An alert banner is a starting point, not a complete incident record. Open Windows Security directly and select Protection history to inspect what the installed protection actually recorded. Avoid using a link or phone number from an unexpected browser warning as your route into support.

Microsoft documents that Protection history retains events for two weeks. Record relevant details promptly if they are needed for an investigation rather than assuming the entry will remain indefinitely.

Read the event state before choosing an action

Select the relevant card to expand it. Administrator privileges are required to review threat details. Note the time, detection name, affected item and displayed action or status, while keeping any private paths out of a public post.

Threat blocked means Defender blocked and removed the threat. Threat quarantined means it has been blocked and quarantined but not yet removed. Remediation incomplete means the attempted cleanup did not finish and the card needs further attention.

These states should not be compressed into the same description. For an uncertain item requiring a choice, Microsoft advises quarantine rather than allowing it on the device.

Preserve enough context for the next decision

Write down what you were doing before the event: opening an attachment, downloading a file or connecting storage. Keep observations separate from guesses about where the item came from.

Do not restore or allow a file merely because an application now asks for it. Establish the file’s legitimate source and the reason for the detection through the publisher or an appropriate support route first.

If remediation is incomplete, follow the details shown by Windows Security and seek help when the required action is unclear. On a managed work computer, provide the record to the administrator rather than changing protection policy yourself.

Finally, check the current status after the approved action. An old card describing a blocked item and a new unresolved event are different findings. Keep both dates when reporting progress so a historical alert is neither ignored nor mistaken for proof of continuing infection.

Sources: Microsoft Protection History.