In this case I am following as below checklist (Layer 1 to Layer 7)
I need your input on that. what else I do on it.
1. List of critical Services (Like URLs & IP address)
2. Meraki Switch for Traffic shipping Config.
3. if the system has no antivirus.
(Need to monitory end Device behavior like access is legitimate or Non Legitimate,
it should scan via Security Engine.
So keep an eye on background processes
reveal viruses and other malware
expose unauthorized access
monitor running programs
log process activity