You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/autoir-investigation-results.md
+4-10Lines changed: 4 additions & 10 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -20,22 +20,18 @@ ms.custom:
20
20
- autoir
21
21
- admindeeplinkDEFENDER
22
22
ms.reviewer: evaldm, isco
23
-
ms.date: 04/04/2025
23
+
ms.date: 11/30/2025
24
24
appliesto:
25
25
- Microsoft Defender for Endpoint Plan 2
26
26
27
27
---
28
28
# View the details and results of an automated investigation
29
29
30
-
31
30
With Microsoft Defender for Endpoint, when an [automated investigation](automated-investigations.md) runs, details about that investigation are available both during and after the automated investigation process. If you have the necessary permissions, you can view those details in an investigation details view. The investigation details view provides you with up-to-date status and the ability to approve any pending actions.
32
31
33
-
## (NEW!) Unified investigation page
34
-
35
-
The investigation page is updated to include information across your devices, email, and collaboration content. The new, unified investigation page defines a common language and provides a unified experience for automatic investigations across [Microsoft Defender for Endpoint](microsoft-defender-endpoint.md) and [Microsoft Defender for Office 365](/defender-office-365/mdo-about).
32
+
## Unified investigation page
36
33
37
-
> [!TIP]
38
-
> To learn more about what's changing, see [(NEW!) Unified investigation page](/microsoft-365/security/mtp/mtp-autoir-results).
34
+
The unified investigation page includes information across your devices, email, and collaboration content. It defines a common language and provides a unified experience for automatic investigations across [Microsoft Defender for Endpoint](microsoft-defender-endpoint.md) and [Microsoft Defender for Office 365](/defender-office-365/mdo-about). For more information, see [Details and results of an automated investigation](/defender-xdr/m365d-autoir-results).
39
35
40
36
## Open the investigation details view
41
37
@@ -69,9 +65,7 @@ Use an incident details page to view detailed information about an incident, inc
69
65
70
66
## Investigation details
71
67
72
-
Use the investigation details view to see past, current, and pending activity pertaining to an investigation. The investigation details view resembles the following image:
73
-
74
-
In the Investigation details view, you can see information on the **Investigation graph**, **Alerts**, **Devices**, **Identities**, **Key findings**, **Entities**, **Log**, and **Pending actions** tabs, described in the following table.
68
+
Use the investigation details view to see past, current, and pending activity pertaining to an investigation. In the investigation details view, you can see information on the **Investigation graph**, **Alerts**, **Devices**, **Identities**, **Key findings**, **Entities**, **Log**, and **Pending actions** tabs, described in the following table.
75
69
76
70
> [!NOTE]
77
71
> - The specific tabs you see in an investigation details page depends on what your subscription includes. For example, if your subscription doesn't include Microsoft Defender for Office 365 Plan 2, you won't see a **Mailboxes** tab.
0 commit comments