Skip to content

Commit 5f46f97

Browse files
Update mdo-sec-ops-guide.md
Link to incidents page has been updated from https://security.microsoft.com/incidents-queue to https://security.microsoft.com/incidents on two lines in this document
1 parent 99dc02a commit 5f46f97

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

defender-office-365/mdo-sec-ops-guide.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ For a video about this information, see <https://youtu.be/eQanpq9N1Ps>.
4343

4444
### Monitor the Microsoft Defender XDR Incidents queue
4545

46-
The **Incidents** page in the Microsoft Defender portal at <https://security.microsoft.com/incidents-queue> (also known as the _Incidents queue_) allows you to manage and monitor events from the following sources in Defender for Office 365:
46+
The **Incidents** page in the Microsoft Defender portal at <https://security.microsoft.com/incidents> (also known as the _Incidents_ queue) allows you to manage and monitor events from the following sources in Defender for Office 365:
4747

4848
- [Alerts](/purview/alert-policies#default-alert-policies).
4949
- [Automated investigation and response (AIR)](air-about.md).
@@ -64,7 +64,7 @@ Incident queue management and the responsible personas are described in the foll
6464

6565
|Activity|Cadence|Description|Persona|
6666
|---|---|---|---|
67-
|Triage incidents in the Incidents queue at <https://security.microsoft.com/incidents-queue>.|Daily|Verify that all **Medium** and **High** severity incidents from Defender for Office 365 are triaged.|Security Operations Team|
67+
|Triage incidents in the Incidents queue at <https://security.microsoft.com/incidents>.|Daily|Verify that all **Medium** and **High** severity incidents from Defender for Office 365 are triaged.|Security Operations Team|
6868
|Investigate and take Response actions on incidents.|Daily|Investigate all incidents and actively take the recommended or manual response actions.|Security Operations Team|
6969
|Resolve incidents.|Daily|If the incident has been remediated, resolve the incident. Resolving the incident resolves all linked and related active alerts.|Security Operations Team|
7070
|Classify incidents.|Daily|Classify incidents as true or false. For true alerts, specify the threat type. This classification helps your security team see threat patterns and defend your organization from them.|Security Operations Team|

0 commit comments

Comments
 (0)