deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-29 05:37:22 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

update user account topic

Browse Source
This commit is contained in:
Joey Caparas 2017-02-16 14:40:07 -08:00
parent 389e26f7f1
commit d007606977
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
windows/keep-secure/TOC.md
View File

@ -751,7 +751,7 @@
###### [Export machine timeline events](investigate-machines-windows-defender-advanced-threat-protection.md#export-machine-timeline-events)
###### [Navigate between pages](investigate-machines-windows-defender-advanced-threat-protection.md#navigate-between-pages)
##### [Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md)
##### [Investigate a user entity](investigate-user-entity-windows-defender-advanced-threat-protection.md)
##### [Investigate a user account](investigate-user-entity-windows-defender-advanced-threat-protection.md)
##### [Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md)
#### [Take response actions](response-actions-windows-defender-advanced-threat-protection.md)
##### [Take response actions on a machine](respond-machine-alerts-windows-defender-advanced-threat-protection.md)

8
windows/keep-secure/investigate-user-entity-windows-defender-advanced-threat-protection.md
View File

@ -1,6 +1,6 @@
---
title: Investigate user entities in Windows Defender Advanced Threat Protection
description: Use the investigation options to investigate alerts related to a user account.
title: Investigate user account in Windows Defender Advanced Threat Protection
description: Investigate a user account in Windows Defender Advanced Threat Protection for potential compromised credentials or pivot on the associated user account during an investigation.
keywords: investigate, account, user, user entity, alert, windows defender atp
search.product: eADQiWindows 10XVcnh
ms.prod: w10
@ -10,7 +10,7 @@ ms.pagetype: security
author: mjcaparas
localizationpriority: high
---
# Investigate a user account associated with a Windows Defender ATP alert
# Investigate a user account in Windows Defender ATP
**Applies to:**
@ -23,7 +23,7 @@ localizationpriority: high
<span style="color:#ED1C24;">[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.]</span>
## Investigate user account entities
Identify user accounts with the most active alerts (displayed on dashboard as "Users at risk") and and investigate cases of potential compromised credentials, or pivot on the associated user account when investigating an alert or machine to identify possible lateral movement between machines with that user account.
Identify user accounts with the most active alerts (displayed on dashboard as "Users at risk") and investigate cases of potential compromised credentials, or pivot on the associated user account when investigating an alert or machine to identify possible lateral movement between machines with that user account.
You can find user account information in the following views:
- Dashboard