Which types of alerts do you investigate immediately, and which do you tend to defer?

kevin.joyce (Kevin Joyce) July 21, 2025, 6:11pm 1

Topic		Replies	Views
If you could enhance one aspect of the detection or investigation experience, what would it be? Discussions & Questions threat-manager , weekly-product-discussion	1	14	July 18, 2025
When Endpoint Protector alerts you of a potential data breach (e.g. unauthorized data transfers), what steps do you typically follow? Discussions & Questions endpoint-protector , weekly-product-discussion	2	22	July 29, 2025
Have you tried creating custom activity reports or alerts with Investigations? What information did you need to get? Did it work for you? Discussions & Questions 1secure , weekly-product-discussion	0	5	July 15, 2025
What types of changes do you most frequently monitor using the “User Activity” or “Logon Activity” reports—and why are those important for your team? Discussions & Questions auditor , weekly-product-discussion	0	19	July 21, 2025
How has the ability to block certain behaviors impacted your team's ability to maintain control of Active Directory? Discussions & Questions threat-prevention , weekly-product-discussion	3	21	July 16, 2025