Recently I've been working on some Advanced Hunting queries for Web Content Filtering. This data is easy to find for third party browsers such as Chrome or Firefox assuming Network Protection is turned on. Simply query DeviceEvents | Where ActionType == 'ExploitGuardNetworkProtectionBlocked'. However, Edge does not use Network Protection to block sites based on Web Content Filtering. It utilizes SmartScreen. As such I would expect that these events would be under the 'SmartScreenUrlWarning' ActionType. However, this doesn't return any data. In fact, I've found that none of the SmartScreen related ActionTypes return any data. I've confirmed that SmartScreen is enabled and functional with the tools on demo.wd.com. Has anyone been able to successfully query SmartScreen data through Advanced Hunting?
