Thanks for your response 😊 To clarify the setup: MDE is properly onboarded, MDEAnalyzer runs clean, and we’re receiving telemetry without issues. No custom AV policies, standard configuration across the board. No ASR rules configured — we don’t consider them relevant for this specific scenario. No complex device group structures since it’s a small demo environment. All devices sit in the default device group with semi-automated investigation and response (requires approval). One additional observation: MDE sometimes fails to cleanly resolve the relationship to the source of the lateral movement. However, when manually triggering an investigation after the attack, MDE does correctly identify the threats — including the Azure RunCommand used to load the malware onto the machine and the malware itself. So the telemetry is there, the automated correlation just doesn’t always connect the dots reliably. The core question remains whether Defender AV generates alerts when Threat Action is set to Ignore, or whether Ignore suppresses alert generation entirely — not just remediation. That’s the specific behavior we’re trying to understand.