Exam 70-744 topic 1 question 65 discussion

HOTSPOT -
Your network contains an Active Directory domain named contoso.com.
You are deploying Microsoft Advanced Threat Analytics (ATA) to the domain. You install the ATA Gateway on a server named Server1.
To assist in detecting Pass-the-Hash attacks, you plan to configure ATA Gateway to collect events.
You need to configure the query filter for event subscriptions on Server1.
How should you configure the query filter? To answer, select the appropriate options in the answer are.
Hot Area:

Suggested Answer:
References:
https://docs.microsoft.com/en-us/advanced-threat-analytics/configure-event-collection