My colleague pointed this out for us:
sk167102 Investigative Threat Prevention Best Practices
This article incorporates video tutorials that explains the best way to investigate Threat Prevention attacks in your organization and helps to identify significant events generated by your Threat Prevention environment and understand their meaning:
· Identify infected hosts and mobile devices
· Detect malicious emails.
· Learn about the attacks and the corresponding vulnerabilities in your system
· Tune your threat prevention policy based on reports
This is really great, even for hardcore threat😎 hunters, check it out!
CCSP - CCSE / CCTE / CTPS / CCME / CCSM Elite / SMB Specialist