deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-16 10:53:43 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge branch 'master' into v-gmoor-fixes-pr-4822

Browse Source
This commit is contained in:
Gary Moore
2021-03-05 09:02:35 -08:00
committed by GitHub
parent f8093999bc 693e963446
commit c8d4951993
5 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
windows/security/threat-protection/microsoft-defender-atp/images/techniques-cmd.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 69 KiB

BIN
windows/security/threat-protection/microsoft-defender-atp/images/techniques-hunting.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 39 KiB

BIN
windows/security/threat-protection/microsoft-defender-atp/images/techniques-sha1.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 69 KiB

BIN
windows/security/threat-protection/microsoft-defender-atp/images/timeline-columns.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 151 KiB

8
windows/security/threat-protection/microsoft-defender-atp/techniques-device-timeline.md
View File

@ -52,18 +52,18 @@ Select the specific *Attack technique* to open the related ATT&CK technique page
You can copy an entity's details when you see a blue icon on the right. For instance, to copy a related file's SHA1, select the blue page icon. You can copy an entity's details when you see a blue icon on the right. For instance, to copy a related file's SHA1, select the blue page icon.
![Copy entity details](images/techniques-side-pane-clickable.png) ![Copy entity details](images/techniques-sha1.png)
You can do the same for command lines. You can do the same for command lines.
![Copy command line](images/techniques-side-pane-command.png) ![Copy command line](images/techniques-cmd.png)
## Investigate related events ## Investigate related events
To use [advanced hunting](advanced-hunting-overview.md) to find events related to the selected Technique, select **Hunt for related events**. This leads to the advanced hunting page with a query to find events related to the Technique. To use [advanced hunting](advanced-hunting-overview.md) to find events related to the selected Technique, select **Hunt for related events**. This leads to the advanced hunting page with a query to find events related to the Technique.
![Hunt for related events](images/techniques-hunt-for-related-events.png) ![Hunt for related events](images/techniques-hunting.png)
>[!NOTE] >[!NOTE]
>Querying using the **Hunt for related events** button from a Technique side pane displays all the events related to the identified technique but does not include the Technique itself in the query results. >Querying using the **Hunt for related events** button from a Technique side pane displays all the events related to the identified technique but does not include the Technique itself in the query results.
@ -78,7 +78,7 @@ You can customize which columns to expose. You can also filter for flagged event
### Choose columns to expose ### Choose columns to expose
You can choose which columns to expose in the timeline by selecting the **Choose columns** button. You can choose which columns to expose in the timeline by selecting the **Choose columns** button.
![Customize columns](images/filter-customize-columns.png) ![Customize columns](images/timeline-columns.png)
From there you can select which information set to include. From there you can select which information set to include.