From c62cacee883b776b254f267a1b45abed98247bce Mon Sep 17 00:00:00 2001 From: MaratMussabekov <48041687+MaratMussabekov@users.noreply.github.com> Date: Sat, 23 Mar 2019 07:53:54 +0500 Subject: [PATCH] copy editor review applied --- .../attack-surface-reduction-exploit-guard.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md index 50deb828c4..6d95b7eaba 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md @@ -37,19 +37,19 @@ For information about configuring attack surface reduction rules, see [Enable at ## Review attack surface reduction events in Windows Event Viewer -You can review the Windows event log to see events that are created when attack surface reduction rules fire: +You can review the Windows event log to view events that are created when attack surface reduction rules fire: 1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the machine. -2. Type **Event viewer** in the Start menu to open the Windows Event Viewer. +2. Type **Event Viewer** in the Start menu to open the Windows Event Viewer. -3. On the left panel, under **Actions**, click **Import custom view...**. +3. Click **Import custom view...** on the left panel, under **Actions**. -4. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [copy the XML directly](event-views-exploit-guard.md). +4. Select the file *cfa-events.xml* from where it was extracted. Alternatively, [copy the XML directly](event-views-exploit-guard.md). -4. Click **OK**. +5. Click **OK**. -5. This will create a custom view that filters to only show the following events related to controlled folder access: +This will create a custom view that filters to only show the following events related to controlled folder access: Event ID | Description -|-