Microsoft Defender Advanced Threat Protection portal overview

Applies to:

Want to experience Microsoft Defender ATP? Sign up for a free trial.

Enterprise security teams can use Microsoft Defender Security Center to monitor and assist in responding to alerts of potential advanced persistent threat (APT) activity or data breaches.

You can use Microsoft Defender Security Center to:

  • View, sort, and triage alerts from your endpoints
  • Search for more information on observed indicators such as files and IP Addresses
  • Change Microsoft Defender ATP settings, including time zone and review licensing information.

Microsoft Defender Security Center

When you open the portal, you’ll see the main areas of the application:

Microsoft Defender Advanced Threat Protection portal

  • (1) Navigation pane
  • (2) Main portal
  • (3) Search, Community center, Time settings, Help and support, Feedback


Malware related detections will only appear if your machines are using Windows Defender Antivirus as the default real-time protection antimalware product.

You can navigate through the portal using the menu options available in all sections. Refer to the following table for a description of each section.

Area Description
(1) Navigation pane Use the navigation pane to move between the Dashboards, Alerts queue, Automated investigations, Machines list, Service health, Advanced hunting, and Settings.
Dashboards Access the Security operations, the Secure Score, or Threat analytics dashboard.
Incidents View alerts that have been aggregated as incidents.
Alerts View alerts generated from machines in your organizations.
Automated investigations Displays a list of automated investigations that's been conducted in the network, the status of each investigation and other details such as when the investigation started and the duration of the investigation.
Advanced hunting Advanced hunting allows you to proactively hunt and investigate across your organization using a powerful search and query tool.
Machines list Displays the list of machines that are onboarded to Microsoft Defender ATP, some information about them, and the corresponding number of alerts.
Service health Provides information on the current status of the Window Defender ATP service. You'll be able to verify that the service health is healthy or if there are current issues.
Settings Shows the settings you selected during onboarding and lets you update your industry preferences and retention policy period. You can also set other configuration settings such as email notifications, activate the preview experience, enable or turn off advanced features, SIEM integration, threat intel API, build Power BI reports, and set baselines for the Secure Score dashboard.
(2) Main portal Main area where you will see the different views such as the Dashboards, Alerts queue, and Machines list.
(3) Community center, Time settings, Help and support, Feedback Community center -Access the Community center to learn, collaborate, and share experiences about the product.
Time settings - Gives you access to the configuration settings where you can set time zones and view license information.

Help and support - Gives you access to the Microsoft Defender ATP guide, Microsoft support, and Premier support.

Feedback - Access the feedback button to provide comments about the portal.

Microsoft Defender ATP icons

The following table provides information on the icons used all throughout the portal:

Icon Description
ATP logo icon Microsoft Defender ATP logo
Alert icon Alert – Indication of an activity correlated with advanced attacks.
Detection icon Detection – Indication of a malware threat detection.
Active threat icon Active threat – Threats actively executing at the time of detection.
Remediated icon Remediated – Threat removed from the machine.
Not remediated icon Not remediated – Threat not removed from the machine.
Thunderbolt icon Indicates events that triggered an alert in the Alert process tree.
Machine icon Machine icon
Windows Defender AV events icon Windows Defender Antivirus events
Application Guard events icon Windows Defender Application Guard events
Device Guard events icon Windows Defender Device Guard events
Exploit Guard events icon Windows Defender Exploit Guard events
SmartScreen events icon Windows Defender SmartScreen events
Firewall events icon Windows Firewall events
Response action icon Response action
Process events icon Process events
Network communication events icon Network events
File observed events icon File events
Registry events icon Registry events
Module load DLL events icon Load DLL events
Other events icon Other events
Access token modification icon Access token modification
File creation icon File creation
Signer icon Signer
File path icon File path
Command line icon Command line
Unsigned file icon Unsigned file
Process tree icon Process tree
Memory allocation icon Memory allocation
Process injection icon Process injection
Powershell command run icon Powershell command run
Community center icon Community center
Notifications icon Notifications
No threats found Automated investigation - no threats found
Failed icon Automated investigation - failed
Partially remediated icon Automated investigation - partially investigated
Termindated by system Automated investigation - terminated by system
Pending icon Automated investigation - pending
Running icon Automated investigation - running
Remediated icon Automated investigation - remediated
Partially investigated icon Automated investigation - partially remediated
Threat insights icon Threat & Vulnerability Management - threat insights
Possible active alert icon Threat & Vulnerability Management - possible active alert
Recommendation insights icon Threat & Vulnerability Management - recommendation insights