WD ATP Processing / Flow

[abeerq]

Hi All,

Assuming that I have enabled all the features/capabilities of WD ATP and received and infected file, in which order do we examine the file? i.e. do we detect first with antivirus then check attack surface reduction if we have both enabled? Just trying to understand the flow through the different features when all are enabled, which one do we start with and why? 

Thanks! 

[#2]

@abeerq Enable automatic investigation and it should take care of most of the steps

https://techcommunity.microsoft.com/t5/microsoft-defender-atp/automate-the-boring-for-your-soc-with-...