From 4f60ac58c46877e206c2b47b39930c3e95d07ee5 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 3 Apr 2019 20:42:04 +0000 Subject: [PATCH] Updated manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md --- ...locked-list-windows-defender-advanced-threat-protection.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md index c11ff2b24d..cdcaa43100 100644 --- a/windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/manage-allowed-blocked-list-windows-defender-advanced-threat-protection.md @@ -57,7 +57,9 @@ On the top navigation you can: >[!NOTE] ->Blocking IPs, domains, or URLs is currently available on limited preview only. This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforeced. While the option is not yet generally available, it will only be used when identified during an investigation. +>Blocking IPs, domains, or URLs is currently available on limited preview only. +>This requires sending your custom list to [network protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-network-protection) to be enforeced. +>When Automated investigations finds this indicator during an investigation, it will use the allowed/block list as the basis of its decision to automatically remdiate (blocked list) or skip (allowed list) the entity. ## Manage indicators