**Microsoft Defender for Identity** is one of the most powerful tools for detecting on-premises Active Directory attacks — but out of the box, it's also one of the noisiest. If you've deployed MDI sensors and found yourself drowning in alerts about suspicious LDAP queries, encryp