mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-25 03:37:23 +00:00
Merge branch 'master' into m3d-converged-win
This commit is contained in:
Daniel Simpson
GitHub
commit
f034c0d7ba
@ -44,7 +44,8 @@
|
||||
"folder_relative_path_in_docset": "./"
|
||||
}
|
||||
},
|
||||
"titleSuffix": "Windows Application Management"
|
||||
"titleSuffix": "Windows Application Management",
|
||||
"searchScope": ["Windows 10"]
|
||||
},
|
||||
"fileMetadata": {},
|
||||
"template": [],
|
||||
|
||||
@ -46,7 +46,8 @@
|
||||
"folder_relative_path_in_docset": "./"
|
||||
}
|
||||
},
|
||||
"titleSuffix": "Windows Client Management"
|
||||
"titleSuffix": "Windows Client Management",
|
||||
"searchScope": ["Windows 10"]
|
||||
},
|
||||
"fileMetadata": {},
|
||||
"template": [],
|
||||
|
||||
@ -44,7 +44,8 @@
|
||||
"folder_relative_path_in_docset": "./"
|
||||
}
|
||||
},
|
||||
"titleSuffix": "Configure Windows"
|
||||
"titleSuffix": "Configure Windows",
|
||||
"searchScope": ["Windows 10"]
|
||||
},
|
||||
"fileMetadata": {},
|
||||
"template": [],
|
||||
|
||||
@ -49,7 +49,8 @@
|
||||
"folder_relative_path_in_docset": "./"
|
||||
}
|
||||
},
|
||||
"titleSuffix": "Windows Deployment"
|
||||
"titleSuffix": "Windows Deployment",
|
||||
"searchScope": ["Windows 10"]
|
||||
},
|
||||
"fileMetadata": {},
|
||||
"template": [],
|
||||
|
||||
@ -46,7 +46,8 @@
|
||||
"folder_relative_path_in_docset": "./"
|
||||
}
|
||||
},
|
||||
"titleSuffix": "Windows Privacy"
|
||||
"titleSuffix": "Windows Privacy",
|
||||
"searchScope": ["Windows 10"]
|
||||
},
|
||||
"fileMetadata": {},
|
||||
"template": [],
|
||||
|
||||
@ -47,7 +47,8 @@
|
||||
"folder_relative_path_in_docset": "./"
|
||||
}
|
||||
},
|
||||
"titleSuffix": "Microsoft 365 Security"
|
||||
"titleSuffix": "Microsoft 365 Security",
|
||||
"searchScope": ["Windows 10"]
|
||||
},
|
||||
"fileMetadata": {
|
||||
"titleSuffix":{
|
||||
|
||||
@ -377,8 +377,9 @@
|
||||
###### [Download or collect file](microsoft-defender-atp/respond-file-alerts.md#download-or-collect-file)
|
||||
###### [Deep analysis](microsoft-defender-atp/respond-file-alerts.md#deep-analysis)
|
||||
|
||||
#### [View and approve remediation actions](microsoft-defender-atp/manage-auto-investigation.md)
|
||||
##### [View details and results of automated investigations](microsoft-defender-atp/auto-investigation-action-center.md)
|
||||
#### [Visit the Action center to see remediation actions](microsoft-defender-atp/auto-investigation-action-center.md)
|
||||
##### [View and approve pending actions](microsoft-defender-atp/manage-auto-investigation.md)
|
||||
##### [Details and results of an automated investigation](microsoft-defender-atp/autoir-investigation-results.md)
|
||||
|
||||
#### [Investigate entities using Live response]()
|
||||
##### [Investigate entities on devices](microsoft-defender-atp/live-response.md)
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedfeats-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
Use the `AssignedIPAddresses()` function in your advanced hunting queries to quickly obtain the latest IP addresses that have been assigned to a device. If you specify a timestamp argument, this function obtains the most recent IP addresses at the specified time.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-bestpractices-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
@ -41,8 +41,8 @@ For information on other tables in the advanced hunting schema, see [the advance
|
||||
| `ReportId` | long | Event identifier based on a repeating counter. To identify unique events, this column must be used in conjunction with the `DeviceName` and `Timestamp` columns |
|
||||
| `NetworkAdapterName` | string | Name of the network adapter |
|
||||
| `MacAddress` | string | MAC address of the network adapter |
|
||||
| `NetworkAdapterType` | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2) |
|
||||
| `NetworkAdapterStatus` | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2) |
|
||||
| `NetworkAdapterType` | string | Network adapter type. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.networkinterfacetype?view=netframework-4.7.2&preserve-view=true) |
|
||||
| `NetworkAdapterStatus` | string | Operational status of the network adapter. For the possible values, refer to [this enumeration](https://docs.microsoft.com/dotnet/api/system.net.networkinformation.operationalstatus?view=netframework-4.7.2&preserve-view=true) |
|
||||
| `TunnelType` | string | Tunneling protocol, if the interface is used for this purpose, for example 6to4, Teredo, ISATAP, PPTP, SSTP, and SSH |
|
||||
| `ConnectedNetworks` | string | Networks that the adapter is connected to. Each JSON array contains the network name, category (public, private or domain), a description, and a flag indicating if it's connected publicly to the internet |
|
||||
| `DnsAddresses` | string | DNS server addresses in JSON array format |
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
[Advanced hunting](advanced-hunting-overview.md) relies on data coming from across your organization. To get the most comprehensive data possible, ensure that you have the correct settings in the corresponding data sources.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
The `FileProfile()` function is an enrichment function in [advanced hunting](advanced-hunting-overview.md) that adds the following data to files found by the query.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
With the *go hunt* action, you can quickly investigate events and various entity types using powerful query-based [advanced hunting](advanced-hunting-overview.md) capabilities. This action automatically runs an advanced hunting query to find relevant information about the selected event or entity.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhunting-abovefoldlink)
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
# Take action on advanced hunting query results
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-advancedhuntingref-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-alertsq-abovefoldlink)
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
The Microsoft Defender for Endpoint API Explorer is a tool that helps you explore various Defender for Endpoint APIs interactively.
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-apiportalmapping-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -19,7 +19,7 @@ ms.technology: mde
|
||||
|
||||
# Microsoft Defender for Endpoint API release notes
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@ ms.technology: mde
|
||||
**Applies to:**
|
||||
- Azure Active Directory
|
||||
- Office 365
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-assignaccess-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-attacksimulations-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
## Is attack surface reduction (ASR) part of Windows?
|
||||
|
||||
@ -44,7 +44,7 @@ Yes. ASR is supported for Windows Enterprise E3 and above.
|
||||
|
||||
All of the rules supported with E3 are also supported with E5.
|
||||
|
||||
E5 also added greater integration with Defender for Endpoint. With E5, you can [use Defender for Endpoint to monitor and review analytics](https://docs.microsoft.com/microsoft-365/security/mtp/monitor-devices?view=o365-worldwide#monitor-and-manage-asr-rule-deployment-and-detections) on alerts in real-time, fine-tune rule exclusions, configure ASR rules, and view lists of event reports.
|
||||
E5 also added greater integration with Defender for Endpoint. With E5, you can [use Defender for Endpoint to monitor and review analytics](https://docs.microsoft.com/microsoft-365/security/mtp/monitor-devices?view=o365-worldwide&preserve-view=true#monitor-and-manage-asr-rule-deployment-and-detections) on alerts in real-time, fine-tune rule exclusions, configure ASR rules, and view lists of event reports.
|
||||
|
||||
## What are the currently supported ASR rules?
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
## Why attack surface reduction rules are important
|
||||
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
You can enable attack surface reduction rules, exploit protection, network protection, and controlled folder access in audit mode. Audit mode lets you see a record of what *would* have happened if you had enabled the feature.
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
---
|
||||
title: View details and results of automated investigations
|
||||
title: Visit the Action center to see remediation actions
|
||||
description: Use the action center to view details and results following an automated investigation
|
||||
keywords: action, center, autoir, automated, investigation, response, remediation
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -15,159 +15,67 @@ audience: ITPro
|
||||
ms.collection:
|
||||
- m365-security-compliance
|
||||
- m365initiative-defender-endpoint
|
||||
ms.topic: article
|
||||
ms.topic: how-to
|
||||
ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs
|
||||
ms.date: 09/24/2020
|
||||
ms.date: 01/28/2021
|
||||
ms.technology: mde
|
||||
---
|
||||
|
||||
# View details and results of automated investigations
|
||||
# Visit the Action center to see remediation actions
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
During and after an automated investigation, remediation actions for threat detections are identified. Depending on the particular threat and how [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection) is configured for your organization, some remediation actions are taken automatically, and others require approval. If you're part of your organization's security operations team, you can view pending and completed [remediation actions](manage-auto-investigation.md#remediation-actions) in the **Action center**.
|
||||
|
||||
## (NEW!) A unified Action center
|
||||
|
||||
During and after an automated investigation, certain remediation actions can be identified. Depending on the threat and how [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection) is configured for your organization, some remediation actions are taken automatically.
|
||||
We are pleased to announce a new, unified Action center ([https://security.microsoft.com/action-center](https://security.microsoft.com/action-center))!
|
||||
|
||||
If you're part of your organization's security operations team, you can view pending and completed [remediation actions](manage-auto-investigation.md#remediation-actions) in the **Action center** ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)). You can also use the **Investigations** page ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) to view details about an investigation.
|
||||
:::image type="content" source="images/mde-action-center-unified.png" alt-text="Action center in Microsoft 365 security center":::
|
||||
|
||||
>[!NOTE]
|
||||
>If your organization has implemented role-based access to manage portal access, only authorized users or user groups who have permission to view the device or device group will be able to view the entire investigation.
|
||||
The following table compares the new, unified Action center to the previous Action center.
|
||||
|
||||
## The Action center
|
||||
|
||||
|
||||
|
||||
The action center consists of two main tabs: **Pending actions** and **History**.
|
||||
- **Pending actions** Displays a list of ongoing investigations that require attention. Recommended actions are presented that your security operations team can approve or reject. The Pending tab appears only if there are pending actions to be approved (or rejected).
|
||||
- **History** Acts as an audit log for all of the following items: <br/>
|
||||
- Remediation actions that were taken as a result of an automated investigation
|
||||
- Remediation actions that were approved by your security operations team (some actions, such as sending a file to quarantine, can be undone)
|
||||
- Commands that were run and remediation actions that were applied in Live Response sessions (some actions can be undone)
|
||||
- Remediation actions that were applied by Microsoft Defender Antivirus (some actions can be undone)
|
||||
|
||||
Use the **Customize columns** menu to select columns that you'd like to show or hide.
|
||||
|
||||
You can also download the entire list in CSV format using the **Export** feature, specify the number of items to show per page, and navigate between pages.
|
||||
|
||||
## The Investigations page
|
||||
|
||||
|
||||
|
||||
On the **Investigations** page, you'll find a list of all automated investigations. Select an item in the list to view additional information about that automated investigation.
|
||||
|
||||
By default, the automated investigations list displays investigations initiated in the last week. You can also choose to select other time ranges from the drop-down menu or specify a custom range.
|
||||
|
||||
Use the **Customize columns** menu to select columns that you'd like to show or hide.
|
||||
|
||||
From this view, you can also download the entire list in CSV format using the **Export** feature, specify the number of items to show per page, and navigate between pages.
|
||||
|
||||
### Filters for the list of investigations
|
||||
|
||||
On the **Investigations** page, you can view details and use filters to focus on specific information. The following table lists available filters:
|
||||
|
||||
|Filter |Description |
|
||||
|The new, unified Action center |The previous Action center |
|
||||
|---------|---------|
|
||||
|**Status** |(See [Automated investigation status](#automated-investigation-status)) |
|
||||
|**Triggering alert** | The alert that initiated the automated investigation |
|
||||
|**Detection source** |The source of the alert that initiated the automated investigation |
|
||||
|**Entities** | Entities can include device or devices, and device groups. You can filter the automated investigations list to zone in a specific device to see other investigations related to the device, or to see specific device groups that were created. |
|
||||
|**Threat** |The category of threat detected during the automated investigation |
|
||||
|**Tags** |Filter using manually added tags that capture the context of an automated investigation|
|
||||
|**Comments** |Select between filtering the list between automated investigations that have comments and those that don't|
|
||||
|Lists pending and completed actions for devices and email in one location <br/>([Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md) plus [Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-atp))|Lists pending and completed actions for devices <br/> ([Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md) only) |
|
||||
|Is located at:<br/>[https://security.microsoft.com/action-center](https://security.microsoft.com/action-center) |Is located at:<br/>[https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center) |
|
||||
| In the Microsoft 365 security center, choose **Action center**. <p>:::image type="content" source="images/action-center-nav-new.png" alt-text="Navigating to the Action Center in the Microsoft 365 security center"::: | In the Microsoft Defender Security Center, choose **Automated investigations** > **Action center**. <p>:::image type="content" source="images/action-center-nav-old.png" alt-text="Navigating to the Action center from the Microsoft Defender Security Center"::: |
|
||||
|
||||
## Automated investigation status
|
||||
The unified Action center brings together remediation actions across Defender for Endpoint and Defender for Office 365. It defines a common language for all remediation actions, and provides a unified investigation experience.
|
||||
|
||||
An automated investigation can have one of the following status values:
|
||||
You can use the unified Action center if you have appropriate permissions and one or more of the following subscriptions:
|
||||
- [Defender for Endpoint](microsoft-defender-advanced-threat-protection.md)
|
||||
- [Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-atp)
|
||||
- [Microsoft 365 Defender](https://docs.microsoft.com/microsoft-365/security/mtp/microsoft-threat-protection)
|
||||
|
||||
|Status |Description |
|
||||
> [!TIP]
|
||||
> To learn more, see [Requirements](https://docs.microsoft.com/microsoft-365/security/mtp/prerequisites).
|
||||
|
||||
## Using the Action center
|
||||
|
||||
To get to the unified Action center in the improved Microsoft 365 security center:
|
||||
1. Go to the Microsoft 365 security center ([https://security.microsoft.com](https://security.microsoft.com)) and sign in.
|
||||
2. In the navigation pane, select **Action center**.
|
||||
|
||||
When you visit the Action center, you see two tabs: **Pending actions** and **History**. The following table summarizes what you'll see on each tab:
|
||||
|
||||
|Tab |Description |
|
||||
|---------|---------|
|
||||
| Running | The investigation process has started and is underway. Malicious artifacts that are found are remediated. |
|
||||
| Partially investigated | Entities directly related to the alert have been investigated. However, a problem stopped the investigation of collateral entities. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) for specific details. |
|
||||
| No threats found | The investigation has finished and no threats were identified. <br/>If you suspect something was missed (such as a false negative), you can use [advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-overview). |
|
||||
| Pending action | The investigation has found a threat, and an action to remediate that threat is awaiting approval. The Pending Action state is triggered when any threat with a corresponding action is found. However, the list of pending actions can increase as an investigation runs. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) to see if other items are still pending completion. |
|
||||
| Remediated | The investigation finished and all actions were approved (fully remediated). |
|
||||
| Partially remediated | The investigation resulted in remediation actions, and some were approved and completed. Other actions are still pending. |
|
||||
| Terminated by system | The investigation stopped. An investigation can stop for several reasons:<br/>- The investigation's pending actions expired. Pending actions can time out after awaiting approval for an extended period of time. <br/>- There are too many actions in the list.<br/>Visit the Action center ([https://securitycenter.windows.com/action-center](https://securitycenter.windows.com/action-center)) to view and approve any pending actions. |
|
||||
| Failed | At least one investigation analyzer ran into a problem where it could not complete properly. <br/><br/>If an investigation fails after remediation actions were approved, the remediation actions might still have succeeded. Check the investigation log ([https://securitycenter.windows.com/investigations](https://securitycenter.windows.com/investigations)) for detailed results. |
|
||||
| Queued | An investigation is being held in a queue. When other investigations complete, queued investigations begin. |
|
||||
| Waiting for device | Investigation paused. The investigation will resume as soon as the device is available. |
|
||||
| Terminated by user | A user stopped the investigation before it could complete. |
|
||||
|**Pending** | Displays a list of actions that require attention. You can approve or reject actions one at a time, or select multiple actions if they have the same type of action (such as **Quarantine file**). <br/>**TIP**: Make sure to [review and approve (or reject) pending actions](manage-auto-investigation.md) as soon as possible so that your automated investigations can complete in a timely manner. |
|
||||
|**History** | Serves as an audit log for actions that were taken, such as: <br/>- Remediation actions that were taken as a result of automated investigations <br>- Remediation actions that were approved by your security operations team <br/>- Commands that were run and remediation actions that were applied during Live Response sessions <br/>- Remediation actions that were taken by threat protection features in Microsoft Defender Antivirus <p>Provides a way to undo certain actions (see [Undo completed actions](manage-auto-investigation.md#undo-completed-actions)). |
|
||||
|
||||
You can customize, sort, filter, and export data in the Action center.
|
||||
|
||||
## View details about an automated investigation
|
||||
:::image type="content" source="images/new-action-center-columnsfilters.png" alt-text="Columns and filters in the Action center":::
|
||||
|
||||
|
||||
|
||||
You can view the details of an automated investigation to see information such as the investigation graph, alerts associated with the investigation, the device that was investigated, and other information.
|
||||
|
||||
In this view, you'll see the name of the investigation, when it started and ended.
|
||||
|
||||
### Investigation graph
|
||||
|
||||
The investigation graph provides a graphical representation of an automated investigation. All investigation-related information is simplified and arranged in specific sections. Clicking on any of the icons brings you the relevant section where you can view more information.
|
||||
|
||||
A progress ring shows two status indicators:
|
||||
- Orange ring - shows the pending portion of the investigation
|
||||
- Green ring - shows the running time portion of the investigation
|
||||
|
||||
|
||||
|
||||
In the example image, the automated investigation started on 10:26:59 AM and ended on 10:56:26 AM. Therefore, the entire investigation was running for 29 minutes and 27 seconds.
|
||||
|
||||
The pending time of 16 minutes and 51 seconds reflects two possible pending states: pending for asset (for example, the device might have disconnected from the network) or pending for approval.
|
||||
|
||||
From this view, you can also view and add comments and tags about the investigation.
|
||||
|
||||
### Alerts
|
||||
|
||||
The **Alerts** tab for an automated investigation shows details such as a short description of the alert that initiated the automated investigation, severity, category, the device associated with the alert, user, time in queue, status, investigation state, and to whom the investigation is assigned.
|
||||
|
||||
Additional alerts seen on a device can be added to an automated investigation as long as the investigation is ongoing.
|
||||
|
||||
Selecting an alert using the check box brings up the alerts details pane where you have the option of opening the alert page, manage the alert by changing its status, see alert details, automated investigation details, related device, logged-on users, and comments and history.
|
||||
|
||||
Clicking on an alert title brings you the alert page.
|
||||
|
||||
### Devices
|
||||
|
||||
The **Devices** tab Shows details the device name, IP address, group, users, operating system, remediation level, investigation count, and when it was last investigated.
|
||||
|
||||
Devices that show the same threat can be added to an ongoing investigation and will be displayed in this tab. If 10 or more devices are found during this expansion process from the same entity, then that expansion action will require an approval and will be seen in the **Pending actions** view.
|
||||
|
||||
Selecting a device using the checkbox brings up the device details pane where you can see more information such as device details and logged-on users.
|
||||
|
||||
Clicking on a device name brings you the device page.
|
||||
|
||||
### Evidence
|
||||
|
||||
The **Evidence** tab shows details related to threats associated with this investigation.
|
||||
|
||||
### Entities
|
||||
|
||||
The **Entities** tab shows details about entities such as files, process, services, drives, and IP addresses. The table details such as the number of entities that were analyzed. You'll gain insight into details such as how many are remediated, suspicious, or had no threats found.
|
||||
|
||||
### Log
|
||||
|
||||
The **Log** tab gives a chronological detailed view of all the investigation actions taken on the alert. You'll see the action type, action, status, device name, description of the action, comments entered by analysts who may have worked on the investigation, execution start time, duration, pending duration.
|
||||
|
||||
As with other sections, you can customize columns, select the number of items to show per page, and filter the log.
|
||||
|
||||
Available filters include action type, action, status, device name, and description.
|
||||
|
||||
You can also click on an action to bring up the details pane where you'll see information such as the summary of the action and input data.
|
||||
|
||||
### Pending actions
|
||||
|
||||
If there are pending actions on an automated investigation, you'll see a pop-up similar to the following image.
|
||||
|
||||
|
||||
|
||||
When you click on the pending actions link, you'll be taken to the Action center. You can also navigate to the page from the navigation page by going to **automated investigation** > **Action center**.
|
||||
- Select a column heading to sort items in ascending or descending order.
|
||||
- Use the time period filter to view data for the past day, week, 30 days, or 6 months.
|
||||
- Choose the columns that you want to view.
|
||||
- Specify how many items to include on each page of data.
|
||||
- Use filters to view just the items you want to see.
|
||||
- Select **Export** to export results to a .csv file.
|
||||
|
||||
## Next steps
|
||||
|
||||
- [View and approve remediation actions](manage-auto-investigation.md)
|
||||
|
||||
- [See the interactive guide: Investigate and remediate threats with Microsoft Defender for Endpoint](https://aka.ms/MDATP-IR-Interactive-Guide)
|
||||
|
||||
## See also
|
||||
|
||||
@ -0,0 +1,94 @@
|
||||
---
|
||||
title: Details and results of an automated investigation
|
||||
description: During and after an automated investigation, you can view the results and key findings
|
||||
keywords: automated, investigation, results, analyze, details, remediation, autoair
|
||||
search.appverid: met150
|
||||
ms.prod: m365-security
|
||||
ms.technology: mde
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
f1.keywords:
|
||||
- NOCSH
|
||||
ms.author: deniseb
|
||||
author: denisebmsft
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection:
|
||||
- M365-security-compliance
|
||||
- m365initiative-m365-defender
|
||||
ms.topic: conceptual
|
||||
ms.custom: autoir
|
||||
ms.reviewer: evaldm, isco
|
||||
ms.date: 02/02/2021
|
||||
---
|
||||
|
||||
# Details and results of an automated investigation
|
||||
|
||||
**Applies to:**
|
||||
- Microsoft Defender for Endpoint
|
||||
|
||||
With Microsoft Defender for Endpoint, when an [automated investigation](automated-investigations.md) runs, details about that investigation are available both during and after the automated investigation process. If you have the necessary permissions, you can view those details in an investigation details view. The investigation details view provides you with up-to-date status and the ability to approve any pending actions.
|
||||
|
||||
## (NEW!) Unified investigation page
|
||||
|
||||
The investigation page has recently been updated to include information across your devices, email, and collaboration content. The new, unified investigation page defines a common language and provides a unified experience for automatic investigations across [Microsoft Defender for Endpoint](microsoft-defender-advanced-threat-protection.md) and [Microsoft Defender for Office 365](/microsoft-365/security/office-365-security/office-365-atp).
|
||||
|
||||
> [!TIP]
|
||||
> To learn more about what's changing, see [(NEW!) Unified investigation page](/microsoft-365/security/mtp/mtp-autoir-results).
|
||||
|
||||
## Open the investigation details view
|
||||
|
||||
You can open the investigation details view by using one of the following methods:
|
||||
- [Select an item in the Action center](#select-an-item-in-the-action-center)
|
||||
- [Select an investigation from an incident details page](#open-an-investigation-from-an-incident-details-page)
|
||||
|
||||
### Select an item in the Action center
|
||||
|
||||
The improved [Action center](auto-investigation-action-center.md) brings together [remediation actions](manage-auto-investigation.md#remediation-actions) across your devices, email & collaboration content, and identities. Listed actions include remediation actions that were taken automatically or manually. In the Action center, you can view actions that are awaiting approval and actions that were already approved or completed. You can also navigate to more details, such as an investigation page.
|
||||
|
||||
1. Go to [https://security.microsoft.com](https://security.microsoft.com) and sign in.
|
||||
2. In the navigation pane, choose **Action center**.
|
||||
3. On either the **Pending** or **History** tab, select an item. Its flyout pane opens.
|
||||
4. Review the information in the flyout pane, and then take one of the following steps:
|
||||
- Select **Open investigation page** to view more details about the investigation.
|
||||
- Select **Approve** to initiate a pending action.
|
||||
- Select **Reject** to prevent a pending action from being taken.
|
||||
- Select **Go hunt** to go into [Advanced hunting](advanced-hunting-overview.md).
|
||||
|
||||
### Open an investigation from an incident details page
|
||||
|
||||
Use an incident details page to view detailed information about an incident, including alerts that were triggered information about any affected devices, user accounts, or mailboxes.
|
||||
|
||||
1. Go to [https://security.microsoft.com](https://security.microsoft.com) and sign in.
|
||||
2. In the navigation pane, choose **Incidents & alerts** > **Incidents**.
|
||||
3. Select an item in the list, and then choose **Open incident page**.
|
||||
4. Select the **Investigations** tab, and then select an investigation in the list. Its flyout pane opens.
|
||||
5. Select **Open investigation page**.
|
||||
|
||||
## Investigation details
|
||||
|
||||
Use the investigation details view to see past, current, and pending activity pertaining to an investigation. The investigation details view resembles the following image:
|
||||
|
||||
In the Investigation details view, you can see information on the **Investigation graph**, **Alerts**, **Devices**, **Identities**, **Key findings**, **Entities**, **Log**, and **Pending actions** tabs, described in the following table.
|
||||
|
||||
> [!NOTE]
|
||||
> The specific tabs you see in an investigation details page depends on what your subscription includes. For example, if your subscription does not include Microsoft Defender for Office 365 Plan 2, you won't see a **Mailboxes** tab.
|
||||
|
||||
| Tab | Description |
|
||||
|:--------|:--------|
|
||||
| **Investigation graph** | Provides a visual representation of the investigation. Depicts entities and lists threats found, along with alerts and whether any actions are awaiting approval.<br/>You can select an item on the graph to view more details. For example, selecting the **Evidence** icon takes you to the **Evidence** tab, where you can see detected entities and their verdicts. |
|
||||
| **Alerts** | Lists alerts associated with the investigation. Alerts can come from threat protection features on a user's device, in Office apps, Cloud App Security, and other Microsoft 365 Defender features.|
|
||||
| **Devices** | Lists devices included in the investigation along with their remediation level. (Remediation levels correspond to the [automation level for device groups](automation-levels.md).) |
|
||||
| **Mailboxes** |Lists mailboxes that are impacted by detected threats. |
|
||||
| **Users** | Lists user accounts that are impacted by detected threats. |
|
||||
| **Evidence** | Lists pieces of evidence raised by alerts/investigations. Includes verdicts (*Malicious*, *Suspicious*, or *No threats found*) and remediation status. |
|
||||
| **Entities** | Provides details about each analyzed entity, including a verdict for each entity type (*Malicious*, *Suspicious*, or *No threats found*).|
|
||||
|**Log** | Provides a chronological, detailed view of all the investigation actions taken after an alert was triggered.|
|
||||
| **Pending actions** | Lists items that require approval to proceed. Go to the Action center ([https://security.microsoft.com/action-center](https://security.microsoft.com/action-center)) to approve pending actions. |
|
||||
|
||||
## See also
|
||||
|
||||
- [Review remediation actions following an automated investigation](manage-auto-investigation.md)
|
||||
- [View and organize the Microsoft Defender for Endpoint Incidents queue](view-incidents-queue.md)
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: Use automated investigations to investigate and remediate threats
|
||||
description: Understand the automated investigation flow in Microsoft Defender for Endpoint.
|
||||
keywords: automated, investigation, detection, source, threat types, id, tags, devices, duration, filter export, defender atp
|
||||
keywords: automated, investigation, detection, defender atp
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: m365-security
|
||||
@ -11,62 +11,45 @@ ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: deniseb
|
||||
author: denisebmsft
|
||||
ms.date: 12/07/2020
|
||||
ms.date: 02/02/2021
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection:
|
||||
- m365-security-compliance
|
||||
- m365initiative-defender-endpoint
|
||||
ms.topic: conceptual
|
||||
ms.topic: how-to
|
||||
ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs
|
||||
ms.custom: AIR
|
||||
---
|
||||
|
||||
# Overview of automated investigations
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146806)
|
||||
|
||||
If your organization is using Microsoft Defender for Endpoint, your security operations team receives an alert whenever a malicious or suspicious artifact is detected. Given the seemingly never-ending flow of threats that come in, security teams often face challenges in addressing the high volume of alerts. Fortunately, Defender for Endpoint includes automated investigation and remediation (AIR) capabilities that can help your security operations team address threats more efficiently and effectively.
|
||||
|
||||
Your security operations team receives an alert whenever a malicious or suspicious artifact is detected by Microsoft Defender for Endpoint. Security operations teams face challenges in addressing the multitude of alerts that arise from the seemingly never-ending flow of threats. Microsoft Defender for Endpoint includes automated investigation and remediation (AIR) capabilities that can help your security operations team address threats more efficiently and effectively. Want to see how it works? Watch the following video:
|
||||
Want to see how it works? Watch the following video: <br/><br/>
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4bOeh]
|
||||
|
||||
The technology in automated investigation uses various inspection algorithms and is based on processes that are used by security analysts. AIR capabilities are designed to examine alerts and take immediate action to resolve breaches. AIR capabilities significantly reduce alert volume, allowing security operations to focus on more sophisticated threats and other high-value initiatives. The [Action center](auto-investigation-action-center.md) keeps track of all the investigations that were initiated automatically, along with details, such as investigation status, detection source, and any pending or completed actions.
|
||||
The technology in automated investigation uses various inspection algorithms and is based on processes that are used by security analysts. AIR capabilities are designed to examine alerts and take immediate action to resolve breaches. AIR capabilities significantly reduce alert volume, allowing security operations to focus on more sophisticated threats and other high-value initiatives. All remediation actions, whether pending or completed, are tracked in the [Action center](auto-investigation-action-center.md). In the Action center, pending actions are approved (or rejected), and completed actions can be undone if needed.
|
||||
|
||||
This article provides an overview of AIR and includes links to next steps and additional resources.
|
||||
|
||||
> [!TIP]
|
||||
> Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-automated-investigations-abovefoldlink).
|
||||
|
||||
## How the automated investigation starts
|
||||
|
||||
When an alert is triggered, a security playbook goes into effect. Depending on the security playbook, an automated investigation can start. For example, suppose a malicious file resides on a device. When that file is detected, an alert is triggered, and the automated investigation process begins. Microsoft Defender for Endpoint checks to see if the malicious file is present on any other devices in the organization. Details from the investigation, including verdicts (*Malicious*, *Suspicious*, and *No threats found*) are available during and after the automated investigation. To learn more about what happens after a verdict is reached, see [Automated investigation results and remediation actions](manage-auto-investigation.md#automated-investigation-results-and-remediation-actions).
|
||||
An automated investigation can start when an alert is triggered or when a security operator initiates the investigation.
|
||||
|
||||
>[!NOTE]
|
||||
>Currently, AIR only supports the following OS versions:
|
||||
>- Windows Server 2019
|
||||
>- Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441)) or later
|
||||
>- Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464/windows-10-update-kb4493464)) or later
|
||||
>- Windows 10, version [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019) or later
|
||||
|
||||
## Details of an automated investigation
|
||||
|
||||
During and after an automated investigation, you can view details about the investigation. Select a triggering alert to view the investigation details. From there, you can go to the **Investigation graph**, **Alerts**, **Devices**, **Evidence**, **Entities**, and **Log** tabs.
|
||||
|
||||
|Tab |Description |
|
||||
|:--|:--|
|
||||
|**Alerts**| The alert(s) that started the investigation.|
|
||||
|**Devices** |The device(s) where the threat was seen.|
|
||||
|**Evidence** |The entities that were found to be malicious during an investigation.|
|
||||
|**Entities** |Details about each analyzed entity, including a determination for each entity type (*Malicious*, *Suspicious*, or *No threats found*). |
|
||||
|**Log** |The chronological, detailed view of all the investigation actions taken on the alert.|
|
||||
|**Pending actions** |If there are any actions awaiting approval as a result of the investigation, the **Pending actions** tab is displayed. On the **Pending actions** tab, you can approve or reject each action. |
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Go to the **[Action center](auto-investigation-action-center.md)** to get an aggregated view all pending actions and manage remediation actions. The **Action center** also acts as an audit trail for all automated investigation actions.
|
||||
|Situation |What happens |
|
||||
|---------|---------|
|
||||
|An alert is triggered | In general, an automated investigation starts when an [alert](review-alerts.md) is triggered, and an [incident](view-incidents-queue.md) is created. For example, suppose a malicious file resides on a device. When that file is detected, an alert is triggered, and incident is created. An automated investigation process begins on the device. As other alerts are generated because of the same file on other devices, they are added to the associated incident and to the automated investigation. |
|
||||
|An investigation is started manually | An automated investigation can be started manually by your security operations team. For example, suppose a security operator is reviewing a list of devices and notices that a device has a high risk level. The security operator can select the device in the list to open its flyout, and then select **Initiate Automated Investigation**. |
|
||||
|
||||
## How an automated investigation expands its scope
|
||||
|
||||
@ -76,23 +59,39 @@ If an incriminated entity is seen in another device, the automated investigation
|
||||
|
||||
## How threats are remediated
|
||||
|
||||
As alerts are triggered, and an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be *Malicious*, *Suspicious*, or *No threats found*.
|
||||
As alerts are triggered, and an automated investigation runs, a verdict is generated for each piece of evidence investigated. Verdicts can be
|
||||
- *Malicious*;
|
||||
- *Suspicious*; or
|
||||
- *No threats found*.
|
||||
|
||||
As verdicts are reached, automated investigations can result in one or more remediation actions. Examples of remediation actions include sending a file to quarantine, stopping a service, removing a scheduled task, and more. (See [Remediation actions](manage-auto-investigation.md#remediation-actions).)
|
||||
As verdicts are reached, automated investigations can result in one or more remediation actions. Examples of remediation actions include sending a file to quarantine, stopping a service, removing a scheduled task, and more. To learn more, see [Remediation actions](manage-auto-investigation.md#remediation-actions).
|
||||
|
||||
Depending on the [level of automation](automation-levels.md) set for your organization, as well as other security settings, remediation actions can occur automatically or only upon approval by your security operations team. Additional security settings that can affect automatic remediation include [protection from potentially unwanted applications](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus) (PUA).
|
||||
|
||||
All remediation actions, whether pending or completed, can be viewed in the [Action Center](auto-investigation-action-center.md) ([https://securitycenter.windows.com](https://securitycenter.windows.com)). If necessary, your security operations team can undo a remediation action. (See [Review and approve remediation actions following an automated investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation).)
|
||||
All remediation actions, whether pending or completed, are tracked in the [Action center](auto-investigation-action-center.md). If necessary, your security operations team can undo a remediation action. To learn more, see [Review and approve remediation actions following an automated investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation).
|
||||
|
||||
> [!TIP]
|
||||
> Check out the new, unified investigation page in the Microsoft 365 security center. To learn more, see [(NEW!) Unified investigation page](/microsoft-365/security/mtp/mtp-autoir-results.md#new-unified-investigation-page).
|
||||
|
||||
|
||||
## Requirements for AIR
|
||||
|
||||
Your organization must have Defender for Endpoint (see [Minimum requirements for Microsoft Defender for Endpoint](minimum-requirements.md)).
|
||||
|
||||
Currently, AIR only supports the following OS versions:
|
||||
- Windows Server 2019
|
||||
- Windows 10, version 1709 (OS Build 16299.1085 with [KB4493441](https://support.microsoft.com/help/4493441/windows-10-update-kb4493441)) or later
|
||||
- Windows 10, version 1803 (OS Build 17134.704 with [KB4493464](https://support.microsoft.com/help/4493464/windows-10-update-kb4493464)) or later
|
||||
- Windows 10, version [1803](https://docs.microsoft.com/windows/release-information/status-windows-10-1809-and-windows-server-2019) or later
|
||||
|
||||
## Next steps
|
||||
|
||||
- [Get an overview of the automated investigations dashboard](manage-auto-investigation.md)
|
||||
- [Learn more about automation levels](automation-levels.md)
|
||||
- [See the interactive guide: Investigate and remediate threats with Microsoft Defender for Endpoint](https://aka.ms/MDATP-IR-Interactive-Guide)
|
||||
- [Configure automated investigation and remediation capabilities in Microsoft Defender for Endpoint](configure-automated-investigations-remediation.md)
|
||||
|
||||
## See also
|
||||
|
||||
- [PUA protection](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus)
|
||||
- [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md)
|
||||
- [Automated investigation and response in Microsoft Defender for Office 365](https://docs.microsoft.com/microsoft-365/security/office-365-security/office-365-air)
|
||||
- [Automated investigation and response in Microsoft 365 Defender](https://docs.microsoft.com/microsoft-365/security/mtp/mtp-autoir)
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
**Applies to:**
|
||||
|
||||
- Azure Active Directory
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-basicaccess-abovefoldlink)
|
||||
|
||||
@ -50,7 +50,7 @@ You can assign users with one of the following levels of permissions:
|
||||
> [!NOTE]
|
||||
> You need to run the PowerShell cmdlets in an elevated command-line.
|
||||
|
||||
- Connect to your Azure Active Directory. For more information, see [Connect-MsolService](https://docs.microsoft.com/powershell/module/msonline/connect-msolservice?view=azureadps-1.0).
|
||||
- Connect to your Azure Active Directory. For more information, see [Connect-MsolService](https://docs.microsoft.com/powershell/module/msonline/connect-msolservice?view=azureadps-1.0&preserve-view=true).
|
||||
|
||||
**Full access** <br>
|
||||
Users with full access can log in, view all system information and resolve alerts, submit files for deep analysis, and download the onboarding package.
|
||||
|
||||
@ -28,7 +28,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
## Overview
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-checksensor-abovefoldlink)
|
||||
|
||||
|
||||
@ -28,7 +28,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
## Overview
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -15,23 +15,22 @@ ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
ms.date: 09/24/2020
|
||||
ms.topic: how-to
|
||||
ms.date: 01/27/2021
|
||||
ms.reviewer: ramarom, evaldm, isco, mabraitm, chriggs
|
||||
---
|
||||
|
||||
# Configure automated investigation and remediation capabilities in Microsoft Defender for Endpoint
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
If your organization is using [Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/) (Defender for Endpoint), [automated investigation and remediation capabilities](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations) can save your security operations team time and effort. As outlined in [this blog post](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/enhance-your-soc-with-microsoft-defender-atp-automatic/ba-p/848946), these capabilities mimic the ideal steps that a security analyst takes to investigate and remediate threats. [Learn more about automated investigation and remediation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations).
|
||||
|
||||
To configure automated investigation and remediation, [turn on the features](#turn-on-automated-investigation-and-remediation), and then [set up device groups](#set-up-device-groups).
|
||||
To configure automated investigation and remediation,
|
||||
1. [Turn on the features](#turn-on-automated-investigation-and-remediation); and
|
||||
2. [Set up device groups](#set-up-device-groups).
|
||||
|
||||
## Turn on automated investigation and remediation
|
||||
|
||||
@ -46,7 +45,7 @@ To configure automated investigation and remediation, [turn on the features](#tu
|
||||
2. Select **+ Add device group**.
|
||||
3. Create at least one device group, as follows:
|
||||
- Specify a name and description for the device group.
|
||||
- In the **Automation level list**, select a level, such as **Full – remediate threats automatically**. The automation level determines whether remediation actions are taken automatically, or only upon approval. To learn more, see [How threats are remediated](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/automated-investigations#how-threats-are-remediated).
|
||||
- In the **Automation level list**, select a level, such as **Full – remediate threats automatically**. The automation level determines whether remediation actions are taken automatically, or only upon approval. To learn more, see [Automation levels in automated investigation and remediation](automation-levels.md).
|
||||
- In the **Members** section, use one or more conditions to identify and include devices.
|
||||
- On the **User access** tab, select the [Azure Active Directory groups](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-manage-groups?context=azure/active-directory/users-groups-roles/context/ugr-context) who should have access to the device group you're creating.
|
||||
4. Select **Done** when you're finished setting up your device group.
|
||||
@ -54,8 +53,8 @@ To configure automated investigation and remediation, [turn on the features](#tu
|
||||
## Next steps
|
||||
|
||||
- [Visit the Action Center to view pending and completed remediation actions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/auto-investigation-action-center#the-action-center)
|
||||
- [Review and approve pending actions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation)
|
||||
|
||||
- [Review and approve actions following an automated investigation](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-auto-investigation)
|
||||
|
||||
- [Manage indicators for files, IP addresses, URLs, or domains](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/manage-indicators)
|
||||
## See also
|
||||
|
||||
- [Address false positives/negatives in Microsoft Defender for Endpoint](defender-endpoint-false-positives-negatives.md)
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
This section guides you through all the steps you need to take to properly implement Conditional Access.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-emailconfig-abovefoldlink)
|
||||
|
||||
@ -28,7 +28,7 @@ ms.technology: mde
|
||||
|
||||
- Group Policy
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.technology: mde
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configureendpointsmdm-abovefoldlink)
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@ ms.technology: mde
|
||||
|
||||
- macOS
|
||||
- Linux
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-nonwindows-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
- Microsoft Endpoint Manager current branch
|
||||
- System Center 2012 R2 Configuration Manager
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.technology: mde
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.technology: mde
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
- [Microsoft 365 Endpoint data loss prevention (DLP)](/microsoft-365/compliance/endpoint-dlp-learn-about)
|
||||
|
||||
Devices in your organization must be configured so that the Defender for Endpoint service can get sensor data from them. There are various methods and deployment tools that you can use to configure the devices in your organization.
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
> Want to experience Defender for Endpoint? [Sign up for a free trial](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink).
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint ](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint ](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink)
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
## Before you begin
|
||||
> [!NOTE]
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Configure managed security service provider support
|
||||
description: Take the necessary steps to configure the MSSP integration with Microsoft Defender ATP
|
||||
description: Take the necessary steps to configure the MSSP integration with the Microsoft Defender ATP
|
||||
keywords: managed security service provider, mssp, configure, integration
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-mssp-support-abovefoldlink)
|
||||
|
||||
|
||||
@ -27,7 +27,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-configureendpointsscript-abovefoldlink)
|
||||
|
||||
|
||||
@ -31,7 +31,7 @@ ms.technology: mde
|
||||
- Windows Server (SAC) version 1803 and later
|
||||
- Windows Server 2019 and later
|
||||
- Windows Server 2019 core edition
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configserver-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-configuresiem-abovefoldlink)
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.topic: article
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-emailconfig-abovefoldlink)
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
|
||||
Connected applications integrates with the Defender for Endpoint platform using APIs.
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
Defender for Endpoint has recently upgraded the support process to offer a more modern and advanced support experience.
|
||||
|
||||
|
||||
@ -24,7 +24,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
## What is controlled folder access?
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -26,7 +26,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
Custom detection rules built from [advanced hunting](advanced-hunting-overview.md) queries let you proactively monitor various events and system states, including suspected breach activity and misconfigured devices. You can set them to run at regular intervals, generating alerts and taking response actions whenever there are matches.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
Manage your existing [custom detection rules](custom-detection-rules.md) to ensure they are effectively finding threats and taking actions. Explore how to view the list of rules, check their previous runs, and review the alerts they have triggered. You can also run a rule on demand and modify it.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
|
||||
|
||||
@ -23,7 +23,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is supported on Windows Server 2019 and Windows 10 clients.
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
Exploit protection automatically applies a number of exploit mitigation techniques on both the operating system processes and on individual apps.
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
**Applies to:**
|
||||
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-gensettings-abovefoldlink)
|
||||
|
||||
@ -28,7 +28,7 @@ ms.technology: mde
|
||||
|
||||
|
||||
- Windows Defender
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
|
||||
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
- Want to experience Microsoft Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-exposedapis-abovefoldlink)
|
||||
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
|
||||
Learn how to deploy Microsoft Defender for Endpoint so that your enterprise can take advantage of preventative protection, post-breach detection, automated investigation, and response.
|
||||
|
||||
@ -25,7 +25,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
|
||||
Deploying Microsoft Defender ATP can be done using a ring-based deployment approach.
|
||||
|
||||
@ -22,7 +22,7 @@ ms.technology: mde
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:**
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
>Want to experience Defender for Endpoint? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-secopsdashboard-abovefoldlink)
|
||||
|
||||
|
||||
@ -21,7 +21,7 @@ ms.technology: mde
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
**Applies to:** [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
Event flags in the Defender for Endpoint device timeline help you filter and organize specific events when you're investigate potential attacks.
|
||||
|
||||
|
||||
@ -29,7 +29,7 @@ ms.technology: mde
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/?linkid=2154037)
|
||||
|
||||
## What is EDR in block mode?
|
||||
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
x
Reference in New Issue
Block a user