SOP-07: Data Exfiltration & DLP Alert Response

SOC analyst playbook for data exfiltration and DLP alert response. Covers DLP triggers, volume classification, sensitive data identification, process forensics with KQL and SPL, Defender XDR containment, and legal/compliance escalation. Includes full investigation workflow diagram.