In the Security & Compliance Center (protection.office.com), you can select Alerts | View alerts from the left navigation pane to view, filter, and resolve alerts:

To view more detail on an alert, check the box to its left. This opens a pane with more detail and the option to resolve it as seen in the screenshot that follows:

If you select Resolve on an alert, you're able to modify its status and add additional comments. For the status drop-down list, you can choose from the following to help track the status of the alert:

• Keep it Active and just add comments: No change, except perhaps notes.
• Investigating: Currently being looked into.
• Resolved: Action has been taken so that the alert is no longer a concern.
• Dismissed: The alert is a false positive or no action will be taken.

As seen in the following screenshot you can choose the alert status from a dropdown, enter accompanying comments, and save to update the alert accordingly.

Under Alert policies, you can adjust existing policies (and some default policies). For each policy, you'll configure the severity, category, conditions, actions, and so on. In the following example, the policy is default and is looking for anomalous activity in external file sharing: 

Here's a list of other activities (conditions) you could base a policy on. For the exam, be sure to become familiar with the types of policies you can create with these actions:

A good example of an alert you might be asked to create would be one that notifies someone when a file from a particularly sensitive site, or with a certain name, is shared externally. The following screenshot shows the configuration of an alert's trigger and scope:

Manage advanced alerts takes you to the Cloud App Security dashboard we discussed in a previous chapter.

In the next section, we'll look into the Azure AD Identity Protection dashboard and its alerts.