Forum Discussion

danny_grasso's avatar
danny_grasso
Brass Contributor
Apr 03, 2024

Investigation state Queued

I see a number of messages in our Defender XDR Incidents with a status of Queued. What does this status mean? 

This appears to only be related to Defender for Office 365 incidents, usually email reported as junk/phish/notjunk etc type of incidents.

Regardless of whether I investigate or change the status of the incident, in remains in the Incidents list as queued. I cannot find clear documentation on what this state means or what action is required to resolve/close the incident.

Can anyone shed any light on the what the queued state means and how to resolve a queued incident.

  • Alex Verboon's avatar
    Alex Verboon
    Copper Contributor

    I still see this as an investigation status for a couple of incidents, any update?

     

  • Thank you Danny for your question. This is actually a display issue, and the team has already investigated it and will work on a solution to address this misleading status.
    • ThoFord's avatar
      ThoFord
      Brass Contributor
      Any update on this display issue, seems like its been there forever...

Resources