Investigate the details of a file associated with a specific alert, behavior, or event to help determine if the file exhibits malicious activities, identify the attack motivation, and understand the potential scope of the breach. There are many ways to access the detailed profile page of a specific file. For example, you can use the […]
Investigate alerts that are affecting your network, understand what they mean, and how to resolve them. Select an alert from the alerts queue to go to alert page. This view contains the alert title, the affected assets, the details side pane, and the alert story. From the alert page, begin your investigation by selecting the […]
Defender for Endpoint notifies you of possible malicious events, attributes, and contextual information through alerts. A summary of new alerts is displayed in the Security operations dashboard, and you can access all alerts in the Alerts queue. You can manage alerts by selecting an alert in the Alerts queue, or the Alerts tab of the Device page for an individual […]
The alert page in Microsoft Defender for Endpoint provides full context to the alert, by combining attack signals and alerts related to the selected alert, to construct a detailed alert story. Quickly triage, investigate, and take effective action on alerts that affect your organization. Understand why they were triggered, and their impact from one location. […]
The Alerts queue shows a list of alerts that were flagged from devices in your network. By default, the queue displays alerts seen in the last 30 days in a grouped view. The most recent alerts are showed at the top of the list helping you see the most recent alerts first. Note The alerts queue is […]
Learn how you can view and manage the queue so that you can effectively investigate threats seen on entities such as devices, files, or user accounts. In this section IN THIS SECTION Topic Description View and organize the Alerts queue Shows a list of alerts that were flagged in your network. Manage alerts Learn about […]
Investigate incidents that affect your network, understand what they mean, and collate evidence to resolve them. When you investigate an incident, you’ll see: Incident details Incident comments and actions Tabs (alerts, devices, investigations, evidence, graph) Analyze incident details Click an incident to see the Incident pane. Select Open incident page to see the incident details and related information […]
Managing incidents is an important part of every cybersecurity operation. You can manage incidents by selecting an incident from the Incidents queue or the Incidents management pane. Selecting an incident from the Incidents queue brings up the Incident management pane where you can open the incident page for details. You can assign incidents to yourself, change the status and classification, rename, or […]
The Incidents queue shows a collection of incidents that were flagged from devices in your network. It helps you sort through incidents to prioritize and create an informed cybersecurity response decision. By default, the queue displays incidents seen in the last 30 days, with the most recent incident showing at the top of the list, helping you […]
The Security operations dashboard is where the endpoint detection and response capabilities are surfaced. It provides a high level overview of where detections were seen and highlights where response actions are needed. The dashboard displays a snapshot of: Active alerts Devices at risk Sensor health Service health Daily devices reporting Active automated investigations Automated investigations statistics Users […]