Merge remote-tracking branch 'refs/remotes/origin/master' into live

2025-05-17 07:47:22 +00:00 · 2017-06-06 10:00:26 -07:00 · 2017-06-06 10:00:26 -07:00 · 1f10359a48
commit 1f10359a48
parent 8435bb78c3 826aeaa0ea
33 changed files with 274 additions and 59 deletions
--- a/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md
+++ b/windows/client-management/join-windows-10-mobile-to-azure-active-directory.md
@ -191,7 +191,7 @@ To see the Notebooks that your Azure AD account has access to, tap **More Notebo
 ## Use Windows Store for Business
-[Windows Store for Business](/microsoft-store/index) allows you to specify applications to be available to your users in the Windows Store application. These applications show up on a tab titled for your company. Applications approved in the Windows Store for Business portal can be installed by users.
+[Microsoft Store for Business](/microsoft-store/index) allows you to specify applications to be available to your users in the Windows Store application. These applications show up on a tab titled for your company. Applications approved in the Microsoft Store for Business portal can be installed by users.
 ![company tab on store](images/aadjwsfb.jpg)
--- a/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/api-portal-mapping-windows-defender-advanced-threat-protection.md
@ -25,52 +25,262 @@ Understand what data fields are exposed as part of the alerts API and how they m
 ##	Alert API fields and portal mapping
 The following table lists the available fields exposed in the alerts API payload. It shows examples for the populated values and a reference on how data is reflected on the portal.
 The ArcSight field column contains the default mapping between the Windows Defender ATP fields and the built-in fields in ArcSight. You can download the mapping file from the portal when you enable the SIEM integration feature and you can modify it to match the  needs of your organization. For more information, see [Enable SIEM integration in Windows Defender ATP](enable-siem-integration-windows-defender-advanced-threat-protection.md).
 Field numbers match the numbers in the images below.
-Portal label  | SIEM field name | Description
+<table style="table-layout:fixed;width:100%" >
-:---|:---|:---
+  <tr>
-1	| LinkToWDATP |	Link back to the alert page in Windows Defender ATP
+    <th class>Portal label</th>
-2	|	Alert ID	| Alert ID visible in the link: `https://securitycenter.windows.com/alert/<alert id>`
+    <th class>SIEM field name</th>
-3	| AlertTitle | Alert	title
+    <th class>ArcSight field</th>
-4	| Actor |	Actor name
+    <th class>Example value</th>
-5	| AlertTime |	Last time the alert was observed
+    <th class>Description</th>
-6 | Severity |	Alert severity
+    <th class></th>
-7	| Category |	Alert category
+  </tr>
-8 | Status in queue | Alert status in queue
+  <tr>
-9	| ComputerDnsName|	Computer DNS name and machine name
+    <td class>1</td>
-10| IoaDefinitionId	| (Internal only)  <br><br>  ID for the IOA (Indication of attack) that this alert belongs to. It usually correlates with the title. <br><br> **Note**: This is an internal ID of the rule which triggers the alert. It's provided here as it can be used for aggregations in the SIEM.
+    <td class>AlertTitle</td>
-11 | UserName	| The user context relevant to the activity on the machine which triggered the alert. NOTE: Not yet populated.
+    <td class>name</td>
-12 | FileName	| File name
+    <td class>A dll was unexpectedly loaded into a high integrity process without a UAC prompt</td>
-13 | FileHash	| Sha1 of file observed
+    <td class>Value available for every alert.</td>
-14 | FilePath	| File path
+    <td class></td>
-15 | IpAddress |	IP of the IOC (when relevant)
+  </tr>
-16 | URL	| URL of the IOC (when relevant)  
+  <tr>
-17 | FullId	| (Internal only)  <br><br> Unique ID for each combination of IOC and Alert ID. Provides the ability to apply dedup logic in the SIEM.
+    <td class>2</td>
-18 | AlertPart	| (Internal only)  <br><br> Alerts which contain multiple IOCs will be split into several messages, each message contains one IOC and a running counter. The counter provides the ability to reconstruct the alerts in the SIEM.
+    <td class>Severity</td>
-19 | LastProccesedTimeUtc | (Internal only)  <br><br>	Time the alert was last processed in Windows Defender ATP.
+    <td class>deviceSeverity</td>
-20 | Source| Alert detection source (Windows Defender AV, Windows Defender ATP, and Device Guard)
+    <td class>Medium</td>
-21 | ThreatCategory| Windows Defender AV threat category
+    <td class>Value available for every alert.</td>
-22 | ThreatFamily |	Windows Defender AV family name
+    <td class></td>
-23 | RemediationAction |	Windows Defender AV threat category	 |
+  </tr>
-24 | WasExecutingWhileDetected	| Indicates if a file was running while being detected.
+  <tr>
-25|	RemediationIsSuccess	| Indicates if an alert was successfully remediated.
+    <td class>3</td>
-26 | Sha1	| Sha1 of file observed	in alert timeline and in file side pane (when available)
+    <td class>Category</td>
-27 | Md5 | Md5 of file observed	(when available)
+    <td class>deviceEventCategory</td>
-28 | Sha256 |	Sha256 of file observed	(when available)
+    <td class>Privilege Escalation</td>
-29	|	ThreatName	| Windows Defender AV threat name
+    <td class>Value available for every alert.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>4</td>
    <td class>Source</td>
    <td class>sourceServiceName</td>
    <td class>WindowsDefenderATP</td>
    <td class>Windows Defender Antivirus or Windows Defender ATP. Value available for every alert.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>5</td>
    <td class>MachineName</td>
    <td class>sourceHostName</td>
    <td class>liz-bean</td>
    <td class>Value available for every alert.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>6</td>
    <td class>FileName</td>
    <td class>fileName</td>
    <td class>Robocopy.exe</td>
    <td class>Available for alerts associated with a file or process.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>7</td>
    <td class>FilePath</td>
    <td class>filePath</td>
    <td class>C:\Windows\System32\Robocopy.exe</td>
    <td class>Available for alerts associated with a file or process. \</td>
    <td class></td>
  </tr>
  <tr>
    <td class>8</td>
    <td class>UserDomain</td>
    <td class>sourceNtDomain</td>
    <td class>contoso</td>
    <td class>The domain of the user context running the activity, available for Windows Defender ATP behavioral based alerts.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>9</td>
    <td class>UserName</td>
    <td class>sourceUserName</td>
    <td class>liz-bean</td>
    <td class>The user context running the activity, available for Windows Defender ATP behavioral based alerts.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>10</td>
    <td class>Sha1</td>
    <td class>fileHash</td>
    <td class>5b4b3985339529be3151d331395f667e1d5b7f35</td>
    <td class>Available for alerts associated with a file or process.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>11</td>
    <td class>Md5</td>
    <td class>deviceCustomString5</td>
    <td class>55394b85cb5edddff551f6f3faa9d8eb</td>
    <td class>Available for Windows Defender AV alerts.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>12</td>
    <td class>Sha256</td>
    <td class>deviceCustomString6</td>
    <td class>9987474deb9f457ece2a9533a08ec173a0986fa3aa6ac355eeba5b622e4a43f5</td>
    <td class>Available for Windows Defender AV alerts.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>13</td>
    <td class>ThreatName</td>
    <td class>eviceCustomString1</td>
    <td class>Trojan:Win32/Skeeyah.A!bit</td>
    <td class>Available for Windows Defender AV alerts.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>14</td>
    <td class>IpAddress</td>
    <td class>sourceAddress</td>
    <td class>218.90.204.141</td>
    <td class>Available for alerts associated to network events. For example, 'Communication to a malicious network destination'.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>15</td>
    <td class>Url</td>
    <td class>requestUrl</td>
    <td class>down.esales360.cn</td>
    <td class>Availabe for alerts associated to network events. For example, 'Communication to a malicious network destination'.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>16</td>
    <td class>RemediationIsSuccess</td>
    <td class>deviceCustomNumber2</td>
    <td class>TRUE</td>
    <td class>Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>17</td>
    <td class>WasExecutingWhileDetected</td>
    <td class>deviceCustomNumber1</td>
    <td class>FALSE</td>
    <td class>Available for Windows Defender AV alerts. ArcSight value is 1 when TRUE and 0 when FALSE.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>18</td>
    <td class>AlertId</td>
    <td class>externalId</td>
    <td class>636210704265059241_673569822</td>
    <td class>Value available for every alert.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>19</td>
    <td class>LinkToWDATP</td>
    <td class>flexString1</td>
    <td class>`https://securitycenter.windows.com/alert/636210704265059241_673569822`</td>
    <td class>Value available for every alert.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>20</td>
    <td class>AlertTime</td>
    <td class>deviceReceiptTime</td>
    <td class>2017-05-07T01:56:59.3191352Z</td>
    <td class>The time the activity relevant to the alert occurred. Value available for every alert.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>21</td>
    <td class>MachineDomain</td>
    <td class>sourceDnsDomain</td>
    <td class>contoso.com</td>
    <td class>Domain name not relevant for AAD joined machines. Value available for every alert.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>22</td>
    <td class>Actor</td>
    <td class>deviceCustomString4</td>
    <td class></td>
    <td class>Available for alerts related to a known actor group.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>21+5</td>
    <td class>ComputerDnsName</td>
    <td class>No mapping</td>
    <td class>liz-bean.contoso.com</td>
    <td class>The machine fully qualified domain name. Value available for every alert.</td>
    <td class></td>
  </tr>
  <tr>
    <td class></td>
    <td class>LogOnUsers</td>
    <td class>sourceUserId</td>
    <td class>contoso\liz-bean; contoso\jay-hardee</td>
    <td class>The domain and user of the interactive logon user/s at the time of the event. Note: For machines on Windows 10 version 1607, the domain information will not be available.</td>
    <td class></td>
  </tr>
  <tr>
    <td class>Internal field</td>
    <td class>LastProcessedTimeUtc</td>
    <td class>No mapping</td>
    <td class>2017-05-07T01:56:58.9936648Z</td>
    <td class>Time when event arrived at the backend. This field can be used when setting the request parameter for the range of time that alerts are retrieved.</td>
    <td class></td>
  </tr>
  <tr>
    <td class></td>
    <td class>Not part of the schema</td>
    <td class>deviceVendor</td>
    <td class></td>
    <td class>Static value in the ArcSight mapping - 'Microsoft'.</td>
    <td class></td>
  </tr>
  <tr>
    <td class></td>
    <td class>Not part of the schema</td>
    <td class>deviceProduct</td>
    <td class></td>
    <td class>Static value in the ArcSight mapping - 'Windows Defender ATP'.</td>
    <td class></td>
  </tr>
  <tr>
    <td class></td>
    <td class>Not part of the schema</td>
    <td class>deviceVersion</td>
    <td class></td>
    <td class>Static value in the ArcSight mapping - '2.0', used to identify the mapping versions.</td>
    <td class></td>
  </tr>
 </table>
 >[!NOTE]
 > Fields #21-29 are related to Windows Defender Antivirus alerts.
-![Image of actor profile with numbers](images/atp-actor.png)
+![Image of alert with numbers](images/atp-alert-page.png)
-![Image of alert timeline with numbers](images/atp-alert-timeline-numbered.png)
+![Image of alert details pane with numbers](images/atp-siem-mapping13.png)
-![Image of new alerts with numbers](images/atp-alert-source.png)
+![Image of alert timeline with numbers](images/atp-siem-mapping3.png)
-![Image of machine timeline with numbers](images/atp-remediated-alert.png)
+![Image of alert timeline with numbers](images/atp-siem-mapping4.png)
-![Image of file details](images/atp-file-details.png)
+![Image machine view](images/atp-mapping6.png)
 ![Image browser URL](images/atp-mapping5.png)
 ![Image actor alert](images/atp-mapping7.png)
 ## Related topics
--- a/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/configure-endpoints-sccm-windows-defender-advanced-threat-protection.md
@ -24,14 +24,14 @@ localizationpriority: high
 <span id="sccm1606"/>
 ## Configure endpoints using System Center Configuration Manager (current branch) version 1606
-System Center Configuration Manager (current branch) version 1606, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see [Support for Windows Defender Advanced Threat Protection service](https://go.microsoft.com/fwlink/p/?linkid=823682).
+System Center Configuration Manager (SCCM) (current branch) version 1606, has UI integrated support for configuring and managing Windows Defender ATP on endpoints. For more information, see [Support for Windows Defender Advanced Threat Protection service](https://go.microsoft.com/fwlink/p/?linkid=823682).
 >[!NOTE]
 > If you’re using SCCM client version 1606 with server version 1610 or above, you must upgrade the client version to match the server version.
 <span id="sccm1602"/>
 ## Configure endpoints using System Center Configuration Manager earlier versions
-You can use System Center Configuration Manager’s existing functionality to create a policy to configure your endpoints. This is supported in the following System Center Configuration Manager versions:
+You can use existing System Center Configuration Manager functionality to create a policy to configure your endpoints. This is supported in the following System Center Configuration Manager versions:
 - System Center 2012 Configuration Manager
 - System Center 2012 R2 Configuration Manager
--- a/windows/threat-protection/windows-defender-atp/images/1.png
+++ b/windows/threat-protection/windows-defender-atp/images/1.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-actor-alert.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-actor-alert.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-alert-details.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-alert-details.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-alert-mgt-pane.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-alert-mgt-pane.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-alert-page.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-alert-page.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-alert-process-tree.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-alert-process-tree.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-alert-timeline.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-alert-timeline.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG
+++ b/windows/threat-protection/windows-defender-atp/images/atp-alerts-related-to-machine.PNG
--- a/windows/threat-protection/windows-defender-atp/images/atp-detailed-actor.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-detailed-actor.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-incident-graph.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-incident-graph.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-machine-details-view.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-machine-details-view.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-details-panel.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-machine-timeline-export.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-machines-timeline.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-machines-timeline.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-mapping
+++ b/windows/threat-protection/windows-defender-atp/images/atp-mapping
--- a/windows/threat-protection/windows-defender-atp/images/atp-mapping1.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-mapping1.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-mapping2.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-mapping2.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-mapping3.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-mapping3.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-mapping4.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-mapping4.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-mapping5.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-mapping5.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-mapping6.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-mapping6.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-mapping7.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-mapping7.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping1.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping1.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping13.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping13.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping2.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping2.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping3.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping3.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping4.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-siem-mapping4.png
--- a/windows/threat-protection/windows-defender-atp/images/atp-user-details-pane.png
+++ b/windows/threat-protection/windows-defender-atp/images/atp-user-details-pane.png
--- a/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.md
@ -1,6 +1,6 @@
 ---
 title: Investigate Windows Defender Advanced Threat Protection alerts
-description: Use the investigation options to get details on which alerts are affecting your network, what they mean, and how to resolve them.
+description: Use the investigation options to get details on alerts are affecting your network, what they mean, and how to resolve them.
 keywords: investigate, investigation, machines, machine, endpoints, endpoint, alerts queue, dashboard, IP address, file, submit, submissions, deep analysis, timeline, search, domain, URL, IP
 search.product: eADQiWindows 10XVcnh
 ms.prod: w10
@ -15,30 +15,35 @@ localizationpriority: high
 **Applies to:**
 - Windows 10 Enterprise
 - Windows 10 Education
 - Windows 10 Pro
 - Windows 10 Pro Education
 - Windows Defender Advanced Threat Protection (Windows Defender ATP)
-You can click an alert in any of the [alert queues](alerts-queue-windows-defender-advanced-threat-protection.md) to begin an investigation. Selecting an alert brings up the **Alert management pane**, while clicking an alert brings you the alert details view where general information about the alert, some recommended actions, an alert process tree, an incident graph, and an alert timeline is shown.  
+Investigate alerts that are affecting your network, what they mean, and how to resolve them. Use the alert details view to see various tiles that provide information about alerts. You can also manage an alert and see alert metadata along with other information that can help you make better decisions on how to approach them.
 ![Image of the alert page](images/atp-alert-details.png)
 The alert context tile shows the where, who, and when context of the alert. As with other pages, you can click on the icon beside the name or user account to bring up the machine or user details pane. The alert details view also has a status tile that shows the status of the alert in the queue. You'll also see a description and a set of recommended actions which you can expand.
 For more information about managing alerts, see [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md).
 The alert details page also shows the alert process tree, an incident graph, and an alert timeline.
 You can click on the machine link from the alert view to navigate to the machine. The alert will be highlighted automatically, and the timeline will display the appearance of the alert and its evidence in the **Machine timeline**. If the alert appeared more than once on the machine, the latest occurrence will be displayed in the **Machine timeline**.
 Alerts attributed to an adversary or actor display a colored tile with the actor's name.
-![A detailed view of an alert when clicked](images/alert-details.png)
+![A detailed view of an alert when clicked](images/atp-actor-alert.png)
 Click on the actor's name to see the threat intelligence profile of the actor, including a brief overview of the actor, their interests or targets, their tools, tactics, and processes (TTPs) and areas where they've been observed worldwide. You will also see a set of recommended actions to take.
 Some actor profiles include a link to download a more comprehensive threat intelligence report.
-![Image of detailed actor profile](images/atp-actor-report.png)
+![Image of detailed actor profile](images/atp-detailed-actor.png)
 The detailed alert profile helps you understand who the attackers are, who they target, what techniques, tools, and procedures (TTPs) they use, which geolocations they are active in, and finally, what recommended actions you may take. In many cases, you can download a more detailed Threat Intelligence report about this attacker or campaign for offline reading.
 ## Alert process tree
-The **Alert process tree** takes alert triage and investigation to the next level, displaying the alert and related evidence and other events that occurred within the same execution context and time. This rich triage context of the alert and surrounding events is available on the alert page.
+The **Alert process tree** takes alert triage and investigation to the next level, displaying the alert and related evidence, together with other events that occurred within the same execution context and time. This rich triage context of the alert and surrounding events is available on the alert page.
 ![Image of the alert process tree](images/atp-alert-process-tree.png)
@ -46,11 +51,15 @@ The **Alert process tree** expands to display the execution path of the alert, i
 The alert and related events or evidence have circles with thunderbolt icons inside them.
 >[!NOTE]
 >The alert process tree might not be available in some alerts.
-Clicking in the circle immediately to the left of the indicator displays the **Alert details** pane where you can take a deeper look at the details about the alert. It displays rich information about the selected process, file, IP address, and other details taken from the entity's page –  while remaining on the alert page, so you never leave the current context of your investigation.  
+Clicking in the circle immediately to the left of the indicator displays its details.
 ![Image of the alert details pane](images/atp-alert-mgt-pane.png)
 The alert details pane helps you take a deeper look at the details about the alert. It displays rich information about the execution details, file details, detections, observed worldwide, observed in organization, and other details taken from the entity's page –  while remaining on the alert page, so you never leave the current context of your investigation.  
 ## Incident graph
@ -58,9 +67,7 @@ The **Incident Graph**  provides a visual representation of the organizational f
 ![Image of the Incident graph](images/atp-incident-graph.png)
-The **Incident Graph**  previously supported expansion by File and Process, and now supports expansion by additional criteria: known processes and Destination IP Address.
+The **Incident Graph** supports expansion by File, Process, command line, or Destination IP Address, as appropriate.
 The Windows Defender ATP service keeps track of "known processes". Alerts related to known processes mostly include specific command lines, that combined are the basis for the alert. The **Incident Graph** supports expanding known processes with their command line to display other machines where the known process and the same command line were observed.
 The **Incident Graph** expansion by destination IP Address, shows the organizational footprint of communications with this IP Address without having to change context by navigating to the IP Address page.
--- a/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md
+++ b/windows/threat-protection/windows-defender-atp/investigate-machines-windows-defender-advanced-threat-protection.md
@ -15,10 +15,6 @@ localizationpriority: high
 **Applies to:**
 - Windows 10 Enterprise
 - Windows 10 Education
 - Windows 10 Pro
 - Windows 10 Pro Education
 - Windows Defender Advanced Threat Protection (Windows Defender ATP)
 ## Investigate machines
@ -55,7 +51,9 @@ You'll also see details such as logon types for each user account, the user grou
 For more information, see [Investigate user entities](investigate-user-windows-defender-advanced-threat-protection.md).
-The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. This list is a filtered version of the [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows the date when the alert's last activity was detected, a short description of the alert, the user account associated with the alert, the alert's severity, the alert's status in the queue, and who is addressing the alert.
+The **Alerts related to this machine** section provides a list of alerts that are associated with the machine. You can also manage alerts from this section by clicking the circle icons to the left of the alert (or using Ctrl or Shift + click to select multiple alerts).
 This list is a filtered version of the [Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md), and shows the date when the alert's last activity was detected, a short description of the alert, the user account associated with the alert, the alert's severity, the alert's status in the queue, and who is addressing the alert. You'll also see a list of displayed alerts and you'll be able to quickly know the total number of alerts on the machine.
 You can also choose to highlight an alert from the **Alerts related to this machine** or from the  **Machine timeline** section to see the correlation between the alert and its related events on the machine by right-clicking on the alert and selecting **Select and mark events**. This highlights the alert and its related events and helps distinguish them from other alerts and events appearing in the timeline. Highlighted events are displayed in all information levels whether you choose to view the timeline by **Detections**, **Behaviors**, or **Verbose**.