Preview
The `DisruptionAndResponseEvents` table, now available in advanced hunting, contains information about automatic attack disruption events in Microsoft Defender XDR.
Why it matters: In preview
The `DisruptionAndResponseEvents` table, now available in advanced hunting, contains information about automatic attack disruption events in Microsoft Defender XDR. These events include both block and policy application events related to triggered attack disruption policies, and automatic actions that were taken across related workloads. Increase your visibility and awareness of active, complex attacks disrupted by attack disruption to understand the attacks' scope, context, impact, and actions taken.
Affected: Microsoft Defender XDR, Advanced Hunting