Custom Detection rule to find Inactive Device

Question

Hello, My Org Planning to create incidents whenever the device goes inactive state in Microsoft Defender for Endpoint. It would be much appreciated if I get the query(KQL) to list the Inactive device. Thanks in Advance

princely · Answer

Arjun_Rajan&nbsp;You can use the following query, which runs fine but there is an error in it per MDE, which wont let me save this as a custom detection rule :DeviceTvmSecureConfigurationAssessment| where ConfigurationId in ('scid-2000', 'scid-2001')| extend Test = case(ConfigurationId == "scid-2000", "SensorEnabled",ConfigurationId == "scid-2001", "SensorDataCollection","N/A"),Result = case(IsApplicable == 0, "N/A", IsCompliant == 1, "GOOD", "BAD")| extend packed = pack(Test, Result)| summarize Tests = make_bag(packed), DeviceName = any(DeviceName) by DeviceId| evaluate bag_unpack(Tests)| where SensorEnabled == "GOOD" and SensorDataCollection == "BAD"| summarize by DeviceName, DeviceId

arjun_rajan · Answer

Princely&nbsp; Much appreciated your response to my query. Unfortunately, It does not return any result even if I choose the last 30 days. Please let me know if you happen to know how to set the Time range in the query.&nbsp;&nbsp;However, I do get all inactive devices by running the below query&nbsp;DeviceTvmSecureConfigurationAssessment|&nbsp;where&nbsp;ConfigurationId&nbsp;in&nbsp;("scid-91",&nbsp;"scid-2000",&nbsp;"scid-2001")|&nbsp;summarize&nbsp;arg_max(Timestamp,&nbsp;IsCompliant,&nbsp;IsApplicable)&nbsp;by&nbsp;DeviceId,&nbsp;ConfigurationId|&nbsp;extend&nbsp;Test&nbsp;=&nbsp;case(&nbsp;&nbsp;&nbsp;&nbsp;ConfigurationId&nbsp;==&nbsp;"scid-2000",&nbsp;"SensorEnabled",&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;"N/A"),&nbsp;&nbsp;&nbsp;&nbsp;Result&nbsp;=&nbsp;case(IsApplicable&nbsp;==&nbsp;0,&nbsp;"N/A",&nbsp;IsCompliant&nbsp;==&nbsp;1,&nbsp;"GOOD",&nbsp;"BAD")|&nbsp;extend&nbsp;packed&nbsp;=&nbsp;pack(Test,&nbsp;Result)|&nbsp;summarize&nbsp;Tests&nbsp;=&nbsp;make_bag(packed)&nbsp;by&nbsp;DeviceId|&nbsp;evaluate&nbsp;bag_unpack(Tests)

princely · Answer

Arjun_Rajan&nbsp;The query you had mentioned seems to be giving the health status of each device.And the one I had mentioned would specifically return the devices with a sensor enabled but no sensor data returned. Do you not have any hosts in your environment that match this criteria ? I suspect that is the case here.&nbsp;&nbsp;&nbsp;Regards,Princely Dmello

akash553 · Answer

Princely&nbsp;&nbsp;hello Brother&nbsp;i need to know in this condition for detection, how should we test it like should i have to disable the network connection of the machine and then wait for some time? If yes then how much time it requires&nbsp;Please mention the test how should i test in testing environment?&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;

princely · Answer

Hey&nbsp;Akash553,&nbsp;Yes you could disconnect a device from the network to trigger the 'no sensor data' status. I am not sure about the time period that it would need to be disconnected for. That needs to be confirmed by Microsoft.

Forum Discussion

Custom Detection rule to find Inactive Device

Share

Resources