Forum Discussion

Brass Contributor

Oct 11, 2022

Solved

Microsoft Defender Antivirus Modes

Hello, Is there a way from Microsoft Sentinel using a Query to check when a device turn off the Defender Antivirus. BR,

data collection

Clive_Watson
Oct 11, 2022
Qusai_Ismail I would have thought this query is closer to the ask
Microsoft-365-Defender-Hunting-Queries/Endpoint Agent Health Status Report.md at master · microsoft/Microsoft-365-Defender-Hunting-Queries · GitHub

However, the Table (DeviceTvmSecureConfigurationAssessment) isn't one you can (today) connect to Sentinel using the bult-in Preview connector, so you only have the data on security.microsoft.com rather than Sentinel to generate an Alert there.

Brass Contributor

Oct 11, 2022

Thanks, but it's for Defender Hunting, we need to make a rule for periodic check.

Bronze Contributor

Oct 11, 2022

Qusai_Ismail I would have thought this query is closer to the ask

Microsoft-365-Defender-Hunting-Queries/Endpoint Agent Health Status Report.md at master · microsoft/Microsoft-365-Defender-Hunting-Queries · GitHub

However, the Table (DeviceTvmSecureConfigurationAssessment) isn't one you can (today) connect to Sentinel using the bult-in Preview connector, so you only have the data on security.microsoft.com rather than Sentinel to generate an Alert there.

Resources