For Anomalous RPC detections of any kind, the source endpoint will be network contained

For Anomalous RPC detections of any kind, the source endpoint will be added to a watchlist and network contained

Any Identity Protection detections for Anomalous RPC (ZeroLogon) will result in the source endpoint being added to the watchlist and network contained

Any Identity Protection detections for Anomalous RPC (ZeroLogon) will result in the source user being added to the watchlist and restricted from future logons