deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-14 14:27:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

copy editor review applied

Browse Source
This commit is contained in:
MaratMussabekov 2019-03-23 07:53:54 +05:00 committed by GitHub
parent 6fbdd77531
commit c62cacee88
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
View File

@ -37,19 +37,19 @@ For information about configuring attack surface reduction rules, see [Enable at
## Review attack surface reduction events in Windows Event Viewer ## Review attack surface reduction events in Windows Event Viewer
You can review the Windows event log to see events that are created when attack surface reduction rules fire: You can review the Windows event log to view events that are created when attack surface reduction rules fire:
1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the machine. 1. Download the [Exploit Guard Evaluation Package](https://aka.ms/mp7z2w) and extract the file *cfa-events.xml* to an easily accessible location on the machine.
2. Type **Event viewer** in the Start menu to open the Windows Event Viewer. 2. Type **Event Viewer** in the Start menu to open the Windows Event Viewer.
3. On the left panel, under **Actions**, click **Import custom view...**. 3. Click **Import custom view...** on the left panel, under **Actions**.
4. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [copy the XML directly](event-views-exploit-guard.md). 4. Select the file *cfa-events.xml* from where it was extracted. Alternatively, [copy the XML directly](event-views-exploit-guard.md).
4. Click **OK**. 5. Click **OK**.
5. This will create a custom view that filters to only show the following events related to controlled folder access: This will create a custom view that filters to only show the following events related to controlled folder access:
Event ID | Description Event ID | Description
-|- -|-