update version for airs

This commit is contained in:
Joey Caparas
2019-05-07 15:55:45 -07:00
parent bebb07ae8c
commit 50a4e93030

View File

@ -34,8 +34,8 @@ The Automated investigations list shows all the investigations that have been in
Entities are the starting point for Automated investigations. When an alert contains a supported entity for Automated investigation (for example, a file) that resides on a machine that has a supported operating system for Automated investigation then an Automated investigation can start.
>[!NOTE]
>Currently, Automated investigation only supports Windows 10, version 1803 or later.
>Some investigation playbooks, like memory investigations, require Windows 10, version 1809 or later.
>Currently, Automated investigation only supports Windows 10, version 1709 or later.
>Some investigation playbooks, like memory investigations, require Windows 10, version 1709 or later.
The alerts start by analyzing the supported entities from the alert and also runs a generic machine playbook to see if there is anything else suspicious on that machine. The outcome and details from the investigation is seen in the Automated investigation view.