You have the following advanced hunting query in Microsoft 365 Defender.
You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Question

You have the following advanced hunting query in Microsoft 365 Defender.

You need to receive an alert when any process disables System Restore on a device managed by Microsoft Defender during the last 24 hours.

Which two actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

marwan albahar · Accepted Answer

Create a detection rule.

marwan albahar · Accepted Answer

Add Deviceld and Reportldto the output of the query.

marwan albahar · Answer

Create a suppression rule.

marwan albahar · Answer

Add | order by Timestamp to the query.

marwan albahar · Answer

Replace DeviceProcessEvents with DeviceNetworkEvents.

List of questions