Hey,
Let`s say we have a malicious case with multiple account entities , or even host entities.
and we also have a block for mitigation actions in EDR \\ AAD, but we want to block only one of each entities, not all.
Is there a way to perform this task automatically?
If not, is there a way to pop a window to the analysts to write or select the relevant entities?
generally, do you have any best practices for these kind of actions?
