deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-16 07:17:24 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Update wdac-wizard-parsing-event-logs.md

Browse Source 
For acrolinx
This commit is contained in:
Vinay Pamnani 2023-02-02 11:07:15 -05:00 committed by GitHub
parent f3207026ff
commit 83b5e89dba
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
windows/security/threat-protection/windows-defender-application-control/wdac-wizard-parsing-event-logs.md
View File

@ -54,7 +54,7 @@ To create rules from the WDAC event logs on the system:
## WDAC Event Log File Parsing
To create rules from the WDAC .EVTX event logs files on the system:
To create rules from the WDAC `.EVTX` event logs files on the system:
1. Select **Policy Editor** from the WDAC Wizard main page.
2. Select **Convert Event Log to a WDAC Policy**.
@ -108,7 +108,7 @@ To create rules from the WDAC events in [MDE Advanced Hunting](querying-applicat
5. Select the **Parse Log File(s)** button under the "Parse MDE Advanced Hunting Events to Policy" header.
6. Select the .CSV WDAC MDE Advanced Hunting export files from the disk to parse.
The Wizard will parse the relevant audit and block events from the selected Advanced Hunting log files. You will see a notification when the Wizard successfully finishes reading the events.
The Wizard will parse the relevant audit and block events from the selected Advanced Hunting log files. You'll see a notification when the Wizard successfully finishes reading the events.
> [!div class="mx-imgBorder"]
> ![Parse the Advanced Hunting CSV WDAC event files](images/wdac-wizard-event-log-mde-ah-parsing.png)
@ -116,7 +116,6 @@ To create rules from the WDAC events in [MDE Advanced Hunting](querying-applicat
7. Select the Next button to navigate to the table of software to view the audit and block events and create rules from.
8. [Generate rules from the events](#creating-policy-rules-from-the-events).
## Creating Policy Rules from the Events
On the "Configure Event Log Rules" page, the unique WDAC log events will be shown in the table. Event Ids, filenames, product names, the policy name that audited or blocked the file, and the file publisher are all shown in the table. The table can be sorted alphabetically by clicking on any of the headers.