EDR Endpoint Containment / Ransomware Canary Investigation Investigates modifications to ransomware canary files to identify the accessing account, process, and possible encryption activity. · size 20 · threshold 4 · max attempts 3