From dce8ef8bb3c4eadb4ce2c66c16e16feff18ef527 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Sun, 12 Aug 2018 17:13:08 -0700 Subject: [PATCH] check in edr overview content --- ...lerts-queue-endpoint-detection-response.md | 32 +++++++++++++++++++ ...chines-list-endpoint-detection-response.md | 19 +++++++++++ .../overview-endpoint-detection-response.md | 28 +++++++++++++--- 3 files changed, 74 insertions(+), 5 deletions(-) create mode 100644 windows/security/threat-protection/windows-defender-atp/alerts-queue-endpoint-detection-response.md create mode 100644 windows/security/threat-protection/windows-defender-atp/machines-list-endpoint-detection-response.md diff --git a/windows/security/threat-protection/windows-defender-atp/alerts-queue-endpoint-detection-response.md b/windows/security/threat-protection/windows-defender-atp/alerts-queue-endpoint-detection-response.md new file mode 100644 index 0000000000..2e5a7f7600 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/alerts-queue-endpoint-detection-response.md @@ -0,0 +1,32 @@ +--- +title: Alerts queue in Windows Defender Security Center +description: View and manage the alerts surfaced in Windows Defender Security Center +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 09/12/2018 +--- + +# Alerts queue in Windows Defender Security Center +Learn how you can view and manage the queue so that you can effectively investigate threats seen on entities such as machines, files, or user accounts. + + +## In this section +Topic | Description +:---|:--- +[View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) | Shows a list of alerts that were flagged in your network. +[Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) | Learn about how you can manage alerts such as change its status, assign it to a security operations member, and see the history of an alert. +[Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)| Investigate alerts that are affecting your network, understand what they mean, and how to resolve them. +[Investigate files](investigate-files-windows-defender-advanced-threat-protection.md)| Investigate the details of a file associated with a specific alert, behaviour, or event. +[Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md)| Investigate the details of a machine associated with a specific alert, behaviour, or event. +[Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) | Examine possible communication between machines in your network and external internet protocol (IP) addresses. +[Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) | Investigate a domain to see if machines and servers in your network have been communicating with a known malicious domain. +[Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md) | Identify user accounts with the most active alerts and investigate cases of potential compromised credentials. + + diff --git a/windows/security/threat-protection/windows-defender-atp/machines-list-endpoint-detection-response.md b/windows/security/threat-protection/windows-defender-atp/machines-list-endpoint-detection-response.md new file mode 100644 index 0000000000..8212c698cd --- /dev/null +++ b/windows/security/threat-protection/windows-defender-atp/machines-list-endpoint-detection-response.md @@ -0,0 +1,19 @@ +--- +title: Machines list in Windows Defender Security Center +description: View and manage the machines list in Windows Defender Security Center +keywords: +search.product: eADQiWindows 10XVcnh +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.author: macapara +author: mjcaparas +ms.localizationpriority: high +ms.date: 07/01/2018 +--- + +# Machines list in Windows Defender Security Center +Learn how you can view and manage the machines list, manage machine groups, and investigate machine related alerts. + +## In this section diff --git a/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md b/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md index 69d44177fa..c2823e975b 100644 --- a/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md +++ b/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md @@ -1,16 +1,34 @@ --- -title: Overview of endpoint detection and response -description: Learn about the endpoint detection and responsecapability in Windows Defender ATP +title: Overview of endpoint detection and response capabilities +description: Learn about the endpoint detection and response capability in Windows Defender ATP keywords: search.product: eADQiWindows 10XVcnh ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security -ms.author: v-anbic -author: andreabichsel +ms.author: macapara +author: mjcaparas ms.localizationpriority: high ms.date: 09/12/2018 --- -# Overview of attack surface reduction \ No newline at end of file +# Overview of endpoint detection and response + + +The endpoint detection and response capabilities in Windows Defender ATP continuosly monitors your organization for possible attacks against systems, networks, or users in your organzation. It helps detect, investigate, and quickly respond to threats. + +The detection capability finds the attacks that made it past all other defenses and surfaces them through alerts. + +The platform provides various ways for you to investigate an incident and allows you to pivot in various views to help you approach an investigation through multiple possible vectors. + +The response capabilities gives you the power to prompty remediate threats by taking action on the affected entities. + +## In this section + +[Alerts queue](alerts-queue-endpoint-detection-response.md)| View the alerts surfaced in Windows Defender Security Center. +[Machines list](machines-list-endpoint-detection-response.md) | Learn how you can view and manage the machines list, manage machine groups, and investigate machine related alerts. +[Take response actions](response-actions-windows-defender-advanced-threat-protection.md)| Take response actions on machines and files to quickly respond to detected attacks and contain threats. +[Query data using advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)| Proactively hunt for possible threats accross your organization using a powerful search and query tool. + +