Forum Discussion
Solved
View 'Audit Only' results
Hi, Maybe I'm missing something, but does anyone know how to view the 'Audit Only' logs for InTune? I've it setup for Win 10 End Point Protection > Microsoft Defender Exploit Guard > Process crea...
- securitycenter.microsoft.com (if you have an MDATP subscription) otherwise they are stored in the local event logs of each machine. https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/event-views
Agree with Joe, If you use log analytics, you need to install the agent on the PCs and then you can query info you need.
Moe
Moe