What this demo shows
- Defender for Identity sensor deployment on the domain controller
- Identity alerts and how they correlate with endpoint activity
- Hardening that removes the conditions these techniques rely on (service account hygiene, tiered admin, LAPS)
Status
The recording and detection notes will be published here once the scenario is complete.