KQL to filter by Tags - is it possible?

[marktait19]

Hi - is it possible within Advanced Hunting, to filter based on an associated Tag?

I have added a "where Tag..." in the KQL below, but I can't actually see where the Tags are held and how to filter.

Any help would be appreciated,

Thanks, Mark

DeviceNetworkInfo

| join DeviceTvmSoftwareVulnerabilities on DeviceId

| join DeviceTvmSoftwareVulnerabilitiesKB on CveId

| where Tag has_any (

"tag1",

"tag2"

)

[#2]

Have you tried it via DeviceInfo and then using MachineGroup ?

[#3]

Hi @KarlMZA - I can't see MachineGroup as a table. Do I need specific permissions to view it?

Thank you,

Mark

[#4]

so what I did to show what appears to be Tag information is the following:
DeviceInfo
| where DeviceName contains "server name"
| project DeviceName, OSPlatform, MachineGroup

Ive spent the majority of the morning trying to see if there was any other way to retrieve information based on a Tag and this is the only way I seem to be able to go about doing it.

[#5]

Thanks for your help.

In our instance, MachineGroup is blank for all devices - so the "Tag" must be stored somewhere else in our case.

Thank you for trying to help though,

Cheers, Mark