deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-28 00:33:40 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

added details on gui to sync w mtp version

Browse Source
This commit is contained in:
Marty Hernandez Avedon
2020-09-11 17:44:25 -04:00
parent 729662d01c
commit 5634415d85
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-query-results.md
View File

@ -113,6 +113,12 @@ After running a query, select **Export** to save the results to local file. Your
## Drill down from query results ## Drill down from query results
To view more information about entities, such as devices, files, users, IP addresses, and URLs, in your query results, simply click the entity identifier. This opens a detailed profile page for the selected entity. To view more information about entities, such as devices, files, users, IP addresses, and URLs, in your query results, simply click the entity identifier. This opens a detailed profile page for the selected entity.
To quickly inspect a record in your query results, select the corresponding row to open the Inspect record panel. The panel provides the following information based on the selected record:
- **Assets** — A summarized view of the main assets (mailboxes, devices, and users) found in the record, enriched with available information, such as risk and exposure levels
- **Process tree** — A chart generated for records with process information and enriched using available contextual information; in general, queries that return more columns can result in richer process trees.
- **All details** — Lists all the values from the columns in the record
## Tweak your queries from the results ## Tweak your queries from the results
Right-click a value in the result set to quickly enhance your query. You can use the options to: Right-click a value in the result set to quickly enhance your query. You can use the options to:
@ -123,9 +129,9 @@ Right-click a value in the result set to quickly enhance your query. You can use
![Image of advanced hunting result set](images/advanced-hunting-results-filter.png) ![Image of advanced hunting result set](images/advanced-hunting-results-filter.png)
## Filter the query results ## Filter the query results
The filters displayed to the right provide a summary of the result set. Each column has its own section that lists the distinct values found for that column and the number of instances. The filters displayed in the right pane provide a summary of the result set. Every column has its own section in the pane, each of which lists the values found in that column, and the number of instances.
Refine your query by selecting the `+` or `-` buttons on the values that you want to include or exclude and then selecting **Run query**. Refine your query by selecting the `+` or `-` buttons on the values that you want to include or exclude. Then selecting **Run query**.
![Image of advanced hunting filter](images/advanced-hunting-filter.png) ![Image of advanced hunting filter](images/advanced-hunting-filter.png)