mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-16 19:03:46 +00:00
added syntax
This commit is contained in:
@ -23,7 +23,7 @@ This capability is supported beginning with Windows version 1607.
|
|||||||
|
|
||||||
Here is a simple example query that shows all the WDAC events generated in the last seven days from machines being monitored by Windows Defender ATP:
|
Here is a simple example query that shows all the WDAC events generated in the last seven days from machines being monitored by Windows Defender ATP:
|
||||||
|
|
||||||
```
|
```kusto
|
||||||
MiscEvents
|
MiscEvents
|
||||||
| where EventTime > ago(7d) and
|
| where EventTime > ago(7d) and
|
||||||
ActionType startswith "AppControl"
|
ActionType startswith "AppControl"
|
||||||
|
Reference in New Issue
Block a user