From 6c0701c017c8ab72a246422294b6aedb41ca1743 Mon Sep 17 00:00:00 2001 From: lomayor Date: Fri, 24 Jan 2020 10:50:16 -0800 Subject: [PATCH] Update investigate-alerts.md --- .../microsoft-defender-atp/investigate-alerts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md index 755dafb1e4..297de5d17d 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md +++ b/windows/security/threat-protection/microsoft-defender-atp/investigate-alerts.md @@ -68,7 +68,7 @@ The **Alert process tree** takes alert triage and investigation to the next leve The **Alert process tree** expands to display the execution path of the alert and related evidence that occurred around the same period. Items marked with a thunderbolt icon should be given priority during investigation. >[!NOTE] ->The alert process tree might not be available in some alerts. +>The alert process tree might not show for some alerts, including alerts not triggered directly by process activity. Clicking in the circle immediately to the left of the indicator displays its details.