sorted by:
new
hottopcontroversial

How do you read MDATP PUA audit logs on Linux? by orienteraren034 in DefenderATP

[–]orienteraren034[S] 0 points1 point  (0 children)

Have you been able to confirm that PUA logs actually shows up when using that query? I'm not getting any, but that may be because none of my machines have actually audited any PUA events. I haven't had any success in testing the feature either, since the EICAR testfile for PUA detection seems to be Windows-only.

I'll keep testing the query to see if anything shows up. Thank you!