Forum Discussion

agattsek's avatar
agattsek
Copper Contributor
Jul 29, 2020

MDATP KQL Query isolated machines

How would you write the Hunting query to identify machiens that have been isolated via MDATP?   Thanks,   Andrew  
MichaelJMelone's avatar
MichaelJMelone
Icon for Microsoft rankMicrosoft

Good morning agattsek ,

I can validate that isolate and unisolate are listed on the timeline, but I was unable to find those specific events within advanced hunting today.

I tried to find something in the timeline that corresponded with the isolation event (i.e. a process launch or whatnot), but was unable to find a reliable indicator.

agattsek's avatar
agattsek
Copper Contributor
Jul 31, 2020

MichaelJMelone

Is this something that would better be suited for say Sentinel or MCAS regarding the ability to perform a query such as this? 

  • MichaelJMelone's avatar
    MichaelJMelone
    Icon for Microsoft rankMicrosoft
    Jul 31, 2020

    agattsek Defender ATP \ MTP is definitely the right place to show isolation information in my opinion. This may be an example of whitespace - an area where we need to improve. Tali Ash for visibility \ comment.

Resources