Defender for Identity: the critical role of identities in automatic attack disruption

Randy Smith's course gives insight to the detections MDI provides. Like wel'll always see three 4624 logins when Kerberos ocurs host (service), krbtgt, user.  Along with 4768/4769, those 3 events make MDI analysis more direct.  https://www.ultimatewindowssecurity.com/securitylog/training/