Attackers regularly attempt to wiggle their way into your network and then try to cover their tracks. By the time you determine that someone has breached your network, the evidence of how they got in might have rolled off your log files. You would like to better understand how attackers can use lateral movement inside your Windows network and what resources they have accessed along the way.

For many years that question could only be answered with a lengthy investigation by a dedicated forensic team. Now, with Windows 10 and an E5 license, forensic examinations can be exposed and saved for later review. Called Windows 10 Advanced Threat Protection (ATP), this service allows anyone with an E5 license to see under the hood and review what an attacker did to a system. It relies on telemetry that is enabled when the computer is linked to the ATP service.