Forum Discussion

ben1210's avatar
ben1210
Copper Contributor
Sep 23, 2025

Device Tables are not ingesting tables for an orgs workspace

Device Tables are not ingesting tables for an orgs workspace.

I can confirm that all devices are enrolled and onboarded to MDE (Microsoft defender for endpoint)

 

I had placed an EICAR file on one of the machine which bought an alert through to sentinel,however this did not invoke any of the device related tables .

 

Workspace i am targeting

Workspace from another org with tables enabled and ingesting data

 

 

Microsoft Defender XDR connector shows as connected however the tables do not seem to be ingesting data;

 

I run the following;

DeviceEvents
| where TimeGenerated > ago(15m)
| top 20 by TimeGenerated

DeviceProcessEvents
| where TimeGenerated > ago(15m)
| top 20 by TimeGenerated

I receive no results;

No results found from the specified time range Try selecting another time range

 

Please assist As I cannot think where this is failing

 

No RepliesBe the first to reply

Resources