From 799d91961cfbc1fff59debcfe2df40893f7f9bed Mon Sep 17 00:00:00 2001 From: Sriraman M S <45987684+msbemba@users.noreply.github.com> Date: Sat, 23 Mar 2019 11:46:43 +0530 Subject: [PATCH] Update network-protection-exploit-guard.md Exploit guard evaluation package is no longer supported, We have made changes to the document and it only contains steps for manual import. --- .../network-protection-exploit-guard.md | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md index 3f018f31f7..8ffcfaf3cd 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/network-protection-exploit-guard.md @@ -53,17 +53,11 @@ You can query Windows Defender ATP data by using [Advanced hunting](https://docs You can review the Windows event log to see events that are created when network protection blocks (or audits) access to a malicious IP or domain: -1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *np-events.xml* to an easily accessible location on the machine. +1. [Copy the XML directly](event-views-exploit-guard.md). -1. Type **Event viewer** in the Start menu to open the Windows Event Viewer. +2. Click **OK**. -2. On the left panel, under **Actions**, click **Import custom view...** - -3. Navigate to the Exploit Guard Evaluation Package, and select the file *np-events.xml*. Alternatively, [copy the XML directly](event-views-exploit-guard.md). - -4. Click **OK**. - -5. This will create a custom view that filters to only show the following events related to network protection: +3. This will create a custom view that filters to only show the following events related to network protection: Event ID | Description -|-