Endpoint detection and response (EDR) in block mode is a new capability in Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) It turns EDR detections into blocking and containment of malicious behaviors. This capability uses Microsoft Defender ATPs industry-leading visibility and detection capability to provide an additional layer of post-breach blocking of malicious behavior, malware, and other artifacts that your primary antivirus solution might miss. The ability of this feature to detect and stop threats in real time, even after they have started running, empowers organizations to thwart cyberattacks.”]