Forum Discussion

Copper Contributor

Feb 13, 2023

Solved

Advanced hunting / KQL search for Investigation Priority (User's Score)

Hi good people, When viewing identities in Defender, under 'Investigation Priority' there is a Score. Is it possible to find this score in a KQL query at all, or is it stored in any logs that cou...

investigation

Or Tsemah
Feb 14, 2023
This data is not available through advanced hunting, the only way export activities with score (which are part of the overall user score) is to use the Defender for cloud apps SIEM agents.

We are evaluating ways to enable more programmatic access to that data through Microsoft 365 Defender components but there is no current ETA that we can share at this point.

Or Tsemah

Iron Contributor

Feb 14, 2023

Hi, this per-identity score is available both in each identity page, in the overall identities page (where you can sort by it) or as part of alerts\incidents where the impacted identities have any.

NewandForgiven

Copper Contributor

Feb 14, 2023

Or Tsemah Thanks for the answer; my question was are those the only two places its visible, as they can only be manually checked, or is it possible to view the numbers via Advanced Hunting or from an exported log.

Or Tsemah
Iron Contributor
Feb 14, 2023
This data is not available through advanced hunting, the only way export activities with score (which are part of the overall user score) is to use the Defender for cloud apps SIEM agents.

We are evaluating ways to enable more programmatic access to that data through Microsoft 365 Defender components but there is no current ETA that we can share at this point.