the heading of the machine name from the machines view.
|
||||
- **Search box** - Select Machine from the drop-down menu and enter the machine name.
|
||||
|
||||
2. Open the **Actions** menu and select **Collect investigation package**.
|
||||
|
@ -45,7 +45,7 @@ Deployment with the above-mentioned versions of System Center Configuration Mana
|
||||
|
||||
If the deployment fails, you can check the output of the script on the endpoints. For more information, see [Troubleshoot onboarding when deploying with a script on the endpoint](#troubleshoot-onboarding-when-deploying-with-a-script-on-the-endpoint).
|
||||
|
||||
If the onboarding completed successfully but the endpoints are not showing up in the **Machines view** after an hour, see [Troubleshoot onboarding issues on the endpoint](#troubleshoot-onboarding-issues-on-the-endpoint) for additional errors that might occur.
|
||||
If the onboarding completed successfully but the endpoints are not showing up in the **Machines list** after an hour, see [Troubleshoot onboarding issues on the endpoint](#troubleshoot-onboarding-issues-on-the-endpoint) for additional errors that might occur.
|
||||
|
||||
## Troubleshoot onboarding when deploying with a script on the endpoint
|
||||
|
||||
|
@ -45,7 +45,7 @@ Topic | Description
|
||||
[Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) | Examine possible communication between your machines and external Internet protocol (IP) addresses.
|
||||
[Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) | Investigate a domain to see if machines and servers in your enterprise network have been communicating with a known malicious domain.
|
||||
[View and organize the Machines view](machines-view-overview-windows-defender-advanced-threat-protection.md)| You can sort, filter, and exporting the machine list.
|
||||
[Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) | The **Machines view** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats.
|
||||
[Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) | The **Machines list** shows a list of the machines in your network, the corresponding number of active alerts for each machine categorized by alert severity levels, as well as the number of threats.
|
||||
[Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md)| Investigate user accounts with the most active alerts.
|
||||
[Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) | The **Manage Alert** menu on every alert lets you change an alert's status, resolve it, suppress it, or contribute comments about the alert.
|
||||
[Take response actions](response-actions-windows-defender-advanced-threat-protection.md)| Take action on a machine or file to quickly respond to detected attacks.
|
||||
|
Loading…
x
Reference in New Issue
Block a user