Skip to content

Commit 97ca370

Browse files
committed
remove alert access section
1 parent 8f9fdb3 commit 97ca370

File tree

1 file changed

+6
-20
lines changed

1 file changed

+6
-20
lines changed

articles/defender-for-iot/organizations/how-to-analyze-programming-details-changes.md

Lines changed: 6 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
title: Analyze programming details and changes on an OT sensor - Microsoft Defender for IoT
33
description: Discover suspicious programming activity by investigating programming events occurring on your network devices.
4-
ms.date: 02/27/2023
4+
ms.date: 02/28/2023
55
ms.topic: how-to
66
---
77

@@ -30,7 +30,7 @@ To perform the procedures in this article, make sure that you have:
3030

3131
## Access programming data
3232

33-
The **Programming Timeline** tab can be accessed from unauthorized programming alerts, the **Device map**, the **Device inventory**, and the **Event timeline** in the sensor console.
33+
The **Programming Timeline** tab can be accessed from the **Device map**, **Device inventory**, and **Event timeline** pages in the sensor console.
3434

3535
### Access programming data from the device map
3636

@@ -58,20 +58,6 @@ The **Programming Timeline** tab can be accessed from unauthorized programming a
5858

5959
:::image type="content" source="media/analyze-programming/programming-timeline-window-device-inventory.png" alt-text="Screenshot of programming timeline tab on device details page." lightbox="media/analyze-programming/programming-timeline-window-device-inventory.png":::
6060

61-
### Access programming data from an alert
62-
63-
Unauthorized programming alerts are triggered when unauthorized programming devices carry out programming activities.
64-
65-
**To access the programming timeline from an alert**:
66-
67-
1. Sign into the sensor console and go to **Alerts**.
68-
69-
1. Filter the alerts to find the alert you want to analyze.
70-
71-
1. Select the alert to open the alert details pane on the right.
72-
73-
1. Select **Programming** to open the **Programming timeline**.
74-
7561
### Access programming data from the event timeline
7662

7763
Use the event timeline to display a timeline of events in which programming changes were detected.
@@ -86,21 +72,21 @@ Use the event timeline to display a timeline of events in which programming chan
8672

8773
The **Programming Timeline** tab shows details about each device that was programmed. Select an event and a file to view full programming details on the right. In the **Programming Timeline** tab:
8874

89-
- The **Recent Events** area lists the 50 most recent events detected by the OT sensor. Hover over an event and select the star to mark the event as an **Important** event.
75+
- The **Recent Events** area lists the 50 most recent events detected by the OT sensor. Hover over an event period select the star to mark the event as an **Important** event.
9076

9177
- The **Files** area lists programming files detected for the selected device. The OT sensor can display a maximum of 300 files per device, where each file has a maximum size of 15 MB. The **Files** area lists each file's name and size, and one of the following statuses to indicate the programming event that occurred:
9278

9379
- **Added**: The programming file was added to the endpoint
94-
- **Updated**: The programming file was updated on endpoint
80+
- **Updated**: The programming file was updated on the endpoint
9581
- **Deleted**: The programming file was removed from the endpoint
9682
- **Unknown**: No changes were detected for the programming file
9783

98-
- When a programming file is opened on the right, the device that was programmed is listed as the *programmed asset*. Multiple devices may have made programming changes on the device. Details about any devices that made changes are listed as *programming assets*, including the hostname, when the change was made, and the user that was signed in to the device at the time.
84+
- When a programming file is opened on the right, the device that was programmed is listed as the *programmed asset*. Multiple devices may have made programming changes on the device. Devices that made changes are listed as the *programming assets*, and details include the hostname, when the change was made, and the user that was signed in to the device at the time.
9985

10086
> [!TIP]
10187
> Select the :::image type="icon" source="media/analyze-programming/download-icon.png" border="false"::: download button to download a copy of the currently displayed programming file.
10288
103-
For example:
89+
For example:
10490

10591
:::image type="content" source="media/analyze-programming/programming-timeline-2.png" alt-text="Screenshot of viewing programming details in programming timeline." lightbox="media/analyze-programming/programming-timeline-2.png":::
10692

0 commit comments

Comments
 (0)