Summary
In this chapter, we covered monitoring with MDATP. We learned how to investigate an alert and reviewed the threat analytics, Threat & Vulnerability Management, and machine health and compliance dashboards. We covered how to onboard Windows 10 endpoints and create a machine risk compliance policy in Intune from the MDATP Intune connector. Next, we learned how to use Azure Log Analytics. We covered installing gallery solutions, such as ServiceMap and Wire Data 2.0, which help to quantify the data being captured with charts and visuals. We also provided an overview of Azure Monitor, including using Azure activity logs to audit operations taken on your resources.
In the next section, we discussed ASC and provided the steps to enable advanced features and to onboard machines. Finally, we discussed the importance of capturing performance baselines in addition to building security baselines. Now that we have learned how to configure telemetry to capture performance and security...
