diff --git a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md index c32e8e1b64..03a4c23c48 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/configure-microsoft-threat-experts.md @@ -68,39 +68,14 @@ You can partner with Microsoft Threat Experts who can be engaged directly from w >[!NOTE] >Alert inquiries related to your organization's customized threat intelligence data are currently not supported. Consult your security operations or incident response team for details. -1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or machine is in view before you send an inquiry. +1. Navigate to the portal page with the relevant information that you'd like to investigate, for example, the **Incident** page. Ensure that the page for the relevant alert or machine is in view before you send an investigation request. 2. From the upper right-hand menu, click **?**. Then, select **Consult a threat expert**. -3. Asking a threat expert is a two-step process: provide the necessary information and open a support ticket. - - **Step 1: Provide information** - a. Provide enough information to give the Microsoft Threat Experts enough context to start the investigation. Select the inquiry category from the **Provide information > Inquiry** details drop-down menu.
- - b. Enter the additional details to give the threat experts more context of what you’d like to investigate. Click **Next**, and it takes you to the **Open support ticket** tab.
- - c. Remember to use the ID number from the **Open a support ticket** tab page and include it to the details you will provide in the subsequent Customer Services and Support (CSS) pages.
+3. In the **Investigation topic** field, provide the link to the relevant page for your investigation request. For example, a link to the incident, alert, or machine details page that you would like to investigate. +4. In the next field, provide enough information to give the Microsoft Threat Experts enough context to start the investigation. +5. Enter the email address that you'd like to use to correspond with Microsoft Threat Experts. + - **Step 2: Open a support ticket** - >[!NOTE] - >To experience the full Microsoft Threat Experts preview capability in Microsoft Defender ATP, you need a Premier customer service and support account. However, you will not be charged for the Experts-on-demand service during the preview. - - a. In the **New support request** customer support page, select the following from the dropdown menu and then click **Next**:
- - **Select the product family**: **Security**
- **Select a product**: **Microsoft Threat Experts**
- **Select a category that best describes the issue**: **Microsoft Defender ATP**
- **Select a problem that best describes the issue**: Choose according to your inquiry category
- - b. Fill out the fields with the necessary information about the issue and use the auto-generated ID when you open a Customer Services and Support (CSS) ticket. Then, click **Next**.
- - c. In the **Select a support plan** page, select **Professional No Charge**.
- - d. The severity of your issue has been pre-selected by default, per the support plan, **Professional No Charge**, that you'll use for this public preview. Select the time zone by which you'd like to receive the correspondence. Then, click **Next**.
- - e. Verify your contact details and add another if necessary. Then, click **Next**.
- - f. Review the summary of your support request, and update if necessary. Make sure that you read and understand the **Microsoft Services Agreement** and **Privacy Statement**. Then, click **Submit**. A confirmation page indicating the response time and your support request number shows.
- -## Sample questions to ask Microsoft Threat Experts +## Sample investigation topics that you can consult with Microsoft Threat Experts **Alert information** - We see a new type of alert for a living-off-the-land binary: [AlertID]. Can you tell us something more about this alert and how we can investigate further?