From abc4c3f3c477fc7ad9358d57f8a32ea7d69d11b4 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 19 Sep 2018 19:59:19 +0000 Subject: [PATCH] Updated investigate-incidents-windows-defender-advanced-threat-protection.md --- ...ate-incidents-windows-defender-advanced-threat-protection.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md index b3e10a5d42..c08437ca8e 100644 --- a/windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/investigate-incidents-windows-defender-advanced-threat-protection.md @@ -37,6 +37,8 @@ Alerts are grouped into incidents based on the following reasons: - Same file - The files associated with the alert are exactly the same ![Image of alerts tab in incident page showing the Linked by tool tip](images/atp-incidents-alerts-linkedbytooltip.png) + + ![Image of alerts tab with incident details page showing the reasons the alerts were linked together in that incident](images/atp-incidents-alerts-incidentlinkedbyreason.png) You can also manage an alert and see alert metadata along with other information. For more information, see [Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md).