Tweaks

windows/security/threat-protection/microsoft-defender-atp/threat-analytics-analyst-reports.md

@@ -25,66 +25,56 @@ ms.topic: article
 **Applies to:**
 - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
 
-Each [threat analytics report](threat-analytics.md) includes dynamic sections and a comprehensive written section called the _analyst report_.
+Each [threat analytics report](threat-analytics.md) includes dynamic sections and a comprehensive written section called the _analyst report_. To access this section, open the report about the tracked threat and select the **Analyst report** tab.
+
+![Image of the analyst report section of a threat analytics report](images/ta-analyst-report-small.png)
 
-![Image of the analyst report section of a threat analytics report](images/ta-analyst-report.png)
 _Analyst report section of a threat analytics report_
 
-## Learn about the sections of the analyst report
+## Scan the analyst report 
-Most analyst reports include the following sections:
+Each section of the analyst report is designed to provide actionable information. While reports vary, most reports include the sections described in the following table.
 
 | Report section | Description |
 |--|--|
-| Executive summary | Overview of the threat, including when it was first seen, its motivations, notable events, major targets, and distinct tools and techniques. You can use this information to further assess how to prioritize the threat in the context of your industry, geographic location, and network state. |
+| Executive summary | Overview of the threat, including when it was first seen, its motivations, notable events, major targets, and distinct tools and techniques. You can use this information to further assess how to prioritize the threat in the context of your industry, geographic location, and network. |
-| Analysis | Technical information about the threats, including the details of an attack or how a new technique or attack surface might be used. | 
+| Analysis | Technical information about the threats, including the details of an attack and how attackers might utilize a new technique or attack surface | 
-| MITRE ATT&CK techniques observed | Lists the techniques and how they map to the techniques in the [MITRE ATT&CK attack framework](https://attack.mitre.org/). | 
+| MITRE ATT&CK techniques observed | How observed techniques map to the [MITRE ATT&CK attack framework](https://attack.mitre.org/) | 
-| [Mitigations](#apply-additional-mitigations) | Lists recommendations that can stop or help reduce the impact of the threat. This section also includes mitigations that are not tracked dynamically as part of the threat analytics report. |
+| [Mitigations](#apply-additional-mitigations) | Recommendations that can stop or help reduce the impact of the threat. This section also includes mitigations that aren't tracked dynamically as part of the threat analytics report. |
-| [Detection details](#understand-how-each-threat-can-be-detected) | Lists specific and generic detections provided by Microsoft security solutions that can surface activity or components associated with the threat. | 
+| [Detection details](#understand-how-each-threat-can-be-detected) | Specific and generic detections provided by Microsoft security solutions that can surface activity or components associated with the threat. | 
-| [Advanced hunting](#find-subtle-threat-artifacts-using-advanced-hunting) | Provides sample [advanced hunting queries](advanced-hunting-overview.md) for proactively identifying possible threat activity. Most queries are provided to supplement detections, especially for locating potentially malicious components or behaviors that couldn't be dynamically assessed to be malicious. | 
+| [Advanced hunting](#find-subtle-threat-artifacts-using-advanced-hunting) | [Advanced hunting queries](advanced-hunting-overview.md) for proactively identifying possible threat activity. Most queries are provided to supplement detections, especially for locating potentially malicious components or behaviors that couldn't be dynamically assessed to be malicious. | 
-| References | Lists Microsoft and third-party references reviewed by analysts during the creation of the report. Threat analytics reports are based on data validated by Microsoft researchers. Information from publicly available, third-party source are identified clearly as such. | 
+| References | Microsoft and third-party publications referenced by analysts during the creation of the report. Threat analytics content is based on data validated by Microsoft researchers. Information from publicly available, third-party sources are identified clearly as such. | 
-| Change log | The time the report was published and and when significant changes were made to the report. |
+| Change log | The time the report was published and when significant changes were made to the report. |
 
 ## Apply additional mitigations
-Threat analytics reports dynamically track the [status of security updates and secure configurations](threat-analytics.md#review-list-of-mitigations-and-the-status-of-your-devices). This information is available as charts and tables under the **Mitigations** tab.
+Threat analytics dynamically tracks the [status of security updates and secure configurations](threat-analytics.md#review-list-of-mitigations-and-the-status-of-your-devices). This information is available as charts and tables in the **Mitigations** tab.
 
 In addition to these tracked mitigations, the analyst report also discusses mitigations that are _not_ dynamically monitored. Here are some examples of important mitigations that are not dynamically tracked:
 
 - Block emails with _.lnk_ attachments or other suspicious file types
 - Randomize local administrator passwords
 - Educate end users about phishing email and other threat vectors
+- Turn on specific [attack surface reduction rules](attack-surface-reduction.md)
 
-While you can use the **Mitigations** tab to assess your security posture against a threat, you can take additional steps towards improving your security posture. Carefully read all the mitigation guidance in the analyst report and apply them whenever possible.
+While you can use the **Mitigations** tab to assess your security posture against a threat, these recommendations let you take additional steps towards improving your security posture. Carefully read all the mitigation guidance in the analyst report and apply them whenever possible.
 
 ## Understand how each threat can be detected
-The analyst report also provides the detections from various security Microsoft 365 Defender capabilities, including:
+The analyst report also provides the detections from Microsoft Defender for Endpoint antivirus and _endpoint detection and response_ (EDR) capabilities.
-
-- Antivirus
-- Endpoint detection and response (EDR)
-- Attack surface reduction rules
 
 ### Antivirus detections
 These detections are available on devices with [Microsoft Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/microsoft-defender-antivirus-in-windows-10) turned on. When these detections occur on devices that have been onboarded to Microsoft Defender for Endpoint, they also trigger alerts that light up the charts in the report.
 
-#### Generic detections
+>[!NOTE]
-The analyst report also lists generic detections that can identify a wide-range of threats, in addition to components or behaviors associated with the tracked threat. These generic detections don't reflect in the charts.
+The analyst report also lists **generic detections** that can identify a wide-range of threats, in addition to components or behaviors specific to the tracked threat. These generic detections don't reflect in the charts.
 
 ### Endpoint detection and response (EDR) alerts
-Endpoint detection and response alerts constitute alerts in Microsoft Defender Security Center. They are raised on [devices onboarded to Microsoft Defender for Endpoint](onboard-configure.md). These alerts generally rely on security signals collected by the Microsoft Defender for Endpoint sensor and other endpoint capabilities: antivirus, network protection, tamper protection, among others that serve as powerful signal sources.
+EDR alerts are raised for [devices onboarded to Microsoft Defender for Endpoint](onboard-configure.md). These alerts generally rely on security signals collected by the Microsoft Defender for Endpoint sensor and other endpoint capabilities—such as antivirus, network protection, tamper protection—that serve as powerful signal sources.
 
-Like the list of antivirus detections, some EDR alerts are designed to generically flag suspicious behavior that might not be associated with the tracked threat. In such cases, the report will clearly identify the alert as generic and that it does not influence any of the charts in the report.
+Like the list of antivirus detections, some EDR alerts are designed to generically flag suspicious behavior that might not be associated with the tracked threat. In such cases, the report will clearly identify the alert as "generic" and that it doesn't influence any of the charts in the report.
-
-### Attack surface reduction rules
-When turned on, [attack surface reduction rules](attack-surface-reduction.md) can be set to either detect (audit) or block various behaviors commonly associated with threats, such as:
-- An Office application spawning a child process
-- An email client launching an executable
-- A script downloading executable content
-
-The analyst report provides a list of attack surface reduction rules that you can use to detect or block the tracked threat.
 
 ## Find subtle threat artifacts using advanced hunting
-While detections allow you to identify and stop the tracked threat automatically, many attack activities leave subtle traces that require additional inspection. Some attack activities exhibit behaviors that are also exhibited by everyday transactions, so detecting them dynamically can result in operational noise or even false positives.
+While detections allow you to identify and stop the tracked threat automatically, many attack activities leave subtle traces that require additional inspection. Some attack activities exhibit behaviors that can also be normal, so detecting them dynamically can result in operational noise or even false positives.
 
-[Advanced hunting](advanced-hunting-overview.md) provides a query interface, based on Kusto Query Language, that simplifies locating subtle indicators of threat activity. It also allows you to surface contextual information quickly. You can verify whether identified indicators are indeed associated with the tracked threat.
+[Advanced hunting](advanced-hunting-overview.md) provides a query interface based on Kusto Query Language that simplifies locating subtle indicators of threat activity. It also allows you to surface contextual information and verify whether indicators are connected to a threat.
 
 Advanced hunting queries in the analyst reports have been vetted by Microsoft analysts and are ready for you to run in the [advanced hunting query editor](https://securitycenter.windows.com/advanced-hunting). You can also use the queries to create [custom detection rules](custom-detection-rules.md) that trigger alerts for future matches.
 

windows/security/threat-protection/microsoft-defender-atp/threat-analytics.md

@@ -41,7 +41,7 @@ Threat analytics is a set of reports from expert Microsoft security researchers
 - Common attack surfaces
 - Prevalent malware
 
-Each report provides a detailed analysis of a threat and extensive guidance on how to defend against the threat. It also incorporates data from your network, indicating whether the threat is active and if you have applicable security updates and recommended settings in place.
+Each report provides a detailed analysis of a threat and extensive guidance on how to defend against that threat. It also incorporates data from your network, indicating whether the threat is active and if you have applicable protections in place.
 
 Watch this short video to learn more about how threat analytics can help you track the latest threats and stop them.
 <p></p>
@@ -54,7 +54,7 @@ The threat analytics dashboard is a great jump off point for getting to the repo
 
 - **Latest threats**—lists the most recently published threat reports, along with the number of devices with active and resolved alerts.
 - **High-impact threats**—lists the threats that have had the highest impact to the organization. This section ranks threats by the number of devices that have active alerts.
-- **Threat summary**—shows the overall impact of all the threats reported in threat analytics by showing the number of threats with active and resolved alerts.
+- **Threat summary**—shows the overall impact of tracked threats by showing the number of threats with active and resolved alerts.
 
 Select a threat from the dashboard to view the report for that threat.
 
@@ -84,19 +84,21 @@ Each report includes charts that provide an overview of how resilient your organ
 ### Get expert insight from the analyst report
 Go to the [**Analyst report** section](threat-analytics-analyst-reports.md) to read through the detailed expert write-up. Most reports provide detailed descriptions of attack chains, including tactics and techniques mapped to the MITRE ATT&CK framework, exhaustive lists of recommendations, and powerful [threat hunting](advanced-hunting-overview.md) guidance.
 
-
 ### Review list of mitigations and the status of your devices
-In the **Mitigations** section, review the list of specific actionable recommendations that can help you increase your organizational resilience against the threat. The list of tracked mitigations includes recommended settings and vulnerability patches. It also shows the number of devices that don't have these mitigations in place.
+In the **Mitigations** section, review the list of specific actionable recommendations that can help you increase your organizational resilience against the threat. The list of tracked mitigations includes:
+
+- **Security updates**—deployment of security updates for Microsoft vulnerabilities on onboarded devices
+- **Microsoft Defender Antivirus settings**
+  - Cloud-delivered protection  
+  - Potentially unwanted application (PUA) protection
+  - Real-time protection
  
-This section currently supports dynamically tracking the following mitigations:
-- 
 
 Mitigation information in this section incorporates data from [threat and vulnerability management](next-gen-threat-and-vuln-mgt.md), which also provides detailed drill-down information from various links in the report.
 
 ![Image of the mitigations section of a threat analytics report](images/ta-mitigations.png)
 _Mitigations section of a threat analytics report_
 
-
 ## Additional report details and limitations
 When using the reports, keep the following in mind: