You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-office-365/threat-explorer-threat-hunting.md
+5-5Lines changed: 5 additions & 5 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ author: chrisda
7
7
manager: deniseb
8
8
audience: ITPro
9
9
ms.topic: conceptual
10
-
ms.date: 06/12/2024
10
+
ms.date: 10/01/2024
11
11
ms.localizationpriority: medium
12
12
ms.collection:
13
13
- m365-security
@@ -163,7 +163,7 @@ After you determine that an email message is a threat, the next step is remediat
163
163
>
164
164
> If you select 101 to 200,000 entries, only the following actions are available in the **Take action** wizard:
165
165
>
166
-
> -**Threat Explorer**: **Move to mailbox** and **Propose remediation** are available, but they're mutually exclusive (you can select one or the other).
166
+
> -**Threat Explorer**: **Move or delete** and **Propose remediation** are available, but they're mutually exclusive (you can select one or the other).
167
167
> -**Real-time detections**: Only **Submit to Microsoft for review** and creating corresponding allow/block entries in the Tenant Allow/Block list are available.
168
168
169
169
- Click on the **Subject** value of an entry in the table. The details flyout that opens contains :::image type="icon" source="media/m365-cc-sc-take-actions-icon.png" border="false"::: **Take action** at the top of the flyout.
@@ -176,7 +176,7 @@ Selecting :::image type="icon" source="media/m365-cc-sc-take-actions-icon.png" b
176
176
177
177
|Action|Defender for<br/>Office 365 Plan 2|Defender for<br/>Office 365 Plan 1|
178
178
|---|:---:|:---:|
179
-
|**Move to mailbox folder**|✔¹||
179
+
|**Move or delete**|✔¹||
180
180
| Release quarantined messages to some or all original recipients²|✔||
181
181
|**Submit to Microsoft for review**|✔|✔|
182
182
| **Allow or block entries in the Tenant Allow/Block List**³|✔|✔|
@@ -197,11 +197,11 @@ The **Take action** wizard is described in the following list:
197
197
198
198
By default, some actions are unavailable/grayed out based on the **Latest delivery location** value of the message. To show all available response actions, slide the toggle to :::image type="icon" source="media/scc-toggle-on.png" border="false"::: **On**.
199
199
200
-
-**Move to mailbox folder**: Select one of the available values that appear:
200
+
-**Move or delete**: Select one of the available values that appear:
201
201
-**Junk**: Move the message to the Junk Email folder.
202
202
-**Inbox**: Move the message to the Inbox. Selecting this value might also reveal the following options:
203
203
204
-
-**Move back to Sent Items folder**: If the message was sent by an internal sender and the message was soft deleted (moved to the Recoverable Items\Deletions folder), selecting this option tries to move the message back to the Sent Items folder. This option is an undo action if you previously selected **Move to mailbox folder**\>**Soft deleted items** and also selected **Delete sender's copy** on a message.
204
+
-**Move back to Sent Items folder**: If the message was sent by an internal sender and the message was soft deleted (moved to the Recoverable Items\Deletions folder), selecting this option tries to move the message back to the Sent Items folder. This option is an undo action if you previously selected **Move or delete**\>**Soft deleted items** and also selected **Delete sender's copy** on a message.
205
205
206
206
- For messages with the value **Quarantine** for the **Latest delivery location** property, selecting **Inbox** releases the message from quarantine, so the following options are also available:
207
207
-**Release to one or more of the original recipients of the e-mail**: If you select this value, a box appears where you can select or deselect the original recipients of the quarantined message.
0 commit comments