2.4. Configure Notifications, Automated Investigation, and Attack Disruption

💡 First Principle: Defender XDR already knows how to detect, investigate, and contain many threats on its own. The SOC's configuration job is to decide three things: who hears about what (notifications), what gets quietly handled because it's known to be benign (tuning), and how much the platform may do without asking (automated investigation and attack disruption). Each setting trades human attention against machine speed.

Why care: every hour analysts spend on alerts a machine could have closed is an hour not spent on the incident that matters, and every minute an attacker spends unhindered between detection and containment is a minute of lateral movement. The features in this section are Microsoft's answer to both problems, and the exam tests whether you know what each one does on its own and what it needs from you.

Think of the platform as a building's fire system. Notifications are the alarm panel that pages the right people. Alert tuning is the list of known false triggers, such as the kitchen toaster, that shouldn't wake the fire brigade. Automated investigation and response is the sprinkler system: it investigates the smoke and puts out common fires automatically, asking permission first in rooms you've marked sensitive. Automatic attack disruption is the set of fire doors that slam shut on their own when the system is highly confident a real fire is spreading.

⚠️ Common Misconception: "Alert tuning rules stop the threat." Tuning hides or resolves alerts; it blocks nothing. A tuning rule written too broadly creates a blind spot attackers can hide inside. A second trap: assuming attack disruption is a playbook you must build. It's built into Defender XDR; your job is to meet its prerequisites, manage exclusions, and review or release its containment actions.