---
title: Helpful feature in MDATP
description: One of the benefits of using a cloud service backend instead of on-prem appliance boxes is that we can get new features without doing anything except for “enable” depending on fe...
---

[Onevinn blog ](https://www.onevinn.com/blog)

# [Helpful feature in MDATP](https://www.onevinn.com/blog/helpful-feature-in-mdatp)

 Written by [Security Labs - Stefan och Mattias](https://www.onevinn.com/blog/author/security-labs) | 13 Aug 2020

One of the benefits of using a cloud service backend instead of on-prem appliance boxes is that we can get new features without doing anything except for “enable” depending on feature.

One feature I like is the “flag event” feature in the timeline.

In the machine timeline view there is a “flag” we can enable on each event we find interesting. This will make it easier to go back and further investigate suspicious activities.

In the overview we can see where the flags are located in the timeline and if we want, we can also filter on flagged events

Happy Hunting

[View full post](https://www.onevinn.com/blog/helpful-feature-in-mdatp)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Security Labs - Stefan och Mattias"
  },
  "dateModified" : "2020-08-19T10:11:09.642Z",
  "datePublished" : "2020-08-13T23:50:21Z",
  "headline" : "Helpful feature in MDATP",
  "image" : {
    "@type" : "ImageObject",
    "height" : 60,
    "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
    "width" : 60
  },
  "mainEntityOfPage" : "https://www.onevinn.com/blog/helpful-feature-in-mdatp",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Onevinn blog"
  }
}
```