KQL query for AV scan

Hi Elad,

to see all the scans for the last 7 days, you need to:

Remove arg_max (which only takes the last event).

Filter on TimeGenerated > ago(7d)

For example:

DeviceEvents
| where ActionType == "AntivirusScanCompleted"
| extend ScanType = parse_json(AdditionalFields).ScanTypeIndex
| where TimeGenerated > ago(7d)
| project DeviceName, ScanTime = TimeGenerated, ScanType, ScanId
| order by DeviceName asc, ScanTime desc

This will return to you, for each computer, all scan entries completed in the last 7 days (quick, full, etc.), sorted by most recent.

Hi Elad,

To include the date and time when each scan ran, you need to use the "TimeGenerated" (or "Timestamp") column in your DeviceEvents table, it records exactly when the event was logged.

For example:

kql

DeviceEvents
| where ActionType == "AntivirusScanCompleted"
| extend ScanType = parse_json(AdditionalFields).ScanTypeIndex
| summarize arg_max(TimeGenerated, *) by DeviceName
| project DeviceName, LastScanTime = TimeGenerated, ScanType, ScanId

-Using arg_max(TimeGenerated, *) returns, for each DeviceName, the record with the newest timestamp, including all columns (so you get ScanId, etc.).
-If you only need the timestamp of the last scan, you can simplify to:

kql
DeviceEvents
| where ActionType == "AntivirusScanCompleted"
| summarize LastScanTime = max(TimeGenerated) by DeviceName

This produces a two‑column table: DeviceName | LastScanTime

ScanId
That value—`{041A5DF1-3A85-49D5-B0B0-2231AF4AC13C}`—is simply a **GUID** (Global Unique Identifier). Every scan run gets its own unique ID so you can reliably distinguish one scan event from another in your logs. It doesn’t encode any extra information (like scan type or date); it’s just a unique marker for that single scan.

Hope this helps