Fileless attack alerts deprecation

Author: David Curwin

articles/defender-for-cloud/upcoming-changes.md

@@ -46,6 +46,25 @@ If you're looking for the latest release notes, you can find them in the [What's
 | [Deprecating two security incidents](#deprecating-two-security-incidents) |  | November 2023 |
 | [Defender for Cloud plan and strategy for the Log Analytics agent deprecation](#defender-for-cloud-plan-and-strategy-for-the-log-analytics-agent-deprecation) |  | August 2024 |
 
+## Deprecation of fileless attack alerts
+
+**Announcement date: April 18, 2024**
+
+**Estimated date for change: May 2024**
+
+In May 2024, to enhance the quality of security alerts for Defender for Servers, the fileless attack alerts specific to Windows and Linux virtual machines will be discontinued. These alerts will instead be generated by Defender for Endpoint:
+
+- Fileless attack toolkit detected (VM_FilelessAttackToolkit.Windows)
+- Fileless attack technique detected (VM_FilelessAttackTechnique.Windows)
+- Fileless attack behavior detected (VM_FilelessAttackBehavior.Windows)
+- Fileless Attack Toolkit Detected (VM_FilelessAttackToolkit.Linux)
+- Fileless Attack Technique Detected (VM_FilelessAttackTechnique.Linux)
+- Fileless Attack Behavior Detected (VM_FilelessAttackBehavior.Linux)
+
+All security scenarios covered by the deprecated alerts are fully covered Defender for Endpoint threat alerts.
+
+If you already have the Defender for Endpoint integration enabled, there's no action required on your part. In May 2024 you might experience a decrease in your alerts volume, but still remain protected. If you don't currently have Defender for Endpoint integration enabled in Defender for Servers, you need to enable integration to maintain and improve your alert coverage. All Defender for Server customers can access the full value of Defender for Endpoint's integration at no additional cost. For more information, see [Enable Defender for Endpoint integration](enable-defender-for-endpoint.md).
+
 ## Change in CIEM assessment IDs
 
 **Announcement date: April 16, 2024**