--- title: How Windows Defender ATP Supports Incident Response – Part 2 description: If there’s one thing we’ve learned about data breaches during the past five years, it’s that even the largest retailers, financial institutions, Internet giants and government agencies can be victimized. image: https://info.adaptivedge.com/hubfs/adaptivedge-data-breach.jpg --- Call us Today! (866) 846-7123 [![AdaptivEdge](https://info.adaptivedge.com/hs-fs/hubfs/adaptivedge.png?width=249&height=50&name=adaptivedge.png "AdaptivEdge")](http://adaptivedge.com/) - [Expertise](http://adaptivedge.com/expertise/) - [Microsoft AI Tools](https://adaptivedge.com/expertise/ai-consulting-services/) - [Azure AI](ttps://adaptivedge.com/expertise/azure-ai-consulting/) - [AI Builder](https://adaptivedge.com/expertise/microsoft-ai-builder-consulting/) - [Syntex](https://adaptivedge.com/expertise/microsoft-syntex-consulting/) - [Copilot](https://adaptivedge.com/expertise/microsoft-copilot-consulting/) - [Power Platform](https://adaptivedge.com/expertise/power-platform-consulting/) - [Power BI](https://adaptivedge.com/expertise/power-bi-consulting-and-implementation-services/) - [Power Apps](https://adaptivedge.com/expertise/power-apps-consulting-and-development/) - [Power Automate](https://adaptivedge.com/expertise/power-automate-consulting-and-development/) - [Power Pages](https://adaptivedge.com/expertise/power-pages-consulting-experts/) - [Defender](https://adaptivedge.com/expertise/microsoft-defender-consulting/) - [Defender for Endpoint](https://adaptivedge.com/expertise/microsoft-defender-consulting/endpoint/) - [Defender for Cloud](https://adaptivedge.com/expertise/microsoft-defender-consulting/cloud/) - [Defender for Identity](https://adaptivedge.com/expertise/microsoft-defender-consulting/identity/) - [Defender for Office 365](https://adaptivedge.com/expertise/microsoft-defender-consulting/office-365/) - [Intune](https://adaptivedge.com/expertise/microsoft-intune/) - [Corporate Device Enrollment](https://adaptivedge.com/expertise/microsoft-intune/corporate-device-enrollment/) - [GPO-to-Intune Migration](https://adaptivedge.com/expertise/microsoft-intune/gpo-to-intune-migration/) - [MAM without Enrollment](https://adaptivedge.com/expertise/microsoft-intune/mam-without-enrollment/) - [Device Compliance](https://adaptivedge.com/expertise/microsoft-intune/device-compliance/) - [Microsoft 365](https://adaptivedge.com/expertise/microsoft-365/) - [Azure](https://adaptivedge.com/expertise/microsoft-azure/) - [SharePoint](https://adaptivedge.com/expertise/sharepoint-online/) - [Teams](https://adaptivedge.com/expertise/microsoft-teams/) - [OneDrive](https://adaptivedge.com/expertise/one-drive-for-business/) - [Entra](https://adaptivedge.com/expertise/entra-consulting/) - [Solutions](http://adaptivedge.com/services/) - [M365 Migrations](https://adaptivedge.com/services/microsoft-365-migration-services/) - [SharePoint On-Prem to Online](https://adaptivedge.com/services/sharepoint-migration-services/) - [Divestitures & Carve-Outs](https://adaptivedge.com/services/it-divestiture-and-carve-out-consulting/) - [Mergers and Acquisitions](https://adaptivedge.com/services/it-merger-and-acquisition-m-a-services/) - [Data Center to Azure](https://adaptivedge.com/services/azure-migration-services/) - [Box & Dropbox to M365](https://adaptivedge.com/services/box-and-dropbox-migrations-to-microsoft-365/) - [Google Workspace to M365](https://adaptivedge.com/services/google-workspace-to-microsoft-migrations/) - [File Server to M365](https://adaptivedge.com/services/migrate-file-server-to-microsoft/) - [Enterprise Collaboration](https://adaptivedge.com/services/enterprise-collaboration-consulting/) - [Information Architecture](https://adaptivedge.com/services/microsoft-information-architecture/) - [Web Conferencing](https://adaptivedge.com/services/audio-video-conferencing-consultants/) - [Intranet, Extranet & Portals](https://adaptivedge.com/services/web-portal-intranet-consulting-services/) - [Records & Document Management](https://adaptivedge.com/services/document-management-consulting/) - [IT Security & Compliance](https://adaptivedge.com/services/it-cybersecurity-compliance-consulting-services/) - [Identity & Access Management](https://adaptivedge.com/services/iam-identity-access-management-services/) - [Endpoint & BYOD Security](https://adaptivedge.com/services/endpoint-protection-services-byod-security/) - [Managed Cloud Backup Services](https://adaptivedge.com/services/managed-cloud-backup-consulting/) - [Data Privacy](https://adaptivedge.com/services/data-privacy-security-protection-consulting/) - [Business Process Automation](https://adaptivedge.com/services/business-process-automation-consulting/) - [vCTO](https://adaptivedge.com/services/vcto/) - [Microsoft Licensing CSP](https://adaptivedge.com/services/microsoft-licensing-csp-partner/) - [Project Management](https://adaptivedge.com/services/project-management/) - [About](http://adaptivedge.com/about/) - [Resources](https://info.adaptivedge.com/resources/) - [Contact](http://adaptivedge.com/contact-us/) - [Schedule a Consultation](https://adaptivedge.com/consultation/) # How Windows Defender ATP Supports Incident Response – Part 2 2019-01-24 01:44:33 Posted by [aeadmin](https://info.adaptivedge.com/blog/author/aeadmin) on Jan 23, 2019, 5:44:33 PM - [Tweet](https://twitter.com/share)   In the **[previous post](https://info.adaptivedge.com/blog/why-you-need-an-incident-response-plan-and-how-to-get-started-part-1)**, we discussed why every organization, regardless of how sophisticated its IT security infrastructure and operations are, needs an incident response plan. The first goal is always to prevent a data breach from happening. However, if there’s one thing we’ve learned about data breaches during the past five years, it’s that even the largest retailers, financial institutions, Internet giants and government agencies can be victimized.  That’s why you need to create, document, test and continually update an incident response plan that details exactly what needs to happen after a security incident to restore normal business operations and communicate with those affected. Without proper planning and communication, an organization could suffer irreparable damage. **Part of the problem is the time it takes – several months or more in many cases – to detect an attack.** This extended period of dwell time enables hackers who have already compromised a network to identify and exploit more vulnerabilities, move across the network, and steal, delete and lock down data. As a result, the threat becomes more difficult to eliminate and the recovery process becomes more complicated and expensive. **Slow threat detection is often caused by the high number of alerts generated by security systems that identify threats based on abnormal behavior.** Organizations typically err on the side of caution, choosing to deal with a high number of alerts rather than risk missing a threat. But security teams can easily become bogged down chasing false positives, which delays the analysis of alerts involving truly malicious threats. At the same time, trivial-true positives, which involve alerts that are technically correct but not dangerous, can also drain security resources. In fact, it takes far longer to determine context and triage a trivial-true positive than a false positive. Both create inefficiencies and add cost to security operations and incident response. We recently discussed how [**Windows Defender Advanced Threat Protection (ATP)**](https://info.adaptivedge.com/blog/windows-defender-atp-intelligent-protection-for-modern-threats) uses attack surface reduction to eliminate vulnerabilities and enable organizations to better focus their defenses. Similarly, **Window Defender ATP offers features that aid in incident response by improving the speed and accuracy of threat detection, investigation and remediation.** Windows Defender ATP **[endpoint detection and response capabilities](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/overview-endpoint-detection-response)** make it possible to detect attacks in near real time, aggregate and prioritize alerts, and streamline the investigation of threats. All data is organized and visually represented in the Incidents queue and Alerts queue through the Windows Defender ATP security operations dashboard. Security teams can quickly determine which incidents and alerts require a response. The **[Automated investigations feature](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/automated-investigations-windows-defender-advanced-threat-protection)** uses advanced inspection algorithms and analysis processes to assess alerts and immediately respond to breaches. This significantly reduces the number of alerts that require investigation by human security analysts. Windows Defender ATP also uses [**advanced hunting**](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/overview-hunting-windows-defender-advanced-threat-protection) to enable security teams to track down potential threats, using a sophisticated search and query tool and custom detection rules. While data breach prevention continues to be the top priority, organizations must assume that a breach will happen and plan accordingly. Let us show you how Windows Defender ATP supports incident response and helps you minimize the impact of security incidents. **Written and composed by Principal, Steve Soper** Tags: [Technology](https://info.adaptivedge.com/blog/tag/technology), [cybersecurity](https://info.adaptivedge.com/blog/tag/cybersecurity), [Microsoft](https://info.adaptivedge.com/blog/tag/microsoft), [Windows Defender ATP](https://info.adaptivedge.com/blog/tag/windows-defender-atp) [![Microsoft Teams Switch on the  Power of Teamwork Today!](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/3330897/e809e402-adcc-4aa6-b6ad-e2bcf0c26763.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/3330897/e809e402-adcc-4aa6-b6ad-e2bcf0c26763) ### We're here to help! We'd love to find out more about the projects and initiatives you're working on to exchange ideas and provide some high-level guidance where we can.  We love learning from others as well as sharing some of our experience and lessons learned.  [Let's talk!](http://adaptivedge.com/contact-us/) ### Subscribe to Email Updates ### Recent Posts ### Posts by Tag - [SharePoint (47)](https://info.adaptivedge.com/blog/tag/sharepoint) - [Microsoft (44)](https://info.adaptivedge.com/blog/tag/microsoft) - [Technology (37)](https://info.adaptivedge.com/blog/tag/technology) - [Office 365 (32)](https://info.adaptivedge.com/blog/tag/office-365) - [adaptivedge (27)](https://info.adaptivedge.com/blog/tag/adaptivedge) - [cybersecurity (26)](https://info.adaptivedge.com/blog/tag/cybersecurity) - [microsoft gold partner (20)](https://info.adaptivedge.com/blog/tag/microsoft-gold-partner) - [OneDrive (19)](https://info.adaptivedge.com/blog/tag/onedrive) - [ATS (18)](https://info.adaptivedge.com/blog/tag/ats) - [HRIS (18)](https://info.adaptivedge.com/blog/tag/hris) - [Human Resources (18)](https://info.adaptivedge.com/blog/tag/human-resources) - [Azure (17)](https://info.adaptivedge.com/blog/tag/azure) - [MS Announcement (16)](https://info.adaptivedge.com/blog/tag/ms-announcement) - [Microsoft Entra (15)](https://info.adaptivedge.com/blog/tag/microsoft-entra) - [data loss prevention (14)](https://info.adaptivedge.com/blog/tag/data-loss-prevention) - [microsoft teams (14)](https://info.adaptivedge.com/blog/tag/microsoft-teams) - [DLP (13)](https://info.adaptivedge.com/blog/tag/dlp) - [Office 2013 (12)](https://info.adaptivedge.com/blog/tag/office-2013) - [Purview (12)](https://info.adaptivedge.com/blog/tag/purview) - [bookings (12)](https://info.adaptivedge.com/blog/tag/bookings) - [exchange (12)](https://info.adaptivedge.com/blog/tag/exchange) - [outlook (12)](https://info.adaptivedge.com/blog/tag/outlook) - [Cloud (10)](https://info.adaptivedge.com/blog/tag/cloud) - [Governance (8)](https://info.adaptivedge.com/blog/tag/governance) - [microsoft 365 (8)](https://info.adaptivedge.com/blog/tag/microsoft-365) - [security (8)](https://info.adaptivedge.com/blog/tag/security) - [Enterprise (7)](https://info.adaptivedge.com/blog/tag/enterprise) - [Private Cloud (7)](https://info.adaptivedge.com/blog/tag/private-cloud) - [Onboarding (6)](https://info.adaptivedge.com/blog/tag/onboarding) - [cyberattack (6)](https://info.adaptivedge.com/blog/tag/cyberattack) - [system center (6)](https://info.adaptivedge.com/blog/tag/system-center) - [IoT (5)](https://info.adaptivedge.com/blog/tag/iot) - [Mobile HR (5)](https://info.adaptivedge.com/blog/tag/mobile-hr) - [PowerShell (5)](https://info.adaptivedge.com/blog/tag/powershell) - [Teams (5)](https://info.adaptivedge.com/blog/tag/teams) - [microsoft azure (5)](https://info.adaptivedge.com/blog/tag/microsoft-azure) - [Active Directory (4)](https://info.adaptivedge.com/blog/tag/active-directory) - [Compliance (4)](https://info.adaptivedge.com/blog/tag/compliance) - [Employee Engagement (4)](https://info.adaptivedge.com/blog/tag/employee-engagement) - [Employee Satisfaction (4)](https://info.adaptivedge.com/blog/tag/employee-satisfaction) - [Licensing (4)](https://info.adaptivedge.com/blog/tag/licensing) - [O365 (4)](https://info.adaptivedge.com/blog/tag/o365) - [Secure Score (4)](https://info.adaptivedge.com/blog/tag/secure-score) - [privileged accounts (4)](https://info.adaptivedge.com/blog/tag/privileged-accounts) - [AI (3)](https://info.adaptivedge.com/blog/tag/ai) - [Adaptive Edge (3)](https://info.adaptivedge.com/blog/tag/adaptive-edge) - [Classification (3)](https://info.adaptivedge.com/blog/tag/classification) - [Collaboration (3)](https://info.adaptivedge.com/blog/tag/collaboration) - [Data (3)](https://info.adaptivedge.com/blog/tag/data) - [E5 (3)](https://info.adaptivedge.com/blog/tag/e5) - [Education (3)](https://info.adaptivedge.com/blog/tag/education) - [IaaS (3)](https://info.adaptivedge.com/blog/tag/iaas) - [Labels (3)](https://info.adaptivedge.com/blog/tag/labels) - [PaaS (3)](https://info.adaptivedge.com/blog/tag/paas) - [Power BI (3)](https://info.adaptivedge.com/blog/tag/power-bi) - [Remote Workforce (3)](https://info.adaptivedge.com/blog/tag/remote-workforce) - [SCCM (3)](https://info.adaptivedge.com/blog/tag/sccm) - [SQL (3)](https://info.adaptivedge.com/blog/tag/sql) - [Search (3)](https://info.adaptivedge.com/blog/tag/search) - [Storage (3)](https://info.adaptivedge.com/blog/tag/storage) - [identity management (3)](https://info.adaptivedge.com/blog/tag/identity-management) - [AI & Copilot (2)](https://info.adaptivedge.com/blog/tag/ai-copilot) - [API (2)](https://info.adaptivedge.com/blog/tag/api) - [Autmoation (2)](https://info.adaptivedge.com/blog/tag/autmoation) - [Azure AD (2)](https://info.adaptivedge.com/blog/tag/azure-ad) - [BI (2)](https://info.adaptivedge.com/blog/tag/bi) - [Backup & Recovery (2)](https://info.adaptivedge.com/blog/tag/backup-recovery) - [Copilot Cowork (2)](https://info.adaptivedge.com/blog/tag/copilot-cowork) - [GitHub (2)](https://info.adaptivedge.com/blog/tag/github) - [IT Administration (2)](https://info.adaptivedge.com/blog/tag/it-administration) - [Intune (2)](https://info.adaptivedge.com/blog/tag/intune) - [Microsoft 365 Updates (2)](https://info.adaptivedge.com/blog/tag/microsoft-365-updates) - [Microsoft Dynamics (2)](https://info.adaptivedge.com/blog/tag/microsoft-dynamics) - [Microsoft Graph (2)](https://info.adaptivedge.com/blog/tag/microsoft-graph) - [PAWS (2)](https://info.adaptivedge.com/blog/tag/paws) - [People Analytics (2)](https://info.adaptivedge.com/blog/tag/people-analytics) - [Performance (2)](https://info.adaptivedge.com/blog/tag/performance) - [SKU (2)](https://info.adaptivedge.com/blog/tag/sku) - [Safety (2)](https://info.adaptivedge.com/blog/tag/safety) - [Security & Compliance (2)](https://info.adaptivedge.com/blog/tag/security-compliance) - [Server (2)](https://info.adaptivedge.com/blog/tag/server) - [Windows Defender ATP (2)](https://info.adaptivedge.com/blog/tag/windows-defender-atp) - [Workflow Automation (2)](https://info.adaptivedge.com/blog/tag/workflow-automation) - [Zero Trust (2)](https://info.adaptivedge.com/blog/tag/zero-trust) - [copilot studio (2)](https://info.adaptivedge.com/blog/tag/copilot-studio) - [microsoft ignite (2)](https://info.adaptivedge.com/blog/tag/microsoft-ignite) - [Agentic AI (1)](https://info.adaptivedge.com/blog/tag/agentic-ai) - [Artificial Intelligence (1)](https://info.adaptivedge.com/blog/tag/artificial-intelligence) - [Attack Surface (1)](https://info.adaptivedge.com/blog/tag/attack-surface) - [BYOL (1)](https://info.adaptivedge.com/blog/tag/byol) - [Business (1)](https://info.adaptivedge.com/blog/tag/business) - [Business Requirements (1)](https://info.adaptivedge.com/blog/tag/business-requirements) - [CASB (1)](https://info.adaptivedge.com/blog/tag/casb) - [CRM (1)](https://info.adaptivedge.com/blog/tag/crm) - [Cloud Computing (1)](https://info.adaptivedge.com/blog/tag/cloud-computing) - [Coexistence (1)](https://info.adaptivedge.com/blog/tag/coexistence) - [Customer Relationship Management (1)](https://info.adaptivedge.com/blog/tag/customer-relationship-management) - [DBaaS (1)](https://info.adaptivedge.com/blog/tag/dbaas) - [DMZ (1)](https://info.adaptivedge.com/blog/tag/dmz) - [Datacenter (1)](https://info.adaptivedge.com/blog/tag/datacenter) - [ERP (1)](https://info.adaptivedge.com/blog/tag/erp) - [Enterprise Visual Studio (1)](https://info.adaptivedge.com/blog/tag/enterprise-visual-studio) - [Group Writeback (1)](https://info.adaptivedge.com/blog/tag/group-writeback) - [HRSM (1)](https://info.adaptivedge.com/blog/tag/hrsm) - [Hybrid (1)](https://info.adaptivedge.com/blog/tag/hybrid) - [Infrastructure (1)](https://info.adaptivedge.com/blog/tag/infrastructure) - [LAPS (1)](https://info.adaptivedge.com/blog/tag/laps) - [Millennials (1)](https://info.adaptivedge.com/blog/tag/millennials) - [OMS (1)](https://info.adaptivedge.com/blog/tag/oms) - [OSD (1)](https://info.adaptivedge.com/blog/tag/osd) - [Offboarding (1)](https://info.adaptivedge.com/blog/tag/offboarding) - [Office 365 Groups (1)](https://info.adaptivedge.com/blog/tag/office-365-groups) - [PXE (1)](https://info.adaptivedge.com/blog/tag/pxe) - [Payroll (1)](https://info.adaptivedge.com/blog/tag/payroll) - [Performance Reviews (1)](https://info.adaptivedge.com/blog/tag/performance-reviews) - [Recruiting (1)](https://info.adaptivedge.com/blog/tag/recruiting) - [Requirements Gathering (1)](https://info.adaptivedge.com/blog/tag/requirements-gathering) - [SUP (1)](https://info.adaptivedge.com/blog/tag/sup) - [SaaS (1)](https://info.adaptivedge.com/blog/tag/saas) - [Servers (1)](https://info.adaptivedge.com/blog/tag/servers) - [Skype (1)](https://info.adaptivedge.com/blog/tag/skype) - [Succession Planning (1)](https://info.adaptivedge.com/blog/tag/succession-planning) - [TEM (1)](https://info.adaptivedge.com/blog/tag/tem) - [Training and Development (1)](https://info.adaptivedge.com/blog/tag/training-and-development) - [Travel and Expense (1)](https://info.adaptivedge.com/blog/tag/travel-and-expense) - [UEBA (1)](https://info.adaptivedge.com/blog/tag/ueba) - [Unified Groups (1)](https://info.adaptivedge.com/blog/tag/unified-groups) - [UserVoice (1)](https://info.adaptivedge.com/blog/tag/uservoice) - [VM (1)](https://info.adaptivedge.com/blog/tag/vm) - [Virtualization (1)](https://info.adaptivedge.com/blog/tag/virtualization) - [Windows 10 (1)](https://info.adaptivedge.com/blog/tag/windows-10) - [custom scripts (1)](https://info.adaptivedge.com/blog/tag/custom-scripts) - [digital transformation (1)](https://info.adaptivedge.com/blog/tag/digital-transformation) - [disk utilization (1)](https://info.adaptivedge.com/blog/tag/disk-utilization) - [geotagging (1)](https://info.adaptivedge.com/blog/tag/geotagging) - [identity (1)](https://info.adaptivedge.com/blog/tag/identity) - [identity perimeter (1)](https://info.adaptivedge.com/blog/tag/identity-perimeter) - [mobile workforces (1)](https://info.adaptivedge.com/blog/tag/mobile-workforces) - [orchestrator (1)](https://info.adaptivedge.com/blog/tag/orchestrator) - [phishing (1)](https://info.adaptivedge.com/blog/tag/phishing) - [scom (1)](https://info.adaptivedge.com/blog/tag/scom) - [sharing (1)](https://info.adaptivedge.com/blog/tag/sharing) - [software update (1)](https://info.adaptivedge.com/blog/tag/software-update) - [windows automation (1)](https://info.adaptivedge.com/blog/tag/windows-automation) - [windows server (1)](https://info.adaptivedge.com/blog/tag/windows-server) - [workgroup (1)](https://info.adaptivedge.com/blog/tag/workgroup) see all ### OUR COMPANY As a Microsoft Gold Partner, AdaptivEdge helps customers evaluate various product options from a financial perspective as well as from a business and technical perspective. ### LINKS - [Home](http://adaptivedge.com/) - [Company](http://adaptivedge.com/about/) - [Expertise](http://adaptivedge.com/expertise/) - [Services](http://adaptivedge.com/services/) - [News & Events](http://adaptivedge.com/news-events/) - [Blog](http://adaptivedge.com/blog/) - [Contact](http://adaptivedge.com/contact-us/) ### Latest Posts ### SIGN-UP FOR OUR EMAIL LIST Sign-up below for updates about AdaptivEdge today! ### Footer Newsletter - - - Copyright © 2026. AdaptivEdge, LLC. All rights reserved. Designed by [Bound-by Marketing](http://www.boundbymarketing.com)