These details are especially helpful for investigating attack surface reduction rules. Use Defender for Endpoint to get greater details for each event. To find the audited entries, go to Applications and Services > Microsoft > Windows > Windows Defender > Operational. With audit mode, you can review the event log to see what affect the feature would have had if it was enabled. However, the Windows Event Log will record events as if the features were fully enabled. The features won't block or prevent apps, scripts, or files from being modified. You can also get an idea of how many suspicious file modification attempts occur over a certain period of time. Enabling audit mode only for testing helps to prevent audit mode from affecting your line-of-business apps. You can enable audit mode when testing how the features will work.

You can enable the following ASR security features in audit mode:Īudit mode lets you see a record of what would have happened if you had enabled the feature.

Test attack surface reduction in Microsoft Defender for EndpointĪs part of your organization's security team, you can configure attack surface reduction capabilities to run in audit mode to see how they'll work. In most cases, when you configure attack surface reduction capabilities, you can choose from among several methods:

Controlled folder access blocked