Update auto-investigation-action-center.md

This commit is contained in:
Denise Vangel-MSFT 2021-01-28 14:12:23 -08:00
parent f9e66ff7e5
commit a7e18c2f7a

View File

@ -40,7 +40,7 @@ We are pleased to announce a new, unified Action center ([https://security.micro
|Listed pending and completed actions for devices ([Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md) only) |Lists pending and completed actions for devices and email in one location <br/>([Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md) plus [Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-atp)) |
|[https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center) |[https://security.microsoft.com/action-center](https://security.microsoft.com/action-center) |
Easily accessed within the the improved Microsoft 365 security center ([https://security.microsoft.com](https://security.microsoft.com)), the unified Action center brings together remediation actions across Defender for Endpoint and Defender for Office 365. It defines a common language for all remediation actions, and provides a unified investigation experience.
Easily accessed within the improved Microsoft 365 security center ([https://security.microsoft.com](https://security.microsoft.com)), the unified Action center brings together remediation actions across Defender for Endpoint and Defender for Office 365. It defines a common language for all remediation actions, and provides a unified investigation experience.
You can use the unified Action center if you have appropriate permissions and one or more of the following subscriptions:
- [Defender for Endpoint](microsoft-defender-advanced-threat-protection.md)
@ -57,13 +57,13 @@ When you visit the Action center, you see two tabs: **Pending actions** and **Hi
|Tab |Description |
|---------|---------|
|**Pending** | Displays a list of actions that require attention. You can approve or reject actions one at a time, or select multiple actions if they have the same type of action (such as **Quarantine file**). <br/>**TIP**: Make sure to review and approve (or reject) pending actions as soon as possible so that your automated investigations can complete in a timely manner. |
|**History** | Serves as an audit log for actions that were taken, such as: <br/>- Remediation actions that were taken as a result of automated investigations <br>- Remediation actions that were approved by your security operations team <br/>- Commands that were run and remediation actions that were applied during Live Response sessions <br/>- Remediation actions that were taken by threat protection features in Microsoft Defender Antivirus <p>Provides the ability to undo certain actions. |
|**History** | Serves as an audit log for actions that were taken, such as: <br/>- Remediation actions that were taken as a result of automated investigations <br>- Remediation actions that were approved by your security operations team <br/>- Commands that were run and remediation actions that were applied during Live Response sessions <br/>- Remediation actions that were taken by threat protection features in Microsoft Defender Antivirus <p>Provides a way to undo certain actions. |
You can customize, sort, filter, and export data in the Action center.
:::image type="content" source="images/new-action-center-columnsfilters.png" alt-text="Columns and filters in the Action center":::
- Select a column eading to sort items in ascending or descending order.
- Select a column heading to sort items in ascending or descending order.
- Use the time period filter to view data for the past day, week, 30 days, or 6 months.
- Choose the columns that you want to view.
- Specify how many items to include on each page of data.