Merge pull request #5431 from MicrosoftDocs/main

[AutoPublish] main to live - 10/31 19:53 PDT | 11/01 08:23 IST

Author: m365-skilling-repo-management[bot]

.openpublishing.redirection.defender-xdr.json

@@ -215,6 +215,16 @@
       "redirect_url": "/unified-secops-platform/mto-dashboard",
       "redirect_document_id": false
     },
+    {
+      "source_path": "defender-xdr/configure-deception.md",
+      "redirect_url": "/defender-xdr/automatic-attack-disruption",
+      "redirect_document_id": false
+    },
+  {
+      "source_path": "defender-xdr/deception-overview.md",
+      "redirect_url": "/defender-xdr/automatic-attack-disruption",
+      "redirect_document_id": false
+    },
     {
       "source_path": "defender-xdr/mto-endpoint-security-policy.md",
       "redirect_url": "/unified-secops-platform/mto-endpoint-security-policy",

defender-endpoint/advanced-features.md

@@ -2,8 +2,8 @@
 title: Configure advanced features in Microsoft Defender for Endpoint
 description: Turn on advanced features such as block file in Microsoft Defender for Endpoint.
 ms.service: defender-endpoint
-ms.author: bagol
-author: batamig
+ms.author: painbar
+author: paulinbar
 ms.reviewer: yongrhee
 ms.localizationpriority: medium
 manager: bagol
@@ -14,7 +14,7 @@ ms.collection:
 ms.topic: how-to
 ms.subservice: onboard
 search.appverid: met150
-ms.date: 02/25/2025
+ms.date: 10/31/2025
 appliesto:
   - Microsoft Defender for Endpoint Plan 2
 
@@ -165,9 +165,9 @@ For more information about role assignments, see [Create and manage roles](user-
 
 Enabling this feature allows you to run unsigned scripts in a live response session.
 
-## Deception
+## Automatic attack disruption
 
-Deception enables your security team to manage and deploy lures and decoys to catch attackers in your environment. After you turn this on, go to Rules > Deception rules to run deception campaigns. See [Manage the deception capability in Microsoft Defender XDR](/defender-xdr/deception-overview).
+Automatic attack disruption disrupts attacks by automatically containing compromised assets that the attacker is using. It limits lateral movement early on, thereby reducing the overall impact of an attack, both on the associated costs and on  loss of productivity. At the same time, it leaves security operations teams in complete control of investigating, remediating, and bringing assets back online. For more information, see [Automatic attack disruption in Microsoft Defender XDR](/defender-xdr/automatic-attack-disruption).
 
 ## Share endpoint alerts with Microsoft Compliance Center
 

defender-xdr/TOC.yml

@@ -147,12 +147,6 @@
           href: autoad-results.md
         - name: Exclude assets from automated responses
           href: automatic-attack-disruption-exclusions.md           
-      - name: Manage the deception capability
-        items:
-        - name: Overview
-          href: deception-overview.md
-        - name: Configure capabilities
-          href: configure-deception.md
       - name: Search for threats with advanced hunting
         items:
         - name: Overview