Forum Discussion

agattsek's avatar
agattsek
Copper Contributor
Jul 29, 2020

MDATP KQL Query isolated machines

How would you write the Hunting query to identify machiens that have been isolated via MDATP?   Thanks,   Andrew  
agattsek's avatar
agattsek
Copper Contributor
Jul 31, 2020

MichaelJMelone

Is this something that would better be suited for say Sentinel or MCAS regarding the ability to perform a query such as this? 

MichaelJMelone's avatar
MichaelJMelone
Icon for Microsoft rankMicrosoft
Jul 31, 2020

agattsek Defender ATP \ MTP is definitely the right place to show isolation information in my opinion. This may be an example of whitespace - an area where we need to improve. Tali Ash for visibility \ comment.

Resources