Skip to content

Commit 1be5237

Browse files
committed
Update entity-page-device.md
Minor lint fixes
1 parent d057846 commit 1be5237

File tree

1 file changed

+31
-30
lines changed

1 file changed

+31
-30
lines changed

defender-xdr/entity-page-device.md

Lines changed: 31 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ ms.author: yelevin
77
author: yelevin
88
manager: dansimp
99
audience: ITPro
10-
ms.collection:
10+
ms.collection:
1111
- m365-security
1212
- tier3
1313
- usx-security
@@ -31,7 +31,7 @@ The device entity page in the Microsoft Defender portal helps you in your invest
3131
> The content set displayed on the device entity page may differ slightly, depending on the device's enrollment in Microsoft Defender for Endpoint and Microsoft Defender for Identity.
3232
>
3333
> If your organization onboarded Microsoft Sentinel to the Defender portal, additional information will appear.
34-
>
34+
>
3535
> In Microsoft Sentinel, device entities are also known as **host** entities. [Learn more](/azure/sentinel/entities-reference).
3636
>
3737
> [!INCLUDE [unified-soc-preview-no-alert](../includes/unified-soc-preview-no-alert.md)]
@@ -85,15 +85,15 @@ The **Overview** tab contains the [device details](#device-details) sidebar and
8585

8686
The sidebar lists the device's full name and exposure level. It also provides some important basic information in small subsections, which can be expanded or collapsed, such as:
8787

88-
| Section | Included information |
89-
| ------- | -------------------- |
90-
| **VM details** | Machine and domain names and IDs, health and onboarding statuses, timestamps for first and last seen, IP addresses, and more |
91-
| **DLP policy sync details** | If relevant |
92-
| **Configuration status** | Details regarding Microsoft Defender for Endpoint configuration |
93-
| **Cloud resource details** | Cloud platform, resource ID, subscription information, and more |
94-
| **Hardware and firmware** | VM, processor, and BIOS information, and more |
95-
| **Device management** | Microsoft Defender for Endpoint enrollment status and management info |
96-
| **Directory data** | [UAC](/windows/security/identity-protection/user-account-control/user-account-control-overview) flags, [SPNs](/windows/win32/ad/service-principal-names), and group memberships. |
88+
|Section|Included information|
89+
|---|---|
90+
|**VM details**|Machine and domain names and IDs, health and onboarding statuses, timestamps for first and last seen, IP addresses, and more|
91+
|**DLP policy sync details**|If relevant|
92+
|**Configuration status**|Details regarding Microsoft Defender for Endpoint configuration|
93+
|**Cloud resource details**|Cloud platform, resource ID, subscription information, and more|
94+
|**Hardware and firmware**|VM, processor, and BIOS information, and more|
95+
|**Device management**|Microsoft Defender for Endpoint enrollment status and management info|
96+
|**Directory data**|[UAC](/windows/security/identity-protection/user-account-control/user-account-control-overview) flags, [SPNs](/windows/win32/ad/service-principal-names), and group memberships.|
9797

9898
### Dashboard
9999

@@ -282,30 +282,31 @@ Response actions offer shortcuts to analyze, investigate, and defend against thr
282282
:::image type="content" source="/defender/media/entity-page-device/entity-device-response-actions.png" alt-text="Screenshot of the Action bar for the device entity page in the Microsoft Defender portal.":::
283283

284284
> [!IMPORTANT]
285+
>
285286
> - [Response actions](/windows/security/threat-protection/microsoft-defender-atp/respond-machine-alerts) are only available if the device is enrolled in Microsoft Defender for Endpoint.
286287
> - Devices that are enrolled in Microsoft Defender for Endpoint may display different numbers of response actions, based on the device's OS and version number.
287288
288289
Response actions run along the top of a specific device page and include:
289290

290-
| Action | Description |
291-
| ------ | ----------- |
292-
| **Device value** | |
293-
| **Set criticality** | |
294-
| **Manage tags** | Updates custom tags you've applied to this device. |
295-
| **Report device inaccuracy** | |
296-
| **Run Antivirus Scan** | Updates Microsoft Defender Antivirus definitions and immediately runs an antivirus scan. Choose between Quick scan or Full scan. |
297-
| **Collect Investigation Package** | Gathers information about the device. When the investigation is completed, you can download it. |
298-
| **Restrict app execution** | Prevents applications that aren't signed by Microsoft from running. |
299-
| **Initiate automated investigation** | Automatically [investigates and remediates threats](/defender-office-365/air-about). Although you can manually trigger automated investigations to run from this page, [certain alert policies](/Microsoft-365/compliance/alert-policies#default-alert-policies) trigger automatic investigations on their own. |
300-
| **Initiate Live Response Session** | Loads a remote shell on the device for [in-depth security investigations](/defender-endpoint/live-response). |
301-
| **Isolate device** | Isolates the device from your organization's network while keeping it connected to Microsoft Defender. You can choose to allow Outlook, Teams, and Skype for Business to run while the device is isolated, for communication purposes. |
302-
| **Ask Defender Experts** | |
303-
| **Action Center** | Displays information about any response actions that are currently running. Only available if another action has already been selected. |
304-
| **Download force release from isolation script** | |
305-
| **Exclude** | |
306-
| **Go hunt** | |
307-
| **Turn on troubleshooting mode** | |
308-
| **Policy sync** | |
291+
|Action|Description|
292+
|---|---|
293+
|**Device value**||
294+
|**Set criticality**||
295+
|**Manage tags**|Updates custom tags you've applied to this device.|
296+
|**Report device inaccuracy**||
297+
|**Run Antivirus Scan**|Updates Microsoft Defender Antivirus definitions and immediately runs an antivirus scan. Choose between Quick scan or Full scan.|
298+
|**Collect Investigation Package**|Gathers information about the device. When the investigation is completed, you can download it.|
299+
|**Restrict app execution**|Prevents applications that aren't signed by Microsoft from running.|
300+
|**Initiate automated investigation**|Automatically [investigates and remediates threats](/defender-office-365/air-about). Although you can manually trigger automated investigations to run from this page, [certain alert policies](/Microsoft-365/compliance/alert-policies#default-alert-policies) trigger automatic investigations on their own.|
301+
|**Initiate Live Response Session**|Loads a remote shell on the device for [in-depth security investigations](/defender-endpoint/live-response).|
302+
|**Isolate device**|Isolates the device from your organization's network while keeping it connected to Microsoft Defender. You can choose to allow Outlook, Teams, and Skype for Business to run while the device is isolated, for communication purposes.|
303+
|**Ask Defender Experts**||
304+
|**Action Center**|Displays information about any response actions that are currently running. Only available if another action has already been selected.|
305+
|**Download force release from isolation script**||
306+
|**Exclude**||
307+
|**Go hunt**||
308+
|**Turn on troubleshooting mode**||
309+
|**Policy sync**||
309310

310311
## Related topics
311312

0 commit comments

Comments
 (0)