microsoft defender endpoint detection for rmm

Does anyone know the locations of the program and definitions, and ap process needed for detection in an RMM like ConnectWise Automate?