Update attack-surface-reduction.md

This commit is contained in:
Denise Vangel-MSFT
2021-02-03 12:22:42 -08:00
parent c58cd058de
commit 1be537b367

View File

@ -135,7 +135,7 @@ You can review the Windows event log to view events generated by attack surface
You can create a custom view that filters events to only show the following events, all of which are related to controlled folder access: You can create a custom view that filters events to only show the following events, all of which are related to controlled folder access:
|Event ID | Description | |Event ID | Description |
|---|---| |:---|:---|
|5007 | Event when settings are changed | |5007 | Event when settings are changed |
|1121 | Event when rule fires in Block-mode | |1121 | Event when rule fires in Block-mode |
|1122 | Event when rule fires in Audit-mode | |1122 | Event when rule fires in Audit-mode |