Microsoft ATP

Applies to: Windows Defender Security Center

Overview

Windows Defender Advanced Threat Protection is a platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats. To help maximize the effectiveness of the security platform, you can configure individual capabilities that surface in Windows Defender Security Center.

EventTracker helps to monitor events from Microsoft ATP. It’s dashboard and reports help to detect file less attacks, backdoor drops and virus/malware.

EventTracker Knowledge Pack for Microsoft ATP allows you to monitor the following components: -

• Security– Threat detection.
• Operation– On demand scans and its results.

Once Microsoft ATP is configured to deliver events to EventTracker Manager; alerts, dashboards and reports can be configured into EventTracker.

Some of the Knowledge Packs available in EventTracker are listed below. For more information, please refer Integration Guide.
 

Scope

The configuration details are consistent with EventTracker version 9.X and later, and Microsoft ATP.

Documentation

To configure Microsoft ATP to send logs to EventTracker, refer the How to Guide.

For more information, please refer the Microsoft ATP Integration guide.