Forum Discussion
agattsek
Jul 29, 2020Copper Contributor
MDATP KQL Query isolated machines
How would you write the Hunting query to identify machiens that have been isolated via MDATP? Thanks, Andrew
MichaelJMelone
Jul 31, 2020Microsoft
Good morning agattsek ,
I can validate that isolate and unisolate are listed on the timeline, but I was unable to find those specific events within advanced hunting today.
I tried to find something in the timeline that corresponded with the isolation event (i.e. a process launch or whatnot), but was unable to find a reliable indicator.
- agattsekJul 31, 2020Copper Contributor
Is this something that would better be suited for say Sentinel or MCAS regarding the ability to perform a query such as this?
- MichaelJMeloneJul 31, 2020Microsoft
agattsek Defender ATP \ MTP is definitely the right place to show isolation information in my opinion. This may be an example of whitespace - an area where we need to improve. Tali Ash for visibility \ comment.