Forum Discussion
Devices with malware detections Report
Hi, in our MDE portal the 'Devices with malware detections' contains a few devices which supposedly have active malware, however, the devices do not have any (active) alerts in Defender for Endpoint. It seems the information in the report is gathered from Intune, but the same information is displayed there and does not provide any further indications other than the threat name. How/where can I find the alerts associated with the 'active malware', if they are not in Defender for Endpoint?
- While reverse engineering the reports in M365D I was able to find out the 'Devices with malware detections' report contains hosts that were active within the last 24h, and had malware detections within at least the past 15 days, but that might be a longer period. I used the following query:
DeviceInfo
//| summarize by DeviceName
| where Timestamp > startofday(datetime(2021-11-15 00:00:01))
| join (AlertEvidence | where Timestamp > ago(15d)) on DeviceName
| summarize count() by DeviceName
- Juulw
I have encountered the same issue in my tenant as well where in Intune I can see devices with active malware however when I go the MDE portal, I can't see any active alerts on the devices.
To validate the same, I checked for the presence of malware on machines as well by going to Windows Security App on the device however couldn't find anything on the device also.
This seems to be a bug on the Microsoft reporting side which needs to be highlighted to Microsoft. - While reverse engineering the reports in M365D I was able to find out the 'Devices with malware detections' report contains hosts that were active within the last 24h, and had malware detections within at least the past 15 days, but that might be a longer period. I used the following query:
DeviceInfo
//| summarize by DeviceName
| where Timestamp > startofday(datetime(2021-11-15 00:00:01))
| join (AlertEvidence | where Timestamp > ago(15d)) on DeviceName
| summarize count() by DeviceName - I am facing the same problem. has anyone contacted MS regarding this hole in their configurations? Is there a way to set up alerts for Intune - so that we dont miss the malware detections from the other page?
