Forum Discussion

Ambarish Haridathan's avatar
Ambarish Haridathan
Copper Contributor
May 30, 2020

Endpoint Protection not installed on non-Azure servers

Hi all,   I've used the "Onboard servers to Security Center" with a workspace for our non Azure servers. The agent got installed successfully and could see the server on Microsoft Defender ATP as...
threat protection
Eli's avatar
Eli
Icon for Microsoft rankMicrosoft
Jun 14, 2020

Ambarish Haridathan ,

Please search the Log Analytics workspace in which the machine is connected to for the ProtectionStatus logs.

Query to target your computer looks like:

ProtectionStatus 
| where Computer has "<your computer name>"

check the ProtectionStatusRank. Anything other than 150 indicate unhealthy state.

If no logs return then it might be computer connection to workspace issue, check the 'Heartbeat' on the same query window

  • Ambarish Haridathan's avatar
    Ambarish Haridathan
    Copper Contributor
    Jun 14, 2020

    Eli The query that shows that the end point not installed is as below:

     

    *removed data that are our environment specific.

     

    ProtectionStatus
    | where (ComputerEnvironment != "Azure" or isempty(ResourceId)) and (TypeofProtection == "Malicious Software Removal Tool" or TypeofProtection == "No Anti-Malware Tool was detected")
    | where tolower(SubscriptionId) in ("SUBSCRIPTION_ID") or isempty(SubscriptionId)
    | summarize AggregatedValue = count() by Computer
    | limit 1000000000
     
    With the query you gave:
    ProtectionStatusRank450
    ProtectionStatus
    Not Reporting
    ProtectionStatusDetails
    Not reporting - Unable to collect data
    SignatureVersion
    Unknown
    TypeofProtection
    Malicious Software Removal Tool
    ComputerEnvironment
    Non-Azure
    Type
    ProtectionStatus
    • Eli's avatar
      Eli
      Icon for Microsoft rankMicrosoft
      Jun 14, 2020
      Not Reporting means just that. How is the Heartbeat?
      • Ambarish Haridathan's avatar
        Ambarish Haridathan
        Copper Contributor
        Jun 14, 2020

        Eli I don't have much expertise on the query part, but found the query

         

        Heartbeat
        | where TimeGenerated > ago(1h)
         
        I could see that the server in question is showing up on this list from the query
        Is there anything in specific I should be looking at?

Resources