Detections, lateral movement paths and response actions
The Defender for Identity alert catalogue by kill-chain phase, what replaced lateral movement paths, entity tags, exclusions versus alert tuning, identity posture assessments, response actions and the action account, and the Identity* Advanced Hunting tables with ready KQL.
Secure Score, Exposure Management and Threat analytics
What Microsoft Secure Score measures and how points are awarded, how Security Exposure Management builds attack paths, critical assets and initiatives on top of MDE, MDVM, MDI, MDA, Entra and Defender for Cloud signals, how Threat analytics maps a tracked threat to your exposure, and how to turn the three into a prioritised work list for a client.