Notes, research, and findings on staying secure

Are You Aware of Your Monitoring Gaps?

Microsoft Defender is a powerful platform, but every system operating at scale makes trade-offs about which telemetry it captures. A small experiment on what file activity actually surfaces in DeviceFileEvents, and what that means for detecting exfiltration.