Merge pull request #753 from YongRhee-MSFT/docs-editor/review-detected-threats-1718974858

Update review-detected-threats.md

Author: denisebmsft

defender-endpoint/review-detected-threats.md

@@ -12,7 +12,7 @@ ms.collection:
 - tier2
 - mde-edr
 ms.topic: conceptual
-ms.date: 05/29/2024
+ms.date: 06/21/2024
 ms.subservice: edr
 search.appverid: met150
 ---
@@ -39,15 +39,15 @@ In the Microsoft Defender portal, you can view and manage threat detections usin
 
 1. Visit [Microsoft XDR portal](https://security.microsoft.com/) and sign-in.
 
-    On the landing page, you'll see the **Devices with active malware** card with the following information:
+    On the landing page, you see the **Devices with active malware** card with the following information:
 
     - Display text: Applies to Intune-managed devices. Devices with multiple malware detections may be counted more than once.
     - Last updated date and time.
     - A bar with the Active and Malware remediated portions as per your scan.
 
     You can select **View Details** for more information.
 
-2. Once remediated, you'll see the following text being displayed:
+2. Once remediated, you see the following text being displayed:
 
     *Malware found on your devices have been remediated successfully*.
 
@@ -59,7 +59,7 @@ You can manage threat detections for any devices that are [enrolled in Microsoft
 
 2. In the navigation pane, select **Endpoint security**.
 
-3. Under **Manage**, select **Antivirus**. You'll see tabs for **Summary**, **Unhealthy endpoints**, and **Active malware**.
+3. Under **Manage**, select **Antivirus**. You see tabs for **Summary**, **Unhealthy endpoints**, and **Active malware**.
 
 4. Review the information on the available tabs, and then take action as necessary.
 
@@ -72,20 +72,23 @@ You can manage threat detections for any devices that are [enrolled in Microsoft
 
 ## FAQs
 
-### In the Microsoft XDR portal > Devices with active malware > Devices with malware detections report, why does the Last update seem to be occurring today?
+#### In the Microsoft XDR portal > Devices with active malware > Devices with malware detections report, why does the Last update seem to be occurring today?
 
-To see when the malware was detected, you can do the following:
+To see when the malware was detected, you can take the following steps:
 
 1. Since this is an integration with Intune, visit [**Intune portal**](https://intune.microsoft.com) and select **Antivirus** and then select **Active malware** tab.
+
 2. Select **Export**.
-3. On your device, go to Downloads, and extract the Active malware_YYYY_MM_DD_THH_MM_SS.0123Z.csv.zip.
+
+3. On your device, go to Downloads, and extract the `Active malware_YYYY_MM_DD_THH_MM_SS.0123Z.csv.zip` file.
+
 4. Open the CSV and find the **LastStateChangeDateTime** column to see when malware was detected.
 
-### In the devices with malware detections report, why can't I see any information about which malware was detected on the device.
+#### In the devices with malware detections report, why can't I see any information about which malware was detected on the device.
 
-To see the malware name, visit the [Intune portal](https://intune.microsoft.com) as this is an integration with Intune, select **Antivirus**,  and select **Active malware** tab and you'll see a column named **Malware name**.
+To see the malware name, visit the [Intune portal](https://intune.microsoft.com) as this is an integration with Intune, select **Antivirus**,  and select **Active malware** tab and you see a column named **Malware name**.
 
-### I see a different number for active malware in Devices with active malware report, when compared to numbers I see using Reports > Detected malware, and Intune > Antivirus > Active malware.
+#### I see a different number for active malware in Devices with active malware report, when compared to numbers I see using Reports > Detected malware, and Intune > Antivirus > Active malware.
 
 The **Devices with active malware** report is based on the devices that were active within the last 1 day (24 hours) and had malware detections within the last 15 days.
 
@@ -106,16 +109,21 @@ on DeviceName
 | distinct DeviceName, DeviceId, Title, AlertId, Timestamp
 ```
 
-### I searched the computer name in the top search bar and got two devices with the same name. I don't know which one of those two devices the report is referring to?
+#### I searched the computer name in the top search bar and got two devices with the same name. I don't know which one of those two devices the report is referring to?
 
 Use the Advanced Hunting query that is mentioned [here](#i-see-a-different-number-for-active-malware-in-devices-with-active-malware-report-when-compared-to-numbers-i-see-using-reports--detected-malware-and-intune--antivirus--active-malware) for details such as unique DeviceID, Title, AlertID, and the remediation process. After identifying, work with your IT admin's to make sure that the devices are uniquely named. If a device is retired, use [tags to decommission it.](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/how-to-use-tagging-effectively-part-1/ba-p/1964058)
 
-### I see malware detection in Intune and on the Devices with active malware report, but I don't see it in the MDE Alerts queue or in the Incidents queue.
+#### I see malware detection in Intune and on the Devices with active malware report, but I don't see it in the MDE Alerts queue or in the Incidents queue.
 
 It might be that the URL's [Cloud Protection](configure-network-connections-microsoft-defender-antivirus.md) is currently not being allowed through your firewall or proxy.
 
 You need to ensure that when you run `%ProgramFiles%\Windows Defender\MpCmdRun.exe -ValidateMapsConnection` on your device, the reporting is Ok.
 
+#### I see a device that has been inactive for 180+ days but still showing up on the report for 'Devices with active malware'.  The device doesn't show in the "Device inventory", can't be turned on and can't be offboarded from Microsoft Defender for Endpoint.
+
+  
+The device has not been [retired](/mem/intune/remote-actions/devices-wipe) from Intune.
+
 ## Related articles
 
 - [Alerts in Microsoft Defender for Endpoint](investigate-alerts.md)