IP addresses can now be excluded from automated responses in attack disruption

February 2025

• (Preview) IP addresses can now be excluded from automated responses in attack disruption. This feature allows you to exclude specific IPs from automated containment actions triggered by attack disruption. For more information, see Exclude assets from automated responses in automatic attack disruption.
• (Preview) The PrivilegedEntraPimRoles column is available for preview in the advanced hunting IdentityInfo table.