check in edr overview content

windows/security/threat-protection/windows-defender-atp/alerts-queue-endpoint-detection-response.md

@@ -0,0 +1,32 @@
+---
+title: Alerts queue in Windows Defender Security Center
+description: View and manage the alerts surfaced in Windows Defender Security Center
+keywords: 
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 09/12/2018
+---
+
+# Alerts queue in Windows Defender Security Center
+Learn how you can view and manage the queue so that you can effectively investigate threats seen on entities such as machines, files, or user accounts.
+
+
+## In this section
+Topic | Description 
+:---|:---
+[View and organize the Alerts queue](alerts-queue-windows-defender-advanced-threat-protection.md) | Shows a list of alerts that were flagged in your network.
+[Manage alerts](manage-alerts-windows-defender-advanced-threat-protection.md) | Learn about how you can manage alerts such as change its status, assign it to a security operations member, and see the history of an alert.
+[Investigate alerts](investigate-alerts-windows-defender-advanced-threat-protection.md)| Investigate alerts that are affecting your network, understand what they mean, and how to resolve them.
+[Investigate files](investigate-files-windows-defender-advanced-threat-protection.md)| Investigate the details of a file associated with a specific alert, behaviour, or event. 
+[Investigate machines](investigate-machines-windows-defender-advanced-threat-protection.md)| Investigate the details of a machine associated with a specific alert, behaviour, or event. 
+[Investigate an IP address](investigate-ip-windows-defender-advanced-threat-protection.md) | Examine possible communication between machines in your network and external internet protocol (IP) addresses.
+[Investigate a domain](investigate-domain-windows-defender-advanced-threat-protection.md) | Investigate a domain to see if machines and servers in your network have been communicating with a known malicious domain. 
+[Investigate a user account](investigate-user-windows-defender-advanced-threat-protection.md) | Identify user accounts with the most active alerts and investigate cases of potential compromised credentials.  
+
+

windows/security/threat-protection/windows-defender-atp/machines-list-endpoint-detection-response.md

@@ -0,0 +1,19 @@
+---
+title: Machines list in Windows Defender Security Center
+description: View and manage the machines list in Windows Defender Security Center
+keywords: 
+search.product: eADQiWindows 10XVcnh
+ms.prod: w10
+ms.mktglfcycl: deploy
+ms.sitesec: library
+ms.pagetype: security
+ms.author: macapara
+author: mjcaparas
+ms.localizationpriority: high
+ms.date: 07/01/2018
+---
+
+# Machines list in Windows Defender Security Center
+Learn how you can view and manage the machines list, manage machine groups, and investigate machine related alerts. 
+
+## In this section 

windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response.md

@@ -1,16 +1,34 @@
 ---
-title: Overview of endpoint detection and response
+title: Overview of endpoint detection and response capabilities
-description: Learn about the endpoint detection and responsecapability in Windows Defender ATP
+description: Learn about the endpoint detection and response capability in Windows Defender ATP
 keywords: 
 search.product: eADQiWindows 10XVcnh
 ms.prod: w10
 ms.mktglfcycl: deploy
 ms.sitesec: library
 ms.pagetype: security
-ms.author: v-anbic
+ms.author: macapara
-author: andreabichsel
+author: mjcaparas
 ms.localizationpriority: high
 ms.date: 09/12/2018
 ---
 
-# Overview of attack surface reduction
+# Overview of endpoint detection and response 
+
+
+The endpoint detection and response capabilities in Windows Defender ATP continuosly monitors your organization for possible attacks against systems, networks, or users in your organzation. It helps detect, investigate, and quickly respond to threats.
+
+The detection capability finds the attacks that made it past all other defenses and surfaces them through alerts. 
+
+The platform provides various ways for you to investigate an incident and allows you to pivot in various views to help you approach an investigation through multiple possible vectors. 
+
+The response capabilities gives you the power to prompty remediate threats by taking action on the affected entities. 
+
+## In this section
+
+[Alerts queue](alerts-queue-endpoint-detection-response.md)| View the alerts surfaced in Windows Defender Security Center.
+[Machines list](machines-list-endpoint-detection-response.md) | Learn how you can view and manage the machines list, manage machine groups, and investigate machine related alerts. 
+[Take response actions](response-actions-windows-defender-advanced-threat-protection.md)| Take response actions on machines and files to quickly respond to detected attacks and contain threats.
+[Query data using advanced hunting](advanced-hunting-windows-defender-advanced-threat-protection.md)| Proactively hunt for possible threats accross your organization using a powerful search and query tool.
+
+