Microsoft Defender for Endpoint
Endpoint protectionView Incidents Queue
In brief
The incident queue now displays incidents from the last week by default instead of the last six months, with the newest listed first.
What Defender admins need to know
Administrators should expect a shorter default incident history when reviewing the queue. No action is required.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
The Incidents queue shows a collection of incidents that were flagged from devices in your network. It helps you sort through incidents to prioritize and create an informed cybersecurity response decision.
By default, the queue displays incidents seen in the last six months,week, with the most recent incident showing at the top of the list, helping you see the most recent incidents first.
There are several options you can choose from to customize the Incidents queue view.
@@ -23,7 +23,7 @@ appliesto: The **Incidents queue** shows a collection of incidents that were flagged from devices in your network. It helps you sort through incidents to prioritize and create an informed cybersecurity response decision. -By default, the queue displays incidents seen in the last six months, with the most recent incident showing at the top of the list, helping you see the most recent incidents first.+By default, the queue displays incidents seen in the last week, with the most recent incident showing at the top of the list, helping you see the most recent incidents first. There are several options you can choose from to customize the Incidents queue view.