From c95d1323601d1ba70d9892040cf3677cd9a95dc0 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 5 Dec 2019 10:24:01 -0800 Subject: [PATCH] add not --- .../microsoft-defender-atp/respond-file-alerts.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md index 34d1296ea7..b7fa2c549d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/respond-file-alerts.md @@ -78,6 +78,10 @@ This action takes effect on machines with Windows 10, version 1703 or later, whe - **Alerts** - click the corresponding links from the Description or Details in the Artifact timeline - **Search box** - select **File** from the drop–down menu and enter the file name + + >[!NOTE] + >The stop and quarantine file action is limited to a maximum of 1000 machines. To stop a file on a larger number of machines, see [Add indicator to block or allow file](#add-indicator-to-block-or-allow-a-file). + 2. Go to the top bar and select **Stop and Quarantine File**. ![Image of stop and quarantine file action](images/atp-stop-quarantine-file.png)