Using MS Defender to audit Macro usage

I am trying to determine the best way to audit when Macros are executed using Defender. I tried using the Advanced Hunting with Defender E5 as a test to see when the registry was updated with Trusted Documents but it was giving me way to many responses to be any form of useful. Maybe I just didn't tune it enough.

We have the restrictions in place about not letting MS docs create child processes and all of that stuff in …

audit cybersecurity defender macro