SOLVED

Advanced Hunting Query to Include Assigned Tags

Contributor

Good day community,

 

Is there a way to query tags assigned to devices in MDE? Ideally I would want to include such a query in a Power Bi Dashboard to allow for filtering of devices based on tags (location, environment, etc.).

 

From what I can see, it doesn't seem to be possible, but I'm far from being an expert when it comes to advanced queries :)

 

Thanks

6 Replies
You need to join the query with the DeviceInfo table in order to retrieve the machine groups:
DeviceEvents
| take 10
| join kind=leftouter ( DeviceInfo | distinct DeviceId, MachineGroup) on DeviceId
| project-reorder MachineGroup

I would retrieve the DeviceInfo table within PowerBI and enable the correlation there.

@Thijs Lecomte 

Thanks a lot for the recommendation, much appreciated. While this gives me the MachineGroup value, what I am looking for are tags that are assigned to devices. Ideally I would want to be able to query for information against specific tags OR at least be able to include this tag information in the output of a relevant query (similar to what MachineGroup) is giving me.

 

SebastiaanR_0-1610705831917.png

 

best response confirmed by SebastiaanR (Contributor)
Solution
Tags don't show up in the DeviceInfo table, so I fear there is no way to retrieve this through KQL.
You could enrich the information through the API, this exposes the tags

@Thijs Lecomte 

Thanks again for the valuable feedback. Could you perhaps elaborate a little more on this?

At the moment I have a manual export of the devices per location in an Excel data source, but ideally I would want to not use any offline/manual data sources, so if there is a way of retrieving this through API it will solve a huge problem.

 

What I am after is this:

 

SebastiaanR_0-1610788998789.png

 

Everything works as it should, I'm really only trying to get around the manual location bit.

 

I had a look, on your recommendation, and it seems I am able to retrieve all information, including the machineTag value using as an OData feed into PBI. Thank you very much for the guidance, this really makes my life a whole lot easier!

@SebastiaanR Do you have the OBI query you used or the table name? I need to perform similar thing and trying to get this data at this stage with the Advanced Hunting without success. if API is the only way, I want to explore that too. 

 

Thanks, 

Sagar