2 docs tagged with "response"

The Defender for Identity alert catalogue by kill-chain phase, what replaced lateral movement paths, entity tags, exclusions versus alert tuning, identity posture assessments, response actions and the action account, and the Identity* Advanced Hunting tables with ready KQL.

Every action on a Defender portal device page, what it does, what it needs, OS support and how to undo it, then Live Response in depth with the command set, library, limits and the API.