Forum Discussion
eladfe
Mar 23, 2025Copper Contributor
KQL query for AV scan
Hay
I want to get info about the last time that AV scanned the computers in my org.
I write a this query :
DeviceEvents
| where ActionType == "AntivirusScanCompleted"
| extend SCAN = parse_json(AdditionalFields). ScanTypeIndex
| summarize hint.strategy=shuffle arg_max( DeviceName, *) by DeviceName
but it doesnt give me the date and time when the acan has been preformrd.
Another question: one of the result of this scan is the parameter ScanID. for example:
ScanId
{041A5DF1-3A85-49D5-B0B0-2231AF4AC13C}
What this string means ?
Thank you.
Elad.
No RepliesBe the first to reply