Attack Simulation and Telemetry

Microsoft is generating its detection test logs, and admitting what they do not prove

A Defender research write-up turns MITRE ATT&CK procedures into synthetic process logs so rules can be exercised without range time. It also says synthetic logs are not attack reproduction.