Endpoint Agent Health Status Report
This query will provide a report of many of the best practice configurations for Defender ATP deployment. Special Thanks to Gilad Mittelman for the initial inspiration and concept. Any tests which are reporting "BAD" as a result imply that the associated capability is not configured per best practice recommendation.
Microsoft Sentinel (KQL)
