MDATP KQL Query isolated machines

Question

How would you write the Hunting query to identify machiens that have been isolated via MDATP?&nbsp;Thanks,&nbsp;Andrew&nbsp;

cyb3rmik3 · Answer

nfmiringu&nbsp;hello,&nbsp;yes, this has been implemented. Once you isolate an endpoint, you can find under the DeviceInfo table, the&nbsp;MitigationStatus&nbsp;operator. I've built a query about this, you may find it here:&nbsp;https://github.com/cyb3rmik3/KQL-threat-hunting-queries/blob/main/03.SecOps/identify-endpoints-where-mitigationstatus-is-isolated.md&nbsp;If I have answered your question,&nbsp;please mark your post as SolvedIf you like my response,&nbsp;please consider giving it a like

michaeljmelone · Answer

Good morning&nbsp;agattsek&nbsp;,
I can validate that isolate and unisolate are listed on the timeline, but I was unable to find those specific events within advanced hunting today.

I tried to find something in the timeline that corresponded with the isolation event (i.e. a process launch or whatnot), but was unable to find a reliable indicator.

agattsek · Answer

MichaelJMeloneIs this something that would better be suited for say Sentinel or MCAS regarding the ability to perform a query such as this?&nbsp;

michaeljmelone · Answer

agattsek&nbsp;Defender ATP \ MTP is definitely the right place to show isolation information in my opinion. This may be an example of whitespace - an area where we need to improve.&nbsp;Tali Ash&nbsp;for visibility \ comment.

jake_mowrer · Answer

agattsek&nbsp;We had a blog that posted recently that shows how you can see the isolation actions in the Action Center.&nbsp; It's not a query, but might solve the need another way:&nbsp;https://techcommunity.microsoft.com/t5/microsoft-threat-protection/the-action-center-in-microsoft-threat-protection-your-one-stop/ba-p/1550178&nbsp;
Thanks,
Jake Mowrer

Forum Discussion

MDATP KQL Query isolated machines

Share

Resources