deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-21 17:57:22 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Last few edits

Browse Source
This commit is contained in:
schmurky 2021-02-15 14:48:10 +08:00
parent eb4116eada
commit 4a631f83ae
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
windows/security/threat-protection/microsoft-defender-atp/techniques-device-timeline.md
View File

@ -1,5 +1,5 @@
---
title: Device timeline techniques
title: Techniques in the device timeline
description: Understanding the device timeline in Microsoft Defender for Endpoint
keywords: device timeline, endpoint, MITRE, MITRE ATT&CK, techniques, tactics
search.product: eADQiWindows 10XVcnh
@ -25,7 +25,7 @@ ms.technology: mde
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
You can gather more insight about a device by selecting any device from the [Devices list](machines-view-overview.md). This brings you to the individual device's page. On the device page, you can select the **Timeline** tab to view all the events related to it.
You can gather more insight about events that occurred in a device by selecting any device from the [Devices list](machines-view-overview.md). This brings you to the individual device's page. On the device page, you can select the **Timeline** tab to view all the events on the device.
## Understand techniques in the timeline
@ -46,11 +46,11 @@ Search and Export options are also available for Techniques.
## Investigate using the side pane
Selecting a Technique opens the side pane and shows additional information and insights like related ATT&CK techniques, tactics, and descriptions.
Select a Technique to open its corresponding side pane. Here you can see additional information and insights like related ATT&CK techniques, tactics, and descriptions.
Selecting the specific *Attack technique* opens the related ATT&CK technique page where you can find more information about it.
Select the specific *Attack technique* to open the related ATT&CK technique page where you can find more information about it.
You can also select event entities to copy them using the blue icon on the right. For instance, to copy a related file's SHA1, select the blue page icon.
You can copy an entity's details when you see a blue icon on the right. For instance, to copy a related file's SHA1, select the blue page icon.
![Copy entity details](images/techniques-side-pane-clickable.png)
@ -61,7 +61,7 @@ You can do the same for command lines.
## Investigate related events
To use [advanced hunting](advanced-hunting-overview.md) to find events related to the selected Technique, you can select **Hunt for related events**. This leads to the advanced hunting page with a query to find events related to the Technique.
Use [advanced hunting](advanced-hunting-overview.md) to find events related to the selected Technique by selecting **Hunt for related events**. This leads to the advanced hunting page with a query to find events related to the Technique.
![Hunt for related events](images/techniques-hunt-for-related-events.png)
@ -71,7 +71,9 @@ To use [advanced hunting](advanced-hunting-overview.md) to find events related t
## Customize your device timeline
On the upper right-hand side of the device timeline, you can choose a date range to limit the number of events and techniques in the timeline. You can also customize which columns to expose, and filter for flagged events by data type or by event group.
On the upper right-hand side of the device timeline, you can choose a date range to limit the number of events and techniques in the timeline.
You can customize which columns to expose. You can also filter for flagged events by data type or by event group.
### Choose columns to expose
You can choose which columns to expose in the timeline by selecting the **Choose columns** button.
@ -82,7 +84,7 @@ From there you can select which information set to include.
### Filter to view techniques or events only
To view only either events or techniques, select Filters from the device timeline and choose your preferred Data type to view.
To view only either events or techniques, select **Filters** from the device timeline and choose your preferred Data type to view.
![Filters screenshot](images/device-timeline-filters.png)