Differences

This shows you the differences between two versions of the page.

--- qnd:azure:security_center [2021/03/09 16:45] – mgupton
+++ qnd:azure:security_center [2021/03/09 17:24] (current) – mgupton
@@ Line 1: / Line 1: @@
 ====== Azure Security Center ======
-  * The alerts generated in ASC often stop short of giving enough details to be useful. For example, one alert indicated an error occurred while handling some malware, but it does not indicate any details of the error.
+  * The alerts generated in ASC often stop short of giving enough details to be useful. For example, one alert indicated an error occurred while handling some malware, but it does not indicate any details of the error. Another example, the alert message was, The system process SVCHOST was observed running in an abnormal context, but it's not clear as to what //abnormal context// is.
-  * There doesn't appear to be a way to annotate alerts. You can mark and alert as dismissed, but you cannot add a note to indicate whether it was found to be false positive or not.
+  * There doesn't appear to be a way to annotate alerts. You can mark an alert as //dismissed//, but you cannot add a note to indicate whether it was found to be false positive or not.