deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-22 22:03:46 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

update suppression rules

Browse Source
This commit is contained in:
Joey Caparas
2017-07-05 12:00:53 -07:00
parent 545e465304
commit 9128c3b908
3 changed files with 8 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
windows/threat-protection/windows-defender-atp/images/atp-create-suppression-rule.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 23 KiB

BIN
windows/threat-protection/windows-defender-atp/images/atp-new-suppression-rule.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 44 KiB

9
windows/threat-protection/windows-defender-atp/manage-alerts-windows-defender-advanced-threat-protection.md
View File

@ -76,9 +76,14 @@ Create custom rules to control when alerts are suppressed, or resolved. You can
1. Select the alert you'd like to suppress. This brings up the **Alert management** pane. 1. Select the alert you'd like to suppress. This brings up the **Alert management** pane.
2. Scroll down to the **Supression rules** section. 2. Scroll down to the **Create supression rules** section.
![Image of alert status](images/atp-create-suppression-rule.png)
3. Choose the context for suppressing the alert. 3. Choose the context for suppressing the alert.
![Image of alert status](images/atp-new-suppression-rule.png)
> [!NOTE] > [!NOTE]
> You cannot create a custom or blank suppression rule. You must start from an existing alert. > You cannot create a custom or blank suppression rule. You must start from an existing alert.
4. Specify the conditions for when the rule is applied: 4. Specify the conditions for when the rule is applied:
@ -90,6 +95,8 @@ Create custom rules to control when alerts are suppressed, or resolved. You can
> The SHA1 of the alert cannot be modified > The SHA1 of the alert cannot be modified
5. Specify the action and scope on the alert. You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue. You can also specify to suppress the alert on the machine only or the whole organization. 5. Specify the action and scope on the alert. You can automatically resolve an alert or hide it from the portal. Alerts that are automatically resolved will appear in the resolved section of the alerts queue. You can also specify to suppress the alert on the machine only or the whole organization.
6. Click **Save and close**.
**See the list of suppression rules:** **See the list of suppression rules:**