Microsoft Security Tech Accelerator
Dec 06 2023, 07:00 AM - 12:00 PM (PST)
Microsoft Tech Community

Verify APT indicators are working

Copper Contributor

We have created indicators to allows specific exe's run from vendor USB drives. It seems to be working on a few machines only. All machines are hybrid joined in Intune, onboarded in Defender.  All policies  that we've created in Endpoint manager work on these machines. 


How can we determine if these indicators have applied to these machines? Or are the indicators checked in Real Time?

0 Replies