From db11efe21780f32a1036542b77eddcdb9d824e0b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Sun, 5 Feb 2017 13:41:00 -0800 Subject: [PATCH] investigate alerts content --- ...ows-defender-advanced-threat-protection.md | 3 ++ .../images/atp-alert-process-tree.png | Bin 0 -> 17231 bytes ...ows-defender-advanced-threat-protection.md | 40 +++++++----------- ...ows-defender-advanced-threat-protection.md | 2 - 4 files changed, 18 insertions(+), 27 deletions(-) create mode 100644 windows/keep-secure/images/atp-alert-process-tree.png diff --git a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md index 07643b9003..95064abbf7 100644 --- a/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/alerts-queue-windows-defender-advanced-threat-protection.md @@ -91,6 +91,9 @@ You can take the following management actions on an alert from the **Alert manag - See related activity on the machine - Add and view comments about the alert +>[!NOTE] +>You can also access the **Alert management** pane from the machine details view by selecting an alert in the **Alerts related to this machine** section. + ### Bulk edit alerts Select multiple alerts (Ctrl or Shift select) and manage or edit alerts together, which allows resolving multiple similar alerts in one go. diff --git a/windows/keep-secure/images/atp-alert-process-tree.png b/windows/keep-secure/images/atp-alert-process-tree.png new file mode 100644 index 0000000000000000000000000000000000000000..51d001984b15cb25aa2eee154f03a6e122e0bb48 GIT binary patch literal 17231 zcmc({2UJvBwJ!~cBV#nH%wW{vuS`2UO=!}WIFiP^ ziC)o=DT1Kysn{m9ZCyEFJ5;uOPV)d4IxzW>!{ZL0qATS?f7A3D<{w z;l%79R#Dp+YmsQqITD6i>AEzOVHWSLAs=+EV|QZ|!}nlO;Z+*)MGl zQJVoF1-rgMJ6ui!2S)GU!Gp9nP@+TjFKo-k4>gy-N8!i>$8^WCJsV+e#ZEIyVzEl7 z&W)N4$umq$#81Ie$7WS5@bVnq$!EAV(km)-0s{l5AC<-LE|{@MdKC5B?rbi@2=n7S z=D8$ye$@_Cy5(U%d|2x@i?<++RAZB?JvS`j9BeYO1Z+!R-v$I6@9XVc#BL-TETY|7_-y%UxgMXaynOVA?KvZJ5;-F`xAy?Ut%N_XC|#A3 z(trQ{{fb9*n7j9)MOTlGr^cc?USeer#z|B0sgT~7*qhV!=G4U&{dcUkWp`XF(HuUT zhLvs0KmGZyffW_Pcs{SXp5;DY1M3h*K_8|+cYQFv*nKQ>27#OrHKBo|In?L=r z$wNbWh)KhYY%3Q;^mb&5=n~lU z2F6Y~I=6eE(2`{3Q$k{ZaV1oWXNeix;dV>r=jU6-pT8z~lRUvJc7&m<(or8>&yA&? z#nMssllOhr3*%7*>x?K>BO{~s>%HnDKHE0Ku7fskHeq$H>%jWq${Gib<>lplh7Yme zdQzy~F)|neh4tAU94$Fp-#Sh4+Fc`Hjp;*$HVOT4BIt}_vz|E5`NnO;9cOb}GyN8F zN=LBHre#TAF?~;UC7Fl>@Q~`&P6dy-l<>bxmSJ^qhZ)$1rpT}3yx04EN&Q=U8#udG zH%sDHy?4=RYuoZEMiUbgi_seIX_%8`|KhqvZF~Q%`1qa4D>{XyfqH!5uB4HiN>Yu) z*bvw$6tPozT2PfVjKOzlK6`)U;9?jjK1!H-b`LI~uBlnd5*HvQyXTY}#d`h8m;R4E z7xoCG;mXof#b{TJJ9TBjg&lo;>H5_k#l)&bcd1YE!M#80{EMCER1wo`t#&C3Kl}A$ z*lpC?G!N}L5MyQLq|DUxd(t;K2G|+{NbFW~FC4+`kvM|enc`pEQYx4pJ>XjNYHQ2J z!p^&Xacy%rVd3iZ@K%eKE*1=^x-fIpuMJ^nOy*Vw~6YflxK%B6G4V#l|-`6qYRC_|y zyuZN2Q9Rbt+PXV_Z#9j+Sd6K4I*u=F<1li4_Qhky^=`qGyxhK_*^W=bPrn~ogq7%F z=z`gmLXewst;Dzg#Kej@O~=Sm6qRCbI`lR;Yglbuh}C}HfeUY#4b&+zSMh5d+@a7` z+B!QIC8rujEZR8b#^NPo{eR!ZKGBj8B0Evp5QW@kb9n*@P`h)=7)zI{F5!v8U**D$ z9IelHdwP1n2p_vo|1r}V%j!(u&7D`31W6(*Ir$!vQIbZb}ANL==AxvueXH_rIkttp^kC>1=Ni!;EwpQ1UyzG55EF34SGl-U&}ek!fOu>x zU*!^BbTs?t&!>XsQ&Ur17cSi4*2oU&np5-gs_GZvOMX` z(Tixla8*^+j~_mK%FfPqGB^*HZdZH-n9)EtP(*X7vya;^Q$Cn3OU9-pLO|SOHQi%l zY1pzdGxJ*Ugoy6c@BA40@uTsfkMG_cQ`ofRh-S3p`F!Qg?MN0q6+0gVUlRh^?u)ndmGD!=I06Z zcfsQ9(bLfhVj!taJ)?T>x%j<$r5zN?Svi~w5P_^8NT$Ts#(y5Y8O)iIoJ_0NJmy-- zJ99%LS14#BPm+u4ha(AvLh<(gHc{gd?wSdF%&RwGsJ zO+S99+`ap^X={uHdvsh}?&_*DI1S|5Ibt5JcV()%%^lAduF&7#ze4eXuWLL!LK}!r zm6i1knRPF=QTxIsCnqCpe*XN~av^H3prD||=`{hFLsed9r>eS!#sf`}o zxMb82WYLqUevOOkXkU0tOm=^vSypbYQfO#sW_o)2>l3Uzql%{2UrR3aeg4$tQk+sz zF>oWfbIv(RMuP6xu~k4Tk=rmXFl7t-b(ATMB|a;!#&RzXi%n9D7I8`MJ$D6&wQwnh*```QFGcS}5c+v1h;#+p`EZ@n&_umApCt7Oo+guJJRY>iw;mDP|~EB0V{ z3k!>V)grrFYl1k=f%xVr)ja*`7TmCHDO5=3=;gytq_9ePmC>KO`J}(ZijeE;3NUf{ zTpp}u`$A7e$m`X*@88p5NB4-3r}2*s4HHFd28?^9EW59|SC8;9MGI`kmoC+H)_k(9 zUej=|)_1y@G`LtoTR${3bDStHyvlE9i5!;Biu#@za6Awj0sm~M8eTa4bT1kuj2FhPEsfo59;p5 z6q$l-(2Ug7RJ_SZb5j$thrr5<{e|*SFB7p8Bls8%A3be>D;R6~T*2aCX|rizq|Bd^ z?7=XhbM$^wo=vGrv6--0P>N)HXIGc*q6&h2el6ZTPxS4{(&WB&?E(0hYL}(|?)C-& za1`VWp5}bm<*zayBG+dsv&A(%z4|cbrV0c%q!_LbV#@-iArs0)aO-Q_++6|8f}AJ= z@3qiB{`_-l`PnQpa*va~>;?4qm6gLACRBWUY7jyoD$0`Hz-ua0lM^Lq)~e>>QvBe- zgCoDE@pqD6_Mb6IX;X9wDXHa8>mSJ>H#a{a`R|xan@QYdUM*b#dAmLEWMf6+Ogtvn zV0T_Kkq^1;ZPEW@_{>EHmL@VX((&dw$nn$bkof>w{Frilm5fw5iE_8tgRxkw zkjJWdj!y9dtPpS}DD2>(#+^IQ=ZVD7u&~R1wTV;B;eG{r$Y*TIX7~4tj(YuxCF;9R zg;r4aw%g`}!Bi0b)*3GcH%=_4r>EcN!0dbmFA=utnFcd;$CQ5(?@=>9jTE zLbEY(iF^r#LFdGhARwp!ZXc*}FQjL`brtpQ?c0t((UJ7YN#kLsHp!Wku(Gl;vPU2U zT%bJ=tPKgeOM+B&F@viNA$VXsWU)L1Z{BWjA>J;r?74=Imo|U`VT;m+$%TBUFCZXb zX>Q&gZs3#QHsUT1$fdn0l)KpY#~)~z2HFuF-0(?Rijs`Bkq=}^+1%VzLT5o3fXEE1 z2Ln>k){ZQfhJRycO9y%L2w5thDv?1=2^tCgW z;7htT9;qj}HTx+_%Dcj6t1CX!0Ou1W>FJtgbymbW0(Ob6&4;kC-Z^5nUb!la1ML0S z!Qpdq>b7Xvu&vE#4I10>Wy=1hn!bK6jPDY}7{F>kngASXYHFHyRz$2`Ay-Og45$N` zl*G);Oy|um+}w)*d6)dBh2^8~rQ~09sXA9As!0Cz&1Jq(#e1jAS#b;3jF<^5uNW_d zK5*#xk#TfU8{n6FDnf@3a>;-_GD)=uoozv?b>wKe#SBTW_dxtrGLb9bFsT zAWIC?e!+=)5#N`1s>Hq=cPsJYiL~M;D^pDhB{dv6;v;2t6Fz}kKM${~_V3E5LfsyDRnrCHH|0znuCTgjAL*K;M_~k5pYikgjgfl>e1W6mnFUal#45Oy4odNL| zfs5eQVWi6+qNYQTO%J^tOz%z+yZ$ z=!2boQciv~|D^!cBXH&*cn)n>&i;Oq&xXYAth{t517=f3{np2v+UQd4b&1ZI+3(@o zE?#bdTZ)u8&bjsh7i{u;3jcg_>FDpW9q0g}9cEiMyjx9G^{?>eGrzjd0FYDD(n<%k z3XEp?u&oo|piZdqdFftHPEA?#l*kL}^)op4 zq5Jd#`>vU1*E+S@fU2`pB|gyk;Rr0rCQ(C%(I4njA{?%HoTj$cQsBEQAo!t}GI9`` zJkCH>t&H1JZr+<8&1wIlYx{fE5WcvAm`ik4Yy%@U;&Ax9Q&Ffi*?nU4R zlWMx2?%J@$hu^wQTHHju$ay0Fs$d!0O%K)WdF7HVYb0u5hOdPHwl#11$hBg-!}BB_ zL(-aT*FrmL7s*L4Tdln@-?~kzvC5_2%b6=fqCIAh9ABB78r1ruVlFj$pr>`paSph8 zEZ+3P;G&3(Ho#rrUiaVa-&!NC@l#j$!)&08#zx(JVuk>vN9yr{6?hSO7Nt^g(G~;h z2zp!NxCnnXcd+PwG`V7TrVT+nHgh5}jJU0NZnWc%OY?+0gZA5uf`ZzEnC)cFxy>b( zoM^`^5xkOS?Q`*RQdHJNrIqu~+p#t43q4<+A6T0TH;5zY=0^xwsD4p)f-L<2g;D|3 z2)r(jq%pux2FcYBle0#qrm28b=}b&bqXt*VB^^-l=62D>)Q=6Z+mwd>8@ob~D%4kO`b@4s9v}>@>l0nn?9)tRVM8|+l zQD)9WIL7flhmS)`jIQbIXl2?hKiu3e7nt6!#V(uu+HG-?Yj{yb4p&b(S)FyU&YARZ zqx@X$ay_bA!2|4RF(C~jpVIrGIIVP;UTe&iYpRfn1Nq7)v1CoJ!+?}k0bw5#AG$6r zZSd#ihmW8jg%o%Z>fKOo&CIg0n+Z%jkR}i`1^?1K8$0tzX?Hp#i+{x)2wRl<)x^tp;wYZ$+?S$F5JD#7KmN=5U*RJ3X3MHqy>ww4TOj`)M?S@?S z-mDX7c1f$rPwP3!T$0~ZrKH=y?=|Bq*06xY``s$ogRpl?hDKME>9yw(?6Bh!eZe1U zqOMEfdP$IN8%6eXnx)!SG$*z9-sO5t3&nD}qcSB3BS2BL&ahAk`l`H; z-x9jDTxQNooeYWNmQDxTX_rWA`aHTwb>q{Df5ToN>)mjxBxgLhM%Lk&u9iu87!^zY zii~~9OC3p9<<7gX5R2?m{R7L8a12Y{x3+{Mt`Isb&1qhZpXoq6_4W1mwi&Cej_D>e zi|5p%wb@ex^u-oksa(Rs>VPAH_qhL(OJmKct-YLs(NxDZ_5Sk1FrTdF{2@TrP^6GF zg#g9{a!8NdC?Z)yvgg$<0Gwo3Lzxy~+B8=L4~_F&5+5^idCs*h$(Gxn(EP1)aj|}@1;VEV?vM+UG(2E$@qS&G(Q>TOvRVXqW576A^9_oBI>=?qX{RLuJ#!PyOae1WaHB< z&gX@l#3JUH49zV7BOgD0Oa^{HBN!SHnHd=>5W{~?OsK1>CRJ2akX89%1itG;5vN8@ zi@hDnK(ST0zQ^1pbotl}%QJFh=&{8vs`jY^HG@yj`eUx??&h+kL0fFtlT;12Fuom4 z_Z})o50475jjWOq4Iq((H_}p4evI1#1rtr@`n{pycRj=W0gDyyQ9yibY-m>F`9mxe zikTGhj1`bwQLC76i`ikpOQ+z(nBYV2s>0UBFf}t{1+~&vFm*GSjCKvr z$P^b8{juoUJmqMyG*mu6io=P~c1U-ZI%utm|FcnIMl5GKB0`k$h5g1fAgGg20=U~%$NUSez+_*6yxk0=O zE{oJ`SK_@?>HTB`O@Rb={7dD(lZUH}1zFQp&Mqo%L;7j@X%~D6>P)CY}t-Xw#Q}2U=(yV1F5P$8Z6S zM|#DUp}@Q0#{&SgfVn!nH-;Nd%EE=ue;+7JmoGhGj4iSm6akQv4lEIXn5df$Nr&jq zr9*w14i+HQZ0C-6kre^?ITPaq;Da>7ZL%DV$4S*2aR9B0-N~kleV=8Z(a@W3SS#ed zVhlKy7-f}v)a5O5c8v*Ng$YUb26S{ znpzNY(TRM8gAV0-*REcD1kvL5S#o%Md>(KKz==eU`@_|~XwR2CU+B(wyj92VlZfg*I`Eff1wz%E(N8uy9&u+2X43(+iHtYB~QNS}IPz&(-Q7EG% zX9c*pxPTIpv=e4zVuAo-@dJBlW-%&O_UaKnNTWbN18sqgVtfzW;UkD>Ai!XU#x#)X zufOjHLPxbUMkWl32V_AZ6^*Q&@erL*>B$*1wo$_% z$Kj);EV-t3wP{I2iZb~pO4ZS^fb++kvn9-On)Ee*T~Y@Nz}c}?#t+zTPK4wJFOf(i ze507X^tqS-(MGSO0?p8mU~IHQ-I)i<%7k?jeqt;p%J!&H(5hHe(H`2{ZZR79*-xrL z+ts71c2*-H9T>%lu9^SBz(N9 zjGsF0$=hRc+-;R(k1+5{eqs;Jr+M3xI@7;XzFBHF$FkR!?*2qHNYqjZ2s~2rO-(Z4 zx~OPr9ih~{nrR|LnTE!G8G?6qRh1s%VaUiYO1N4;@wLz9sp;irZ-O3z_*m$>Ew+vP zU9wH%MNDsHMns&2ba{`NnfXF`&GuPg%a6%pchWBD=V@Y{p}8LaA!-LWmU-B4VZUih zkL5Zh-fc)2MHXF`!KCnYhLJI9JAh%Pz9uH-97@rU6FM*8meVzV|Gi&uvv1LL3RwE> zr$$D2E1+c~1_Sl$roktG%LoFB^KY+5^y@u$b@8m@eeGdi6RHm_>D_*u;A3ZfwyL#ALSEIrU6N2C9{m8ME`EK;{!svRpD!>;q z+HKgSrgX%E`(tTm3L~H1ET|OrrX?VT`}zF+x!<}5NZL=s!b3neNug>$)Pu{i|wTJ-( zwRSS#*`m!B8@IcLxi|0*Mr93VpQ{o@bENf{YA8`>)|g7zUF2Do)RdMG-x>??I5_T znx39sdz5CLe$Myr-xFqXa&pw6pAI3PXAl;H69qFx$`hctQwW!VxJDurc!a0lKvrt1 z9Aw|)eNqlT@AY(dM_@Q^+TTXr=iw=;QW6#xo<4aWBNC0@sm4(E!n{9!{;Y%Z@y>E# zmQ0r09vB$#C2MMGDp<}lSFiQz@@`K|Oqdk*7kO{HLUfOAYd0WQw7v#ZiTGVn$91>~ zLN$p*^Ny_rzkNIR3*i!5Q*8fiREiZ(k@Q?QA1ZSY*V?oA;v>IxE_Txq7evZc`R{7Q zBjKD-j&YOfQ!gNGISaCkh1(y%af5hDjiBeG=obXq9frOzNJ+3q@DTzskn_SQ#(M#V zPZ7SDpPw-K<3pRpRl(PB!VE~M9IO8d93rjGX>w);A=YE)fGN&|T?dskd^yEwAj@m$ ziZ(?0N?-faCk9iKlKwKEm5Mejf$=l_Z7b-v(9Dlh0~HL2hc1!o+xD+Fv^?xxAC=-l ziPu!h5mSdU6$`t1>=TrhDyQe6x{S5mk@G86yLS2Vo}Q#^3kki#!4Mj7)-lKvs-fJ>=-proXMLOtO(HJhBCZUXMz>4le% z(;J8bldhG*9;>sAGgnS3?ftF7gf!LF-@=3=_QpY1u+(WSz zewkeJI50g{yjlSS_)DGAqsD-8{1`ZTe|)&&qCIrASqf~q=6JkUm^+*p|3CwU{mZZ3 zvW3K$vBE^>;EhYDnt4RJIIgpIXtaL2F;Gs9q*-^ zm7Z)fAdh39zX1zW@G=_~7p8u2)dPA#(R7w)g-wl(Y0r@y%f;6YHknyLMFFj$650en zJzN3;D&RcRRuj}1@j<63h~)N)6EScIK@rf8Z}A4qJDntmxI>h!ps@hxVUSw1HC94+ zQ=Hg->%Y{YL^r(FTG`|uizC(1VwV;Xr2v=%#^k;7;|eskiaFa(Hzqq~$Xq-;Eu9m+oq9sBF*Ab;JcKR-^lzcq zzgrn3%@hz49TM`yR^j2pBHCpDnSzZ9iZU`1T{1Q=d!`9OY8o0k`V-yV-HbEzkSbp4 zMC7r>kNl@Npxrec=>mWpl91=K#$7FDik;6Y(Op;8q2^}#gysOvb>n;hsxy5R)AQ0q znV1@F3td1WZXVIJ#ZScx2H#qF14hpUxgyzTF;dVBR^WkrFuOVkxJ<^60`U)iMuf(( zcp9BItUnD?QdgR?6>+B0Wi4Wyw*;YiQd0Fppf*Hdg$(CDgn4U9kt2dU*Ne~AZ|z`e zg?xVeiAYt8e0H}Oas0>3%%G>8nVsDYY~q1+3WEVC#4yZ%&%>pC>2ynv8AEtPDi^4; zoa+=H3r{B+L~JkoQ);pb!BjRcDPPStQ-+l`2kiGQC`c+k1!I*AO+#4km|7@o&+;Ma zj-rIYmJ5PBfG;%l-BVJP<8wKrb|ba|SP}!t94eHa$1h4s72goxa*aN_w34gsGKjau zh&i=7^)TU}gMknL*t<0=h%%}j?Ob`gH_t$t7sQ^BK0Ma@%|at1Ga@WT2~3!0GKZ-p zsFA?I+kZw1gbee<1j;|ynEG!iwsMD*v zRDLmJxb_J753M?dn15`3tO@xAPUOVBW-+A;$}#~#Tbz4HhJEM=D;MkJiNC}$2;8qzlcAg!jWn+2UuG)NG) z+Ne9qi0CnqkD_}K>E3u2Ay=V=@}lKe^yrQpj)J#ag%Tybpggk?Cov~d#*1$3U~avjKS6HtTY!4E=CC$ zz2=+)W={izyK(_%6QiP7nrqfQ0O*}Lbqa)a`)KS1=GWoYFF1B?OK*Ndi%GK{Gf@IbOa%O0U)Onrr0t%?L%nHR+Il=xEj%IWO@ zq7bP=$P!)dm=eS;c@2eV4JmgD~|0j+^ZlsZSZ{8%BL8DNb z_J*_W_6A8*`sM?(*E-Dm>NcNLLv<@?|GmC`9&B;!2*X|gL;K!LA6NoVW(z|Ym`_DU z<^}t+v3-CSP*_mNve^e1v*pejyl?;=^j`>UDK0JsK_Y@FTnK143*eE$>{Zm%l7}nZ ztbj=e4K)r{hGn(Z1MCF7Ui|sxm1ce`P|_kjK!^l+wSEi;{WMVHU8!xSK(J^nlmE2- z;xNMl%VS6C$=Bn8Prdo;ufKQ(Q&Jh$_QpFmEoqIGu$YMJ-^|GEbEE;Qyc4s$YdAUb z%#)YK6W(JS>{gbRJR9a!QgWNi4EZp=JDwgO2*nQsvrAeY3PIchOpe@LBUg`kRlCHj zFXdDa!XqLh0XeqE9%W|j%K--3s#0A~`aIlT1*g@0Tadnfg2{zcrF_iW&G6|}9v}@(?!mBx` z#oP041D#f|YI~OBT|*#in!`jr7sxb0D2J>VC9wcBcNgUXuFJfn9=4$BS4|7wR|Q!t zW&8a_dBjJZs0b4bFUVftEnwx4?$awUhjS;R5Wj{5sE}}!fkE`Z-FPW)=U-!YLc_zO zt2uMfY30-8F+SXmqhQPyDH;}m!m}&w#d^p1`9m)nvI~B~hw?H_ zidw|A7$Uz;_hh3hdt)w=k!KEO+Y?Ps;A@|Hdsl<8EPWc+Ii`C+l%1nns^cL6q0_Jx zMYo>lji>>wt&6((W9O!32TSunEo?FO*>X-CFU-+o)@`*KBLw9`8bp1a5|~8qLfvYf z1JLp;uoSL~11TWU%Q3)>9G8H;|1G8#y*1DeZ}hCE6b*iLgttB(Cb19No#Kh}z&vEEPm(?)WR zI(^`yZZ99~*RxUPtGV|TIn;JN^`ZYH^yCYTf+Bu~hnXPg!KRPdby47NAFuV(jhQe# zPNb`!6{BP9MZ5__FQ9WCI#=I6;1V_J30loBUYSqYhRec|eZ@gc(f71H#5mH-Q!@$UKO+vBrlq zpwHJbD|URH=R~1dTgh=xo4w;8mYeeL)!mZN3aobuIsL1G!XRV4w?#QDO!bCUTca^_kySt`CQI&eq7vf@=brM zmbKy5>Reb9L>;pbOXvl$77`abb_Z56`7Q?LnpW@fD)AIKAzU{rY<5%=RQRZS^^|}sO2!Cq=RY`OloFh}kzl(^f;y#{Rnm&qI8dm5|8g0F|Eq^?lMrYOkbCL@!9tc)o)iqBRb_e%Oyrrvk%ryY!wtE1Rm? zlUYD`afk#_GuMOiGBa-kFO%H8Abj!?qHnnuz}_%9D!=C+xQS!@8m1@uE%$S}ESWHf z(KpQBr~@bg;KsVHzFudkc2*r2&H~z#)HwVT$acIkYXKW?s9t$b+Bz|pz5{AFyqF>E zVK7K`gH13yyn^wD2ew=&Q{f8Oa*y<6-|daxn}D*N1Oay*39x2|XugzcM*yc&+yhc^ zzQAh7bdS}tUlQGMK3j8k!%Q;LD~%TsO&Imd#Lh30Frtf!lJMRtD)Fh&)eL4Hc^XY8 zZMcsK#PbzbUA)vxpCb7s-WOw_TVedb;#X^k3T=YSn&T|mR)oJIUlNJlq!hGM6CM~fV`3^ zG{vjh+U82_Z5lyV|1q&V`(B=11&A2X9lYU25Hz0`?Tw;lM1~EGwa7c%&}f0Dj@sXy z;huCB2Nk7VNua+!o%%nlekZW{W8eOzp-u)k0=>AVMOSWk^a&a|ARFD+04zBd)b*-e zLj}MmK{v!rJGdWOq89oc(maER8U}!_SwTKmO4piA3l07$GV?5U7IE0%V=2PLQX33=b#F zdED^dAeOJZ2%~WY)kIP4VBegRTQ77p2exM$A0bZ&`r5v}{W<{(aTj=?2nkD|6$Y8l z=Np28ypo_USHKE^>eQ+6DLg9zS&EZOOiUXJbe#%ki*VY44Og!m5E^KC)Q&_5r+57p zlH7d-7u3ksN(8a70>bJ8VP?DpVx{+8b00a^NTUW2#wsR)B#J;rhEjztM!yI*w*n## z3*$Gi?H@T+l1?%=W34uHtEo_?R;P^Ycz&I14h0EAXXH3WqB?Lu6QhbnbPUb*U-Dn6 zPm>U32xwcd`~4n>NatPxl>^VrGHGg?m}}(WwyiQOk(dYVUvu`Z-jgk}3zlpaH`$7I z`>N2`&+)|a0Te&83~K$`D}>P5s#A7npB(_VjK>V)6gghPj^ zFX*Rq?5w38lLKp$_D?rb=ybJGHlJ6wtV^>q<$#zde`um)_e6!y{f}P$KY0wZb7mY# zFKa-RWF-)AP{PM*+Wy45r3}ztz3&!^=MzuzyA(hnaK|1EggKuNxo`yJioi*MmUteR zfCAba5TgP4*>Zzc0Nmc6iC@I;`U4O+!jqPo2**iBS83ds#0lCYL>DIh%NKcgv^3^7hNHJc(opgW)ug$n2}-+4T%S)C*FlB>#S0 zjmXKs?Ze{AMNLl}D{BA=1TW#{;7q5UZo{a%OHq0H4^RSieWDHt8TXVKP(4Uh;yR$p zqOGQfZdvIm8Akp;U~U?1acrJIIi?|x)isO2Qta&P_?Gz5vvqYmXTX6@zPaGf^nBleL(cPQ zVz7B$zNAIkGw_UX>FP(&;LQ8;*E|BjLpgrY6?yu%;AJkTQsL1rgx~{OCu|-4183HN z*)%j;@ODo2xwX`Cy{hK@s7lZCAcn&Ku|~&aHaRgxR?*diRd;cGe!~R2$}}`@y8#~=6#tUbB;_V zgGQP^@LWG7bgh1Rv4H2^1!27QJ0iyg)H{wo1tfTNPFpjEn2+?HRk~?2nKDp<`+6gf z*s8g~Rrm}OJ=5}E^fxE%W2i0-(~F&m0B6RD*+1$mo%vapg)Hg*`FFu=?tBp4T8Kq1 zJKx;sBj`dw%=T?)qdxl%Z2N&uR|p|IYmkh+1_g{y-NDC75O((Rr$=SNK&S!9JYiJk zGO9V8KiqlRvyl&;BUR#e=NDc(iRa$(GdXjYn)niOO$THmtpT`j((sI(lyZyKnf4>{ zZJ``$ecw{q6JS57#S0Etvs&kVB+r|dix7yg9m720L0|KpDnZQzMINXUjo1fws_?Mu zBkBBv@(M4-dh_M5NpHSQ?GX$le2L%}U3(=7iq8A(9?@-|V8ELqzn{h{VX?^_O8Klw zuO7_KVFWiCC}{Fy!= zp#Z{+jj%5QQntnag>Nj}m3Bc%fAYqEQPS5R*XHHo=6?K-POQkRjUAxvLJXb*!8a8W z`w4nEWu+KIa2W^[Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] -There are three alert severity levels, described in the following table. - -Alert severity | Description -:---|:--- -High (Red) | Threats often associated with advanced persistent threats (APT). These alerts indicate a high risk due to the severity of damage they can inflict on endpoints. -Medium (Orange) | Threats rarely observed in the organization, such as anomalous registry change, execution of suspicious files, and observed behaviors typical of attack stages. -Low (Yellow) | Threats associated with prevalent malware and hack-tools that do not appear to indicate an advanced threat targeting the organization. - -Reviewing the various alerts and their severity can help you decide on the appropriate action to protect your organization's endpoints. - -Alerts are organized in three queues, by their workflow status: - -- **New** -- **In progress** -- **Resolved** - -To begin investigating, click on an alert in [any of the alert queues](alerts-queue-windows-defender-advanced-threat-protection.md). - -Details displayed about the alert include: -- When the alert was last observed -- Alert description -- Recommended actions -- The incident graph -- The indicators that triggered the alert +You can click an alert in any of the [alert queues](alerts-queue-windows-defender-advanced-threat-protection.md) to begin an investigation. Selecting an alert brings up the **Alert management pane**, while clicking an alert brings you the alert details view where general information about the alert, some recommended actions, an alert process tree, an incident graph, and an alert timeline is shown. Alerts attributed to an adversary or actor display a colored tile with the actor name. @@ -56,6 +33,19 @@ Some actor profiles include a link to download a more comprehensive threat intel ![A detailed view of an alert when clicked](images/alert-details.png) +## Alert process tree +The **Alert process tree** takes alert triage and investigation to the next level by displaying the alert and its evidence with other events that occurred in the same execution context and time. This broad triage context of the alert and surrounding events is available on the alert page. + +![Image of the alert process tree](images/atp-alert-process-tree.png) + +The alert process tree expands to display the execution path of the alert, its evidence, and related events that occurred in proximity - before and after - the alert. + +You’ll see markers (thunderbolt icon) that indicate related events. + +>[!NOTE] +>The alert process tree might not be available in some alerts. + + ## Incident graph The incident graph provides a visual representation of where an alert was seen, events that triggered the alert, and which other machines are affected by the event. It provides an illustrated alert footprint on the original machine and expands to show the footprint of each alert event on other machines. diff --git a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md index 128ba65c86..23dd994d46 100644 --- a/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/investigate-machines-windows-defender-advanced-threat-protection.md @@ -23,8 +23,6 @@ localizationpriority: high [Some information relates to pre-released product, which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.] - - ## Investigate machines Investigate the details of an alert raised on a specific machine to identify other behaviors or events that might be related to the alert or the potential scope of breach.