AEDA is a tool that runs scheduled jobs in MSV on a regular basis and detects if the tests meet your requirements. Any change can be documented in a notification from the MSV platform. AEDA tests are best if they are relatively small. (No more than 20-25 actions, generally, per AEDA monitor.)
It is recommended to choose actions that you expect to not be blocked, as well as those that you expect to be blocked. For example, doing a network monitor, you could do one action that is an SSH protocol (which is expected to not be blocked) and another using FTP (that is expected to be blocked). Changes to either one of these results would show a huge change in the environment and warrant investigation.
Another nice explanation can be found here: https://www.googlecloudcommunity.com/gc/Security-Validation/Mandiant-Security-Validation-AEDA-as-you...
LinkedIn
Twitter
