Forum Discussion

suhaimi4n6's avatar
suhaimi4n6
Copper Contributor
Mar 12, 2024

Microsoft Defender for Endpoint - How to export Device Timeline as per web browser display

Hi guys, I am new to Microsoft defender for Endpoint. I want to export Device Timeline activity as per what have been display on the web browser and the information display on the web browser is muc...
AdelAlDabbas's avatar
AdelAlDabbas
Icon for Microsoft rankMicrosoft
Mar 12, 2024

Hello suhaimi4n6,

 

The best option is to familiarize yourself with raw events format, it is not as easy to read as the UI, but being familiar with it can also help you with analyzing Advanced Hunting results. 

After exporting the .csv file, you can customize the report by removing some columns. It is similar to the UI's "Customize Columns" technique in Device Timeline page.

 

If the number of events is not huge, you can select your events and click on "Copy to clipboard". The output's format is similar to the UI format.

 

 

 

  • jbmartin6's avatar
    jbmartin6
    Iron Contributor
    Mar 15, 2024
    TImeline data are not available in the hunting tables.
    • AdelAlDabbas's avatar
      AdelAlDabbas
      Icon for Microsoft rankMicrosoft
      Mar 15, 2024
      I didn't say they are. Take your time to re-read my comment 🙂

      Thank you!
      • jbmartin6's avatar
        jbmartin6
        Iron Contributor
        Mar 15, 2024
        Yeah I misread almost the whole thing , facepalm

Resources