Merge pull request #616 from MicrosoftDocs/siosulli-resource-manager

Update device-timeline-event-flag.md

Author: siosulli

defender-endpoint/device-timeline-event-flag.md

@@ -99,6 +99,12 @@ To use [advanced hunting](/defender-xdr/advanced-hunting-overview) to find event
 
 > [!NOTE]
 > Querying using the **Hunt for related events** button from a Technique side pane displays all the events related to the identified technique but does not include the Technique itself in the query results.
+ 
+ ### EDR client (MsSense.exe) Resource Manager 
+
+When the EDR client on a device is running low on resources, it enters critical mode to maintain the normal working operation of the device. The device won't process new events until the EDR client returns to a normal state. A new event appears in the **Timeline** for that device indicating that the EDR client switched to **Critical** mode. 
+
+When the EDR client's resource usage goes back to normal levels, it will automatically return to normal mode.
 
 ### Customize your device timeline