From e85f8f6b9f651cb8b1c1d70a325ce098e2b14918 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 3 Dec 2020 15:51:40 -0800 Subject: [PATCH] Update automated-investigations.md --- .../microsoft-defender-atp/automated-investigations.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md index e9d90eeff3..9c9e381e83 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md +++ b/windows/security/threat-protection/microsoft-defender-atp/automated-investigations.md @@ -99,7 +99,7 @@ The following table shows the relationship between PUA protection and automation |PUA protection setting
(Microsoft Defender Antivirus) |PUA protection enabled
(AIR) |PUA protection disabled
(AIR) | |---------|---------|---------| |Enabled |PUA remediated by Microsoft Defender Antivirus and/or AIR |PUA remediated by Microsoft Defender Antivirus | -|Audit mode |PUA remediated by AIR |PUA detected but not remediated | +|Audit mode |PUA remediated by AIR |PUA detected but not remediated if **Allow or block file** is turned on

PUA remediated if **Always remediate PUA** is turned on | |Disabled |PUA remediated by AIR |PUA not remediated | To configure PUA protection in AIR, go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in. Choose **Settings** > **Advanced features**, and then turn on **Always remediate PUA** (or **Allow or block file**).