Forum Discussion

eladfe's avatar
eladfe
Copper Contributor
Mar 23, 2025

KQL query for AV scan

Hay

I want to get info about the last time that AV scanned the computers in my org.

I write a this query : 

DeviceEvents

| where ActionType == "AntivirusScanCompleted"

| extend SCAN = parse_json(AdditionalFields). ScanTypeIndex

| summarize hint.strategy=shuffle arg_max( DeviceName, *) by DeviceName

 

but it doesnt give me the date and time when the acan has been preformrd.
Another question: one of the result of this scan is the parameter ScanID. for example: 

ScanId

{041A5DF1-3A85-49D5-B0B0-2231AF4AC13C}
What this string means ? 

Thank you.
Elad.

 

No RepliesBe the first to reply

Resources