deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-16 02:43:43 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

adding screenshots

Browse Source
This commit is contained in:
Daniel Simpson
2020-08-03 07:52:33 -07:00
parent ba168aa2b3
commit c19fa00cc3
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
windows/security/threat-protection/microsoft-defender-atp/device-timeline-event-flag.md
View File

@ -17,6 +17,8 @@ ms.topic: article
---
# Microsoft Defender ATP device timeline event flags
**Applies to:** [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
Event flags in the Microsoft Defender ATP device timeline help you filter and organize specific events when you're investigate potential attacks.
The Microsoft Defender ATP device timeline provides a chronological view of the events and associated alerts observed on a device. This list of events provides full visibility into any events, files, and IP addresses observed on the device. The list can sometimes be lengthy. Device timeline event flags help you track events that could be related.
@ -29,13 +31,15 @@ While navigating the device timeline, you can search and filter for specific eve
- Marking events that requires deep dive
- Building a clean breach timeline
## Flag an event
1. Find the event that you want to flag
2. Click the flag icon in the Flag column.
![Image of device timeline flag](images/device-flags.png)
## View flagged events
1. In the timeline **Filters** section, enable **Flagged events**.
2. Click **Apply**. Only flagged events are displayed.
You can apply additional filters by clicking on the time bar. This will only show events prior to the flagged event.
![Image of device timeline flag with filter on](images/device-flag-filter.png)