EDR Endpoint Containment / Suspicious Process Tree Investigation Investigates suspicious process execution chains, terminates malicious processes, and collects forensic evidence from the endpoint. · size 20 · threshold 4 · max attempts 3