Yesterday I was playing with Mimikatz (Hackertool) for Security pen tests and it was not working because Azure Security Center Quarantined the file 
On my Surface I got an Azure monitoring Agent running
Microsoft Azure Security Center Investigation Dashboard
The Investigation feature in Security Center allows you to triage, understand the scope, and track down the root cause of a potential security incident.
The intent is to facilitate the investigation process by linking all entities (security alerts, users, computers and incidents) that are involved with the incident you are investigating. Security Center can do this by correlating relevant data with any involved entities and exposing this correlation in using a live graph that helps you navigate through the objects and visualize relevant information.
Microsoft Azure Security Center found also a rare SVCHOST Service on my Surface, and the ASC investigation dashboard gives you great overview of the security risk.
You can Run a Playbook based on this alert Rare SVCHOST Service
Try it yourself, more information about Azure Security Center Investigation Dashboard (Preview) can be found here
Microsoft azure Security Center