Missing Advanced Hunting action types for ASR rules in preview mode
Are there no AH action types for ASR rules in preview mode available yet?
Or is this currently undocumented?
Not finding any AH action types for:
– Block use of copied or impersonated system tools (preview)
– Block rebooting machine in Safe Mode (preview)
Are there no AH action types for ASR rules in preview mode available yet?Or is this currently undocumented? Not finding any AH action types for:- Block use of copied or impersonated system tools (preview)- Block rebooting machine in Safe Mode (preview) Ref: https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#per-rule-descriptions Read More