When running a cloud Threat Defense for Active Directory (TDAD) proof-of-concept (PoC) and testing generating events and incidents, in some cases an event is not generating a corresponding incident in the Integrated Cyber Defense Manager (ICDm) console when it is supposed to do so. The event is visible in the client's activity history, but there are missing values under the "Actor process" section of the event.
Component : Active Directory
File and Folder exclusions of test tools cause the protection engine not to track related processes.