Q: What is the timeout for the Evidence of Compromise search within EDR1.0/ATP 2.3? Does it change for 3.0?
A: The timeout for commands is 7 days in ATP v2.3. This does not change in v3.0, however, in 3.0 the architecture is different and the commands are sent directly to each endpoint directly.