Further reading
For more detail about some topics in this chapter, you can refer to the following material:
- Christopher Brumm has an excellent blog on exception management, including how to monitor for changes to them: medium.com/codex/my-learnings-on-microsoft-defender-for-endpoint-and-exclusions-ddacf2fdd047
- To supplement out-the-box reporting, Fabian Bader has some very useful advanced hunting queries available for monitoring MDAV in his blog: cloudbrothers.info/en/antivirus-scan-complete
- The following blog has guidance on the file share approach to MDAV updates: campbell.scot/microsoft-defender-antivirus-schedule-install-updates-via-network-shares
- Olaf Hartong MVP has a fantastic series of MDE Internals blogs, which include some recommended audit policies that can enhance the level of telemetry ingested by MDE: medium.com/@olafhartong