Alerts queue

From the navigation pane, select Alerts queue. This view will show a list of alerts that were flagged from endpoints in your network. You can sort and filter the alerts by clicking on the column header. Select an alert to see further details, and change the status from New to In Progress or Resolved. You can also specify a classification for the alert and assign it to yourself if it is not yet assigned. To manage multiple alerts, use Ctrl or Shift to select more than one, then apply the same action to each alert. Alerts are managed in several queues, depending on their current status:

  • New
  • In Progress
  • Resolved
  • Assigned to me

Use the following guide to understand how to use the various options, such as the alert process tree, incident graph, and alert timeline: https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-atp/investigate-alerts-windows-defender-advanced-threat-protection.