Microsoft security threat protection reports - need kql please

Hi everyone, In security.microsoft.com, there are report for 'threat protection' related to MDE. eg: "detection source of all alerts by creation date" Is there anywhere that I can find th...

CliveWatson
Apr 23, 2021
SocInABox

The [Microsoft 365 Defender (Preview)] connector only takes over Device* tables (and these are optional only if you need that data in Azure Sentinel) or put Alerts into the SecurityAlert table. You may not have enough data to re-create the precise alert even if you had the KQL

So you can use, KQL like:

SecurityAlert | where ProductName in("Microsoft Defender Advanced Threat Protection", "Office 365 Advanced Threat Protection", "Azure Advanced Threat Protection", "Microsoft Cloud App Security", "Microsoft 365 Defender") | summarize count(AlertName) by ProductName

or (very basic KQL to read any Device* Table)

union Device* | summarize count() by DeviceName, Type

CliveWatson

Former Employee

Apr 23, 2021

SocInABox

The [Microsoft 365 Defender (Preview)] connector only takes over Device* tables (and these are optional only if you need that data in Azure Sentinel) or put Alerts into the SecurityAlert table. You may not have enough data to re-create the precise alert even if you had the KQL

So you can use, KQL like:

SecurityAlert 
| where ProductName in("Microsoft Defender Advanced Threat Protection", "Office 365 Advanced Threat Protection", "Azure Advanced Threat Protection", "Microsoft Cloud App Security", "Microsoft 365 Defender")
| summarize count(AlertName) by ProductName

or (very basic KQL to read any Device* Table)

union Device* | summarize count() by DeviceName, Type

SocInABox

Iron Contributor

Apr 23, 2021

Thanks Clive, that's pretty much what we did - just took a couple of hours of playing around with it.

Forum Discussion

Microsoft security threat protection reports - need kql please