deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-19 12:23:37 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

fix toc to include new topics

Browse Source
This commit is contained in:
Joey Caparas
2017-02-07 16:49:58 -08:00
parent d5cdbc4f47
commit a5308d47dc
3 changed files with 28 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
windows/keep-secure/TOC.md
View File

@ -736,22 +736,36 @@
#### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md) #### [Portal overview](portal-overview-windows-defender-advanced-threat-protection.md)
#### [Understand the Dashboard](dashboard-windows-defender-advanced-threat-protection.md) #### [Understand the Dashboard](dashboard-windows-defender-advanced-threat-protection.md)
#### [Use the Windows Defender ATP portal](use-windows-defender-advanced-threat-protection.md) #### [Use the Windows Defender ATP portal](use-windows-defender-advanced-threat-protection.md)
##### [Alerts overview](alerts-queue-windows-defender-advanced-threat-protection.md) #### [Alerts overview](alerts-queue-windows-defender-advanced-threat-protection.md)
##### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) #### [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)
#### [Consume alerts and create custom indicators](configure-siem-windows-defender-advanced-threat-protection.md) #### [Consume alerts and create custom indicators](configure-siem-windows-defender-advanced-threat-protection.md)
##### [Configure an Azure Active Directory application for SIEM integration](configure-aad-windows-defender-advanced-threat-protection.md) ##### [Configure an Azure Active Directory application for SIEM integration](configure-aad-windows-defender-advanced-threat-protection.md)
##### [Configure Splunk to consume Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md) ##### [Configure Splunk to consume Windows Defender ATP alerts](configure-splunk-windows-defender-advanced-threat-protection.md)
##### [Configure HP ArcSight to consume Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md) ##### [Configure HP ArcSight to consume Windows Defender ATP alerts](configure-arcsight-windows-defender-advanced-threat-protection.md)
##### [Understand threat indicators](threat-indicator-concepts-windows-defender-advanced-threat-protection.md) ##### [Understand threat indicators](threat-indicator-concepts-windows-defender-advanced-threat-protection.md)
##### [Create custom threat indicators using REST API](custom-ti-api-windows-defender-advanced-threat-protection.md) ###### [Create custom threat indicators using REST API](custom-ti-api-windows-defender-advanced-threat-protection.md)
#### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) ##### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
##### [Machines overview](machines-view-overview-windows-defender-advanced-threat-protection.md) #### [Machines overview](machines-view-overview-windows-defender-advanced-threat-protection.md)
##### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md) #### [Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md)
##### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md) ##### [Isolate machines from the network](investigate-machines-windows-defender-advanced-threat-protection.md#isolate-machines-from-the-network)
##### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) ##### [Undo machine isolation](investigate-machines-windows-defender-advanced-threat-protection.md#undo-machine-isolation)
##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) ##### [Collect investigation package](investigate-machines-windows-defender-advanced-threat-protection.md#collect-investigation-package)
##### [Check sensor status](check-sensor-status-windows-defender-advanced-threat-protection.md) ##### [Check activity details in Action center](investigate-machines-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
###### [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md) #### [Investigate files](investigate-files-windows-defender-advanced-threat-protection.md)
##### [Stop and quarantine files in your network](investigate-files-windows-defender-advanced-threat-protection.md#stop-and-quarantine-files-in-your-network)
##### [Remove file from quarantine](investigate-files-windows-defender-advanced-threat-protection.md#remove-file-from-quarantine)
##### [Block files in your network](investigate-files-windows-defender-advanced-threat-protection.md#block-files-in-your-network)
##### [Check activity details in Action center](investigate-files-windows-defender-advanced-threat-protection.md#check-activity-details-in-action-center)
##### [Deep analysis]((investigate-files-windows-defender-advanced-threat-protection.md#deep-analysis)
###### [Submit files for analysis](investigate-files-windows-defender-advanced-threat-protection.md#submit-files-for-analysis)
###### [View deep analysis reports](investigate-files-windows-defender-advanced-threat-protection.md#view-deep-analysis-reports)
##### [Troubleshoot deep analysis](investigate-files-windows-defender-advanced-threat-protection.md#troubleshoot-deep-analysis)
#### [Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md)
#### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md)
#### [Check sensor status](check-sensor-status-windows-defender-advanced-threat-protection.md)
##### [Fix unhealthy sensors](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md)
###### [Inactive machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#inactive-machines)
###### [Misconfigured machines](fix-unhealhty-sensors-windows-defender-advanced-threat-protection.md#misconfigured-machines)
#### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md) #### [Windows Defender ATP settings](settings-windows-defender-advanced-threat-protection.md)
#### [Windows Defender ATP service status](service-status-windows-defender-advanced-threat-protection.md) #### [Windows Defender ATP service status](service-status-windows-defender-advanced-threat-protection.md)
#### [Configure email notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md) #### [Configure email notifications](configure-email-notifications-windows-defender-advanced-threat-protection.md)

4
windows/keep-secure/investigate-files-windows-defender-advanced-threat-protection.md
View File

@ -199,7 +199,7 @@ A progress bar is displayed and provides information on the different stages of
> [!NOTE] > [!NOTE]
> Depending on machine availability, sample collection time can vary. There is a 3-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file. > Depending on machine availability, sample collection time can vary. There is a 3-hour timeout for sample collection. The collection will fail and the operation will abort if there is no online Windows 10 machine reporting at that time. You can re-submit files for deep analysis to get fresh data on the file.
## View deep analysis reports ### View deep analysis reports
View the deep analysis report that Windows Defender ATP provides to see the details of the deep analysis that was conducted on the file you submitted. This feature is available in the file view context. View the deep analysis report that Windows Defender ATP provides to see the details of the deep analysis that was conducted on the file you submitted. This feature is available in the file view context.
@ -238,7 +238,7 @@ HKLM\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection
> [!NOTE] > [!NOTE]
> If the value *AllowSampleCollection* is not available, the client will allow sample collection by default. > If the value *AllowSampleCollection* is not available, the client will allow sample collection by default.
### Related topics ## Related topics
- [Understand the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [Understand the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md)
- [Alerts overview](alerts-queue-windows-defender-advanced-threat-protection.md) - [Alerts overview](alerts-queue-windows-defender-advanced-threat-protection.md)
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)

4
windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md
View File

@ -113,7 +113,6 @@ This machine isolation feature disconnects the compromised machine from the netw
>[!NOTE] >[!NOTE]
>You’ll be able to reconnect the machine back to the network at any time. >You’ll be able to reconnect the machine back to the network at any time.
## Isolate machine
1. Select the machine that you want to isolate. You can select or search for a machine from any of the following views: 1. Select the machine that you want to isolate. You can select or search for a machine from any of the following views:
- **Dashboard** – Select the machine name from the Top machines with active alerts section. - **Dashboard** – Select the machine name from the Top machines with active alerts section.
@ -176,7 +175,6 @@ Temp Directories | Contains a set of text files that lists the files located in
Users and Groups | Provides a list of files that each represent a group and its members. Users and Groups | Provides a list of files that each represent a group and its members.
CollectionSummaryReport.xls | This file is a summary of the investigation package collection, it contains the list of data points, the command used to extract the data, the execution status, and the error code in case of failure. You can use this report to track if the package includes all the expected data and identify if there were any errors. CollectionSummaryReport.xls | This file is a summary of the investigation package collection, it contains the list of data points, the command used to extract the data, the execution status, and the error code in case of failure. You can use this report to track if the package includes all the expected data and identify if there were any errors.
## Collect investigation package
1. Select the machine that you want to investigate. You can select or search for a machine from any of the following views: 1. Select the machine that you want to investigate. You can select or search for a machine from any of the following views:
- **Dashboard** – Select the machine name from the Top machines with active alerts section. - **Dashboard** – Select the machine name from the Top machines with active alerts section.
@ -207,7 +205,7 @@ The **Action center** provides information on actions that were taken on a machi
![Image of action center with information](images/atp-action-center-with-info.png) ![Image of action center with information](images/atp-action-center-with-info.png)
### Related topics ## Related topics
- [Understand the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md) - [Understand the Windows Defender Advanced Threat Protection Dashboard](dashboard-windows-defender-advanced-threat-protection.md)
- [Alerts overview](alerts-queue-windows-defender-advanced-threat-protection.md) - [Alerts overview](alerts-queue-windows-defender-advanced-threat-protection.md)
- [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md) - [Investigate Windows Defender Advanced Threat Protection alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)