Detecting adversaries in your environment is a challenging task: Most organizations need at least several months to detect them... IF they detect them at all.Many companies have started to investigate Windows Event Log to improve their detection. But analyzing Event Logs is a tedious task: so much information gathered in different log files and so much data to correlate. To improve your environment‘s security, Microsoft recommends the usage of so called „Microsoft Security Baselines“. Having such a security baseline in place, results in even more events that are being generated.It also requires a certain amount of storage space to gather all these events in one place. Storage space which comes with additional cost. Not all organizations are fortunate enough to store Petabytes of Log files. Therefore, they need to filter which Event IDs are important enough to forward to their SIEM system.But what Events are being generated if you apply a certain Microsoft Security Baseline? Which are important enough to forward to allocate valuable storage space? And what to do with all the data when you have collected everything in one location?In this live-demonstration-filled talk, I will show you how to solve these problems – while matching Event Ids, Security Baselines and hunting queries to the MITRE ATT&CK framework.