From dc2a78cf52d500445b5d345d50a01b374ff9772d Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 22 Oct 2020 08:28:05 -0700 Subject: [PATCH] Update automation-levels.md --- .../microsoft-defender-atp/automation-levels.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/automation-levels.md b/windows/security/threat-protection/microsoft-defender-atp/automation-levels.md index 31a8dc069f..6601b6222a 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/automation-levels.md +++ b/windows/security/threat-protection/microsoft-defender-atp/automation-levels.md @@ -25,7 +25,12 @@ ms.custom: AIR # Automation levels in automated investigation and remediation capabilities -Automation levels determine whether remediation actions are taken automatically or only upon approval following an automated investigation. Microsoft Defender for Endpoint offers several levels of automation. This article describes the various levels of automation and includes recommendations to consider. +Microsoft Defender for Endpoint offers several levels of automation for automated investigation and remediation (AIR). Automation levels determine whether remediation actions are taken automatically or only upon approval following an automated investigation. +- Full automation (this is recommended option) means remediation actions are taken automatically. +- Semi-automation means some remediation actions are taken automatically, but other remediation actions await approval before being taken. +- + +This article describes the various levels of automation and includes recommendations to consider. > [!TIP] > For best results, we recommend using full automation when you set your level of automation. Data collected and analyzed over the past year shows that customers who are using full automation had 40% more high-confidence malware samples removed than customers who are using lower levels of automation. Full automation can help free up your security operations resources to focus more on your strategic initiatives.