Forum Discussion
Device events queries
Hello I noticed when I am trying to run a query in advanced hunting that deviceevents is marked with red and is not recognised.
the section device is totally missing so I cannot get info about asr.
is there a way I can add it ?
thank you!
3 Replies
- it sound like you dont have right access or permission assigned. your access to endpoint data is determined by role-based access control (RBAC) settings in Microsoft Defender for Endpoint https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-roles?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-overview?view=o365-worldwide
- I can run other queries and I am a global admin.
- share the query you are trying to run
