diff --git a/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md index 8ee9cd8e12..9665f24c1f 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md +++ b/windows/security/threat-protection/microsoft-defender-atp/manage-incidents.md @@ -34,13 +34,13 @@ Selecting an incident from the **Incidents queue** brings up the **Incident mana You can assign incidents to yourself, change the status and classification, rename, or comment on them to keep track of their progress. > [!TIP] -> For additional visibility at-a-glance, automatic incident naming, currently in public preview, generates incident names based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories. This allows you to quickly understand the scope of the incident. +> For additional visibility at a glance, incident names are automatically generated based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories. This allows you to quickly understand the scope of the incident. > > For example: *Multi-stage incident on multiple endpoints reported by multiple sources.* > -> Incidents that existed prior the rollout of automatic incident naming will not have their name changed. +> Incidents that existed prior the rollout of automatic incident naming will retain their names. > -> Learn more about [turning on preview features](preview.md#turn-on-preview-features). + ![Image of incident detail page](images/atp-incident-details-updated.png) diff --git a/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md b/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md index 0a72f9fa7d..73f10d1488 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md +++ b/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue.md @@ -49,7 +49,7 @@ Incident severity | Description High
(Red) | Threats often associated with advanced persistent threats (APT). These incidents indicate a high risk due to the severity of damage they can inflict on devices. Medium
(Orange) | Threats rarely observed in the organization, such as anomalous registry change, execution of suspicious files, and observed behaviors typical of attack stages. Low
(Yellow) | Threats associated with prevalent malware and hack-tools that do not necessarily indicate an advanced threat targeting the organization. -Informational
(Grey) | Informational incidents are those that might not be considered harmful to the network but might be good to keep track of. +Informational
(Grey) | Informational incidents might not be considered harmful to the network but might be good to keep track of. ## Assigned to You can choose to filter the list by selecting assigned to anyone or ones that are assigned to you. @@ -65,16 +65,15 @@ Use this filter to show incidents that contain sensitivity labels. ## Incident naming -To understand the incident's scope at-a-glance, automatic incident naming, currently in public preview, generates incident names based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories. +To understand the incident's scope at a glance, incident names are automatically generated based on alert attributes such as the number of endpoints affected, users affected, detection sources or categories. For example: *Multi-stage incident on multiple endpoints reported by multiple sources.* > [!NOTE] -> Incidents that existed prior the rollout of automatic incident naming will not have their name changed. +> Incidents that existed prior the rollout of automatic incident naming will retain their name. -Learn more about [turning on preview features](preview.md#turn-on-preview-features). -## Related topics +## See also - [Incidents queue](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/view-incidents-queue) - [Manage incidents](manage-incidents.md) - [Investigate incidents](investigate-incidents.md)