Let’s talk

UK Water Utility

Native automated account containment

Automate endpoint investigation and response

I enabled Microsoft Defender Attack Disruption and its automatic account-disablement capability. This was configuration of a native response feature. The KQL used to identify accounts Defender had disabled was an investigation query, separate from the product’s containment action.

PowerShellKQLDefender Live ResponseDefender Attack DisruptionPersistence analysisEndpoint configurationRunbook developmentMicrosoft Defender for EndpointMicrosoft Entra ID
Return to the full story ←

Your exploration

Viewed history

Saved only in this browser.

Ask my portfolio

Ask about my work.

Skills, achievements, technical detail. Follow the evidence.

Every answer links to the work.
How this works

When AI is connected, your question, recent questions and relevant published pages are sent to MiniMax to select supporting passages. Otherwise, this searches the site directly. Answers quote the saved website and link to their sources. This website does not save chat transcripts. Clearing or leaving the page clears this conversation.