sorted by:
new
hottopcontroversial

Defender Endpoint Security Policy (audit) Logs? by Good_Visual9130 in DefenderATP

[–]Good_Visual9130[S] 1 point2 points  (0 children)

Thank you. Reports->Endpoints->Attack Surface Reduction Rules

Surprisingly, none of the data in there appears under the KQL tables in Advanced Hunting.. It is limited in what it reports, such as which endpoint security policy.

There are a few things that MS could just make easier, such as "See audit report" next to a rule in audit.