Device events queries

Question

Hello I noticed when I am trying to run a query in advanced hunting that deviceevents is marked with red and is not recognised.

the section device is totally missing so I cannot get info about asr.

is there a way I can add it ?

thank you!

mohamedalishahul · Answer

it sound like you dont have right access or permission assigned. your access to endpoint data is determined by role-based access control (RBAC) settings in Microsoft Defender for Endpoint https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-roles?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-overview?view=o365-worldwide

panos83 · Answer

I can run other queries and I am a global admin.

mohamedalishahul · Answer

share the query you are trying to run

Forum Discussion

Device events queries