Your organization plans to deploy an attack surface reduction (ASR) rule that blocks Office applications from creating child processes across 2,000 Windows devices managed by Microsoft Defender for Endpoint. The security team is concerned that a line-of-business Excel macro may break if the rule immediately blocks activity. You need to measure the potential impact of the rule before enforcing it, without preventing any legitimate business processes. What should you do first?