Getting Started: Enrolling Devices & Running Queries

In order to query data from devices in the data lake, you have to first enroll in the EAP program.

The option can be found in the top right corner by clicking your name and navigating to the 'Early Access Programs' page.

You will see all the available early access programs you can join. Locate the 'XDR & EDR Data Lake - Endpoint' program and click join.

Read the details of the program and accept the terms and conditions if you wish to join.

There will be a prompt for you to add devices into the program.

You can select the devices you wish to enroll and move them over the to 'Assigned Devices' column.

Afterwards, you are ready to run your first Data Lake query in Live Discover. 

Here is a quick video to show the whole process. 

https://1drv.ms/v/s!AibUHjMRkKbRyXCspaxxVwf9eX8k?e=3kNiKf