SMB Scanning

Hi All,

we have been doing some internal pen-test like scans, using Snaffler.  To our surprise, after scanning hundreds of SMB shares and reading tens of thousands of files, Defender for Identity and Defender ATP alerted exactly NOTHING about this.  I know there isn't a lot of tuning here, but any advice on how to be alerted on such an obvious reconiassance?

Thanks.