What this demo shows
- Attack surface reduction rules and tamper protection switched on, and the difference they make
- How alerts from the workstation are grouped into a single incident in Defender XDR
- Automated investigation and response, and when to use manual response actions
Status
The recording and detection notes will be published here once the scenario is complete.