From a24fb87ca81f8c9cdcb675a20dee8785c0599efa Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Wed, 5 Dec 2018 10:42:11 -0800 Subject: [PATCH] added cs to code fence --- ...ication-control-events-centrally-using-advanced-hunting .md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting .md b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting .md index b1018f5e79..df80d3bdec 100644 --- a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting .md +++ b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting .md @@ -23,7 +23,7 @@ This capability is supported beginning with Windows version 1607. Here is a simple example query that shows all the WDAC events generated in the last seven days from machines being monitored by Windows Defender ATP: -``` +```cs MiscEvents | where EventTime > ago(7d) and ActionType startswith "AppControl"