service health content

service-status-windows-defender-defender-advanced-threat-protection.md

@@ -0,0 +1,54 @@
+title: Check the Windows Defender ATP service status
+description: Check Windows Defender ATP service status, see if the service is experiencing issues and review previous issues that have been resolved.
+keywords: dashboard, service, issues, service status, current issues, status history, summary of impact, preliminary root cause, resolution, resolution time, expected resolution time
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+author: mjcaparas
+localizationpriority: high
+---
+
+# Check the Windows Defender Advanced Threat Protection service status
+
+**Applies to:**
+
+- Windows 10 Enterprise
+- Windows 10 Education
+- Windows 10 Pro
+- Windows 10 Pro Education
+- Windows Defender Advanced Threat Protection (Windows Defender ATP)
+
+The **Service health** provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service status is healthy or if there are current issues and the details related to the issue such as when the issue was detected, what the preliminary root cause is, and the expected resolution time.
+
+You'll also see information on historical issues that have been resolved and details such as the date and time when the issue was resolved. When there are no issues on the service, you'll see a healthy status.
+
+You can view details on the service status by clicking the tile from the **Dashboard** or selecting the **Service health** menu from the navigation pane.
+
+The **Service health** details page has the following tabs:
+
+- **Current issues**
+- **Status History**
+
+## Current issues
+The **Current issues** tab shows the current state of the Windows Defender ATP service. When the service is running smoothly a healthy service status is shown. If there are issues seen on telemetry or detection functionality, and the **Deep analysis** feature, the following service details are shown to help you gain better insight about the issue:
+
+- Date and time for when the issue was detected
+- A short description of the issue
+- Update time
+- Summary of impact
+- Preliminary root cause
+- Next steps
+- Expected resolution time
+
+## Status history
+When an issue is resolved, it gets recorded in the **Status history** tab. The **Status history** tab reflects all the historical issues that were seen and resolved. The following service details are shown to help you gain better insight about the historical issues:
+
+- Date and time for when the issue was detected
+- Preliminary root cause
+- Next steps
+- Resolution time
+
+### Related topic
+- [View the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md)

windows/keep-secure/TOC.md

@@ -740,6 +740,7 @@
 ##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md)
 ##### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
 #### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md)
+#### [Windows Defender service status](service-status-windows-defender-defender-advanced-threat-protection.md)
 #### [Configure SIEM tools to consume alerts](configure-siem-windows-defender-advanced-threat-protection.md)
 ##### [Configure an Azure Active Directory application for SIEM integration](configure-aad-windows-defender-advanced-threat-protection.md)
 ##### [Configure Splunk to consume Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)

windows/keep-secure/dashboard-windows-defender-advanced-threat-protection.md

@@ -56,10 +56,12 @@ Click the name of the machine to see details about that machine. For more inform
 You can also click **Machines view** at the top of the tile to go directly to the **Machines view**, sorted by the number of active alerts. For more information see, [Investigate machines in the Windows Defender Advanced Threat Protection Machines view](investigate-machines-windows-defender-advanced-threat-protection.md).
 
 ## Status
-The **Status** tile informs you if the service is active and running and the unique number of machines (endpoints) reporting over the past 30 days.
+The **Status** tile informs you if the service is active or if there are issues and the unique number of machines (endpoints) reporting to the service over the past 30 days.
 
 ![The Status tile shows an overall indicator of the service and the total number of machines reporting to the service](images/status-tile.png)
 
+For more information on the service status, see [Check the Windows Defender ATP service status](service-status-windows-defender-defender-advanced-threat-protection.md).
+
 ## Machines reporting
 The **Machines reporting** tile shows a bar graph that represents the number of machines reporting alerts daily. Hover over individual bars on the graph to see the exact number of machines reporting in each day.