mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-07-02 18:53:41 +00:00
Update defender-endpoint-false-positives-negatives.md
This commit is contained in:
@ -31,7 +31,9 @@ ms.custom: FPFN
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806)
|
||||
|
||||
In endpoint protection, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. If you’re using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection), and you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives. These steps include:
|
||||
In endpoint protection, a false positive is an entity, such as a file or a process, that was detected and identified as malicious, even though the entity isn't actually a threat. A false negative is an entity that was not detected as a threat, even though it actually is malicious. False positives/negatives can occur with any threat protection solution.
|
||||
|
||||
If you’re using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/microsoft-defender-advanced-threat-protection), and you're seeing false positives/negatives in your [Microsoft Defender Security Center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/use), your security operations can take steps to address false positives or false negatives. These steps include:
|
||||
|
||||
1. [Reviewing and classifying alerts](#part-1-review-and-classify-alerts)
|
||||
2. [Reviewing remediation actions that were taken](#part-2-review-remediation-actions)
|
||||
@ -40,8 +42,8 @@ In endpoint protection, a false positive is an entity, such as a file or a proce
|
||||
5. [Reviewing and adjusting your threat protection settings](#part-5-review-and-adjust-your-threat-protection-settings)
|
||||
6. [Getting help if you still have issues with false positives/negatives](#still-need-help)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> This article is intended for security operators and administrators.
|
||||
> [!NOTE]
|
||||
> This article is intended as guidance for security operators and security administrators who are using [Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md).
|
||||
|
||||
## Part 1: Review and classify alerts
|
||||
|
||||
|
Reference in New Issue
Block a user