Can you clean this up: 

I want the whole space and the whole evolution of ITDR. How did identity evolve into this.
If I cannot attack this point at all, then I’m going to start a little bit upstream. I’m going to make a change that will allow me to gain access. 
So people started to attack identity.
Solar winds – They didn’t try to force their way into the victims email. They said hey things are connected here. For users, in order to get access to email in Azure, they need to authenticate with on prem active directory, so they attacked the system that gives the Azure token. 
The private key to mint those tokens, if you steal it, you’re in because then you can mint a token for anyone you like.
Solarwinds installs their own software automatically in their customer’s environment. So basically for the attack, they added a piece of their code to legitimate solarwinds code. Also there was a piece from Microsoft called active directory something. 
So now the administrator account would be compromised. SO they go in as administrator, and change access to the accounts they need to get access sto. 
The identity system, can be attacked in a lot of ways. 
ITDR vendors also operationalize threat detection and response in identity systems. Sometimes, an attack dosen’t  track to the level of the system, people are still attacking individual accounts. But these attacks are interesting enough that you want to react to them. But the system can protect them, but the sophisitication of the attackers go far beyond what the vendors can protect. It’s cat and mouse, but htye’re not doing it as fast as attackers are evolving. 
Active Directory is a legacy system. There are active flaws in the system underlying that they’re never going to fix because there’s millions and millions of customers. They don’t actively maintain it anymore. 
That’s where this ITDR ATDR stuff comes in.

I mentioned last time, it’s a point where things might develop the other way. Okta might say I want to protect my own platform. So far they haven’t done that. So there’s an opportunity here for third party vendors to provide value and make money.
So here’s how ITDR connects to identity. 

ITDR vs ATDR.
Most folks started with ATDR, it’s a real system with known limintations, so around 2014, a whole bunch of companies started looking at this. MSFT had 2 systems, ATP, and ATA. It had sensors on prem and in the cloud. One of them became Micrisoft threat defender. 
In 2017, people realized attacks against active directory are common. Some vendors, say theyr’e ITDR vend Provide two versions of response separated with exactly 6 asterisk symbols: ******.
user