Forum Discussion

Jean-Philippe Breton's avatar
Jean-Philippe Breton
Iron Contributor
Nov 19, 2021

Does Defender Smartscreen trigger an MDE alert.

Hi,

 

Was wondering if there was a way to see Defender SmartScreen event/alert in MDE Security portal?

 

For example, lets says Defender Smartscreen is configured and try  the Defender Smartscreen test website: https://demo.smartscreen.msft.net/

 

Should alert flow thru MDE security portal?

 

Thanks

 

Jean-Philippe

6 Replies

  • Jonhed's avatar
    Jonhed
    Iron Contributor
    Nov 19, 2021

    Jean-Philippe Breton 

    Not 100% sure if an alert will be generated, but you should be able to see events from Advanced Hunting.

     

    This is a query I used lately to find malicious URLs blocked by smartscreen and network protection.

    DeviceEvents
| where (ActionType == "ExploitGuardNetworkProtectionBlocked" and parse_json(AdditionalFields).ResponseCategory != "CustomPolicy") or
 (ActionType == "SmartScreenUrlWarning" and parse_json(AdditionalFields).Experience != "CustomPolicy")

     The ActionType "SmartScreenUrlWarning" shows the Smartscreen browser events, and I think there was a "SmartScreenFileWarning" for file events too.

    • Jean-Philippe Breton's avatar
      Jean-Philippe Breton
      Iron Contributor
      Nov 19, 2021
      Oh thanks for the query !!
      It will be very helpful.

      I just find it weird that Smartscreen event do not show up in Alerts dashboard in MDE...
      • Jonhed's avatar
        Jonhed
        Iron Contributor
        Nov 19, 2021

        When looking at my test environment, I noticed a few alerts with the source listed as SmartScreen, when doing the test below.
        https://demo.wd.microsoft.com/Page/NP

        The prerequisites for the test does say not to use Edge though.. My alerts came from Internet Explorer.

Resources