deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-29 05:37:22 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

update user account topic

Browse Source
This commit is contained in:
Joey Caparas 2017-02-16 14:40:07 -08:00
parent 389e26f7f1
commit d007606977
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
windows/keep-secure/TOC.md
View File

@ -751,7 +751,7 @@
###### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events) ###### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events)
###### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages) ###### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages)
##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) ##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md)
##### [Investigate a user entity](investigate-user-entity-windows-defender-advanced-threat-protection.md) ##### [Investigate a user account](investigate-user-entity-windows-defender-advanced-threat-protection.md)
##### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) ##### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
#### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md) #### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md)
##### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md) ##### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md)

8
windows/keep-secure/investigate-user-entity-windows-defender-advanced-threat-protection.md
View File

@ -1,6 +1,6 @@
--- ---
title: Investigate user entities in Windows Defender Advanced Threat Protection title: Investigate user account in Windows Defender Advanced Threat Protection
description: Use the investigation options to investigate alerts related to a user account. description: Investigate a user account in Windows Defender Advanced Threat Protection for potential compromised credentials or pivot on the associated user account during an investigation.
keywords: investigate, account, user, user entity, alert, windows defender atp keywords: investigate, account, user, user entity, alert, windows defender atp
search.product: eADQiWindows 10XVcnh search.product: eADQiWindows 10XVcnh
ms.prod: w10 ms.prod: w10
@ -10,7 +10,7 @@ ms.pagetype: security
author: mjcaparas author: mjcaparas
localizationpriority: high localizationpriority: high
--- ---
# Investigate a user account associated with a Windows Defender ATP alert # Investigate a user account in Windows Defender ATP
**Applies to:** **Applies to:**
@ -23,7 +23,7 @@ localizationpriority: high
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span> <span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
## Investigate user account entities ## Investigate user account entities
Identify user accounts with the most active alerts (displayed on dashboard as "Users at risk") and and investigate cases of potential compromised credentials, or pivot on the associated user account when investigating an alert or machine to identify possible lateral movement between machines with that user account. Identify user accounts with the most active alerts (displayed on dashboard as "Users at risk") and investigate cases of potential compromised credentials, or pivot on the associated user account when investigating an alert or machine to identify possible lateral movement between machines with that user account.
You can find user account information in the following views: You can find user account information in the following views:
- Dashboard - Dashboard