Forum Discussion
Device events queries
Hello I noticed when I am trying to run a query in advanced hunting that deviceevents is marked with red and is not recognised. the section device is totally missing so I cannot get info about asr. ...
it sound like you dont have right access or permission assigned. your access to endpoint data is determined by role-based access control (RBAC) settings in Microsoft Defender for Endpoint https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-roles?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-overview?view=o365-worldwide
- I can run other queries and I am a global admin.
- share the query you are trying to run
