We’ve recently released a capability called Advanced Hunting in Windows Defender ATP that allows you to get unfiltered access to the raw data inside your Windows Defender ATP tenant and proactively h...
Updated Jun 09, 2021
Version 9.0
Blog Post
Hi,
Is there any way to create a custom rule to detect machines which are on inactive state?
For example we have some critical resources which have the Microsoft monitoring agent is installed and we need to identify in case if on of these machines are not sending data to ATP for a period of time. So if we can have an advance hunting option to identify this scenario, we can also create a custom rule to alert the Administrator.
Thanks in advance