SOP-40: Zero-Hour Auto Purge ZAP Triggered Response

SOC analyst SOP for Microsoft Defender ZAP actions. Covers ZAP verification, pre-ZAP access detection, campaign scope analysis, and endpoint triage.