Chapter 11: Security Monitoring and Reporting

In this chapter, we will provide solutions for security monitoring and reporting within your environment. In previous chapters, we learned about what is needed to implement and enforce a secure environment for your users and Windows systems. Now that the baselines have been enforced and documented controls are in place, we need to ensure that monitoring and reporting programs are available to alert you of potential vulnerabilities or weaknesses within your environment. Next, we will review the different solutions used to capture telemetry and query data to provide insights and recommendations for keeping our environment secure.

First, we will review monitoring with Microsoft Defender Advanced Threat Protection (MDATP). Within this section, we will cover areas such as investigating an alert, as well as provide an overview of the different dashboards used to report on threats and the overall exposure of your environment. Next, we will...