Event details
eyalh
Microsoft
MicrosoftThanks for the question Peter. Automatic attack disruption is enabled by default for Microsoft 365 Defender customers (in public preview, at present). The feature is not affected by the queue you described. Disrupt actions are taken automatically in attack disruption scenarios and do not have a pending state. You can learn more about related configuration options (e.g., to exclude specific assets from automation), and prerequisites here.
is there any way to confirm activation? in an organisation with mixed E3 and E5 licensing, or just some users with +E5 security.
is it just - got E5 and its on - assume you are good unless you have added daft exclusion?
Hadar FeldmanThe simplest answer is - your environment is at the safest setup, when E5 is fully deployed and all sensors are well configured. The reason is that attack disruption is XDR capability - it requires multiple signals from multiple sources to gain confidence and to act on the compromised assets (MDE, MDI, MDA...). That said, we can double click together on your specific setup and see what capabilities are applicable and where, as you may have some partial coverage provided by disruption,