Skip to content

Commit 071950f

Browse files
authored
fix alt text
1 parent 1f9cfd0 commit 071950f

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

defender-xdr/advanced-hunting-take-action.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,21 +68,21 @@ To learn more about how quarantine actions are taken and how files can be restor
6868
6969
To take any of the described actions, select one or more records in your query results and then select **Take actions**. A wizard will guide you through the process of selecting and then submitting your preferred actions.
7070

71-
:::image type="content" source="media/take-action-multiple.png" alt-text="Take actions option in the Microsoft Defender portal" lightbox="media/take-action-multiple.png":::
71+
:::image type="content" source="media/take-action-multiple.png" alt-text="Screenshot of the take actions option in the Microsoft Defender portal." lightbox="media/take-action-multiple.png":::
7272

7373
## Take various actions on emails
7474

7575
Apart from device-focused remediation steps, you can also take some actions on emails from your query results. Select the records you want to take action on, select **Take actions**, then under **Choose actions**, select your choice from the following:
7676

7777
- `Move to mailbox folder` - select this to move the email messages to Junk, Inbox, or Deleted items folder
7878

79-
:::image type="content" source="media/advanced-hunting-take-actions-email.png" alt-text="The option Take actions in the Microsoft Defender portal" lightbox="media/advanced-hunting-take-actions-email.png":::
79+
:::image type="content" source="media/advanced-hunting-take-actions-email.png" alt-text="Screenshot of the option Take actions in the Microsoft Defender portal." lightbox="media/advanced-hunting-take-actions-email.png":::
8080

8181
- `Delete email` - select this to move email messages to the Deleted items folder (**Soft delete**) or delete them permanently (**Hard delete**)
8282

8383
Selecting **Soft delete** also automatically soft deletes the messages from the sender's Sent Items folder if the sender is in the organization.
8484

85-
:::image type="content" source="media/soft-delete-sender-copy.png" alt-text="Screenshot of take actions option in the Microsoft Defender portal" lightbox="media/soft-delete-sender-copy.png":::
85+
:::image type="content" source="media/soft-delete-sender-copy.png" alt-text="Screenshot of take actions option in the Microsoft Defender portal." lightbox="media/soft-delete-sender-copy.png":::
8686

8787
Automatic soft-deletion of the sender's copy is available for results using the `EmailEvents` and `EmailPostDeliveryEvents` tables but not the `UrlClickEvents` table. Furthermore, the result should contain the columns `EmailDirection` and `SenderFromAddress` columns for this action option to show up in the Take actions wizard. Sender's copy clean-up applies to intra-organization emails and outbound emails, ensuring that only the sender's copy is soft-deleted for these email messages. Inbound messages are out of scope.
8888

0 commit comments

Comments
 (0)