Microsoft Detection and Response Team (DART) AMA

I think for most of us, it's figuring out a balance of how many hours to work a day during an incident as we will be going on for days when a customer is breached. We are humans, the customers defenders are human and sometimes someone needs to make the call on "Hey, we need to call it a night and give people rest!". Luckily, DART Leads are great at communicating to customer sponsors on the rotating and rest part of the incident.