Forum Discussion
Device Tables are not ingesting tables for an orgs workspace
Device Tables are not ingesting tables for an orgs workspace.
I can confirm that all devices are enrolled and onboarded to MDE (Microsoft defender for endpoint)
I had placed an EICAR file on one of the machine which bought an alert through to sentinel,however this did not invoke any of the device related tables .
Workspace i am targeting
Workspace from another org with tables enabled and ingesting data
Microsoft Defender XDR connector shows as connected however the tables do not seem to be ingesting data;
I run the following;
DeviceEvents
| where TimeGenerated > ago(15m)
| top 20 by TimeGenerated
DeviceProcessEvents
| where TimeGenerated > ago(15m)
| top 20 by TimeGenerated
I receive no results;
No results found from the specified time range Try selecting another time range
Please assist As I cannot think where this is failing