When automate bans a file hash, how many machines are affected?
Microsoft Defender for Endpoint
When Red Canary bans a file hash via automate, the scope is automatically set to all endpoints on the Microsoft Defender side.
You can view any file hash bans by logging into your Microsoft 365 Defender console and going to Settings | Endpoints | Indicators. The title column will notate "Red Canary Automate" to indicate this was created via automation.