> For the complete documentation index, see [llms.txt](https://msdocs.aohwv.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://msdocs.aohwv.com/secure-and-measure/check-your-setup.md).

# Check Your SetUp

## Check Your SEtUp

How well is your Microsoft environment sending date to our SOC? 

{% hint style="info" %}
**Coming soon:** a free, read-only script that checks your Microsoft logging setup automatically and produces a scorecard. Until then, use the manual checklist below.
{% endhint %}

### Manual checklist

Check off each item you've completed. Each one links to the step that explains how.

#### Core logging

* [ ] An **Event Hub** namespace exists, with a hub for each source (**Step 1**)
* [ ] **Entra ID** diagnostic settings send all core log categories to the Event Hub (**Step 2**)
* [ ] **Defender XDR** Streaming API is sending events to the Event Hub (**Step 3**)
* [ ] **Microsoft 365** auditing is on, and your SIEM is connected through an app with ActivityFeed.Read (**Step 4**)
* [ ] Everyday **Copilot** use (CopilotInteraction) is filtered out in your SIEM (**Step 5**)
* [ ] **Purview** DLP events are collected, if you use DLP (**Step 6**)
* [ ] **Defender for Cloud** continuous export is on for every subscription (**Step 7**)
* [ ] The **Azure Activity Log** is exported for every subscription (**Step 7**)
* [ ] **Intune** audit logs are sent to the Event Hub (**Step 8**, optional)

#### Is data actually arriving?

* [ ] Each event hub shows **Incoming Messages** in the Azure portal
* [ ] Your SIEM shows recent data from **every** source above
* [ ] SOC been told about any **new tenants or subscriptions**

### About the upcoming script

The script will check your setup automatically and create a report you can share with your team.

| It will                                                          | It won't                                                        |
| ---------------------------------------------------------------- | --------------------------------------------------------------- |
| **Read** your Entra, Defender, Azure and Intune logging settings | Change any settings                                             |
| Check that data is **actually arriving** in your Event Hub       | Read your logs, emails, files or user data                      |
| Give each Quick Start step a **pass, warning or fail**           | Send any results outside your organization                      |
| Link each gap to the **page that explains how to fix it**        | Require passwords or secrets. You sign in with your own account |

**What you'll need to run it:** Global Reader in Entra ID, and Reader on your Azure subscriptions.

**Where to get it:** it will be published on GitHub and linked from this page. 🎃ETA 10.22🎃

## Related

* [Quick Start](/quick-start/getting-started.md) — Step-by-step setup for every Microsoft source
* [Microsoft Dashboards](/secure-and-measure/microsoft-dashboards.md) — Microsoft's own scores and dashboards
* [Get Expert Help](/get-expert-help/overview.md) — RedLegg and AOHWV services


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://msdocs.aohwv.com/secure-and-measure/check-your-setup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.