From 67332d947f6a223c7fb9835b45e615ca499c3955 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Mon, 30 Nov 2020 19:18:18 -0800 Subject: [PATCH 1/4] Update respond-file-alerts.md added note from support --- .../microsoft-defender-atp/respond-file-alerts.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md index 336099ffa7..c8cdc8bc87 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md @@ -133,6 +133,9 @@ You can roll back and remove a file from quarantine if you’ve determined that > > Defender for Endpoint will restore all custom blocked files that were quarantined on this device in the last 30 days. +> [!NOTE] +> A file that was quarantined as a potential network threat might not be recoverable. If a user attempts to restore the file after quarantine, that file might not be accessible. This can be due to the system no longer having network credentials to access the file. Typically this is a result of a temporary log on to a system or shared folder and the access tokens expired. + ## Add indicator to block or allow a file You can prevent further propagation of an attack in your organization by banning potentially malicious files or suspected malware. If you know a potentially malicious portable executable (PE) file, you can block it. This operation will prevent it from being read, written, or executed on devices in your organization. From fa07eceda1abc5e6f84e659011c8a672a355ca15 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Mon, 30 Nov 2020 19:19:45 -0800 Subject: [PATCH 2/4] Update respond-file-alerts.md --- .../microsoft-defender-atp/respond-file-alerts.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md index c8cdc8bc87..1a1ea25594 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md @@ -133,8 +133,8 @@ You can roll back and remove a file from quarantine if you’ve determined that > > Defender for Endpoint will restore all custom blocked files that were quarantined on this device in the last 30 days. -> [!NOTE] -> A file that was quarantined as a potential network threat might not be recoverable. If a user attempts to restore the file after quarantine, that file might not be accessible. This can be due to the system no longer having network credentials to access the file. Typically this is a result of a temporary log on to a system or shared folder and the access tokens expired. +> [!Important] +> A file that was quarantined as a potential network threat might not be recoverable. If a user attempts to restore the file after quarantine, that file might not be accessible. This can be due to the system no longer having network credentials to access the file. Typically, this is a result of a temporary log on to a system or shared folder and the access tokens expired. ## Add indicator to block or allow a file From aa86dbe1d305de4d19c877da6898d3ff1f8349d1 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 3 Dec 2020 16:42:57 -0800 Subject: [PATCH 3/4] Applied `> [!NOTE]` --- .../microsoft-defender-atp/respond-file-alerts.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md index c5b3147430..d2047a3c28 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md @@ -1,6 +1,6 @@ --- title: Take response actions on a file in Microsoft Defender ATP -description: Take response actions on file related alerts by stopping and quarantining a file or blocking a file and checking activity details. +description: Take response actions on file-related alerts by stopping and quarantining a file or blocking a file and checking activity details. keywords: respond, stop and quarantine, block file, deep analysis search.product: eADQiWindows 10XVcnh search.appverid: met150 @@ -217,6 +217,7 @@ Results of deep analysis are matched against threat intelligence and any matches Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available within the **Deep analysis** tab, on the file's profile page. +
>[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4aAYy?rel=0] **Submit for deep analysis** is enabled when the file is available in the Defender for Endpoint backend sample collection, or if it was observed on a Windows 10 device that supports submitting to deep analysis. @@ -243,7 +244,8 @@ When the sample is collected, Defender for Endpoint runs the file in is a secure ![You can only submit PE files in the file details section](images/submit-file.png) ->**Note**  Only PE files are supported, including _.exe_ and _.dll_ files + > [!NOTE] + > Only PE files are supported, including _.exe_ and _.dll_ files. A progress bar is displayed and provides information on the different stages of the analysis. You can then view the report when the analysis is done. From 0787b3e1bea54754c3fb4ee9beeff7ec24ef5613 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Thu, 3 Dec 2020 16:50:45 -0800 Subject: [PATCH 4/4] Relocated
--- .../microsoft-defender-atp/respond-file-alerts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md index d2047a3c28..354a099a61 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md @@ -216,8 +216,8 @@ The Deep analysis summary includes a list of observed *behaviors*, some of which Results of deep analysis are matched against threat intelligence and any matches will generate appropriate alerts. Use the deep analysis feature to investigate the details of any file, usually during an investigation of an alert or for any other reason where you suspect malicious behavior. This feature is available within the **Deep analysis** tab, on the file's profile page. -
+ >[!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4aAYy?rel=0] **Submit for deep analysis** is enabled when the file is available in the Defender for Endpoint backend sample collection, or if it was observed on a Windows 10 device that supports submitting to deep analysis.