# Intune Endpoint Analytics policy is created and Assigned
If endpoint analytics isn't enabled, threat actors can exploit gaps in device health, performance, and security posture.
Source: https://maester.dev/docs/tests/ZTA.24576
## Overview
If endpoint analytics isn't enabled, threat actors can exploit gaps in device health, performance, and security posture. Without the visibility endpoint analytics brings, it can be difficult for an organization to detect indicators such as anomalous device behavior, delayed patching, or configuration drift. These gaps allow attackers to establish persistence, escalate privileges, and move laterally across the environment. An absence of analytics data can impede rapid detection and response, allowing attackers to exploit unmonitored endpoints for command and control, data exfiltration, or further compromise.
Enabling endpoint analytics provides visibility into device health and behavior, helping organizations detect risks, respond quickly to threats, and maintain a strong Zero Trust posture.
## Remediation
Enroll Windows devices into endpoint analytics in Intune to monitor device health and identify risks:
- [Configure endpoint analytics](https://learn.microsoft.com/intune/endpoint-analytics/configure?pivots=intune&wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
For more information, see:
- [What is endpoint analytics?](https://learn.microsoft.com/intune/endpoint-analytics/index?wt.mc_id=zerotrustrecommendations_automation_content_cnl_csasci)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Low |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | Devices |
| Category | Device management |
| Product | [Intune](/docs/tests/products/intune) |
| Feature | Tenant administration |
| Area | Devices and endpoints |
| Licence | Intune |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.