Forum Discussion

Brass Contributor

Jan 24, 2022

WorkStation Device uptime

Hi Guys, Has anyone created a query to show the uptime or last restart on workstations? For Cloud Resources you have UpdateSummary, but looking for all endpoint devices. Cant seem to see anyt...

Clive_Watson

Bronze Contributor

Jan 24, 2022

If you have MDE and the DeviceInfo table in Sentinel? See https://github.com/microsoft/Microsoft-365-Defender-Hunting-Queries/blob/d6da8647e41b6862278f50d7227501039e37140d/General%20queries/Device%20uptime%20calculation.md you could modify this - note Timestamp may need changing to TimeGenerated.