Forum Discussion
Solved
Devices with malware detections Report
Hi, in our MDE portal the 'Devices with malware detections' contains a few devices which supposedly have active malware, however, the devices do not have any (active) alerts in Defender for Endpoint....
- While reverse engineering the reports in M365D I was able to find out the 'Devices with malware detections' report contains hosts that were active within the last 24h, and had malware detections within at least the past 15 days, but that might be a longer period. I used the following query:
DeviceInfo
//| summarize by DeviceName
| where Timestamp > startofday(datetime(2021-11-15 00:00:01))
| join (AlertEvidence | where Timestamp > ago(15d)) on DeviceName
| summarize count() by DeviceName
Juulw
I have encountered the same issue in my tenant as well where in Intune I can see devices with active malware however when I go the MDE portal, I can't see any active alerts on the devices.
To validate the same, I checked for the presence of malware on machines as well by going to Windows Security App on the device however couldn't find anything on the device also.
This seems to be a bug on the Microsoft reporting side which needs to be highlighted to Microsoft.
I have encountered the same issue in my tenant as well where in Intune I can see devices with active malware however when I go the MDE portal, I can't see any active alerts on the devices.
To validate the same, I checked for the presence of malware on machines as well by going to Windows Security App on the device however couldn't find anything on the device also.
This seems to be a bug on the Microsoft reporting side which needs to be highlighted to Microsoft.