From 71b1716295e1d3c0f2672015951cf2f2c9f1d31b Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 9 Mar 2020 15:35:19 -0700 Subject: [PATCH] Update shadow-protection.md --- .../windows-defender-antivirus/shadow-protection.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md b/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md index 5fd60956c5..76413b50ab 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/shadow-protection.md @@ -31,7 +31,11 @@ Shadow protection extends behavioral-based blocking and containment capabilities ## What happens when something is detected? -When shadow protection is turned on, and something is detected, you'll see it in the [Microsoft Defender Security Center](https://securitycenter.windows.com). If the item detected is malicious, you'll see its detection status as **Blocked** or **Remediated**. +When shadow protection is turned on, and something is detected, you'll see it in your [alerts queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/alerts-queue) with informational status. (Informational alerts are those that might not be considered harmful to your organization but might be good to keep track of.) + +If the item detected turns out to be malicious, you'll see its detection status as **Blocked** or **Remediated**. You can view these items as completed actions in the [Action center](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation#review-completed-actions). + +The following images shows an instance of unwanted software that was detected and blocked through shadow protection: :::image type="content" source="images/shadow-protection-detection.jpg" alt-text="Malware detected by shadow protection":::