Defensive Use
Use MSAA for authorized auditing, monitoring, investigation, and education.
Security
Defensive audit tooling requires careful review.
MSAA is a defensive security and audit tool. Findings are not proof of compromise. Preserve logs during suspected incidents and only monitor systems you own or are authorized to assess.
Evidence First
Create reports and snapshots before cleanup or remediation changes the system.
Review Required
Findings need human validation, context, false-positive review, and careful remediation planning.