Windows Event Monitoring
Detection engineering
Implemented Windows event monitoring for Rapid7 and Ivanti services, with detection workflows in Microsoft Defender XDR.
Operational · Accepted at BPC
The task
Interruptions to security services need to be recorded and surfaced for investigation.
My contribution
Developed monitoring scripts and Defender detection logic, and validated service-interruption telemetry through controlled testing.
Implementation
- Run scheduled monitoring through Microsoft Intune.
- Process relevant Windows events and record service interruptions.
- Use Defender telemetry and custom detection rules to surface events for review.
Outcome
The monitoring solution is working and has been accepted at BPC.
Scope & limitations
An interruption alert requires investigation: an authorised service stop does not by itself indicate malicious activity.