SOLVED

Advanced Hunting Query to Include Assigned Tags

%3CLINGO-SUB%20id%3D%22lingo-sub-2059566%22%20slang%3D%22en-US%22%3EAdvanced%20Hunting%20Query%20to%20Include%20Assigned%20Tags%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2059566%22%20slang%3D%22en-US%22%3E%3CP%3EGood%20day%20community%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIs%20there%20a%20way%20to%20query%20tags%20assigned%20to%20devices%20in%20MDE%3F%20Ideally%20I%20would%20want%20to%20include%20such%20a%20query%20in%20a%20Power%20Bi%20Dashboard%20to%20allow%20for%20filtering%20of%20devices%20based%20on%20tags%20(location%2C%20environment%2C%20etc.).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EFrom%20what%20I%20can%20see%2C%20it%20doesn't%20seem%20to%20be%20possible%2C%20but%20I'm%20far%20from%20being%20an%20expert%20when%20it%20comes%20to%20advanced%20queries%20%3A)%3C%2Fimg%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2063670%22%20slang%3D%22en-US%22%3ERe%3A%20Advanced%20Hunting%20Query%20to%20Include%20Assigned%20Tags%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2063670%22%20slang%3D%22en-US%22%3EYou%20need%20to%20join%20the%20query%20with%20the%20DeviceInfo%20table%20in%20order%20to%20retrieve%20the%20machine%20groups%3A%3CBR%20%2F%3EDeviceEvents%3CBR%20%2F%3E%7C%20take%2010%3CBR%20%2F%3E%7C%20join%20kind%3Dleftouter%20(%20DeviceInfo%20%7C%20distinct%20DeviceId%2C%20MachineGroup)%20on%20DeviceId%3CBR%20%2F%3E%7C%20project-reorder%20MachineGroup%3CBR%20%2F%3E%3CBR%20%2F%3EI%20would%20retrieve%20the%20DeviceInfo%20table%20within%20PowerBI%20and%20enable%20the%20correlation%20there.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2063793%22%20slang%3D%22en-US%22%3ERe%3A%20Advanced%20Hunting%20Query%20to%20Include%20Assigned%20Tags%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2063793%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F186539%22%20target%3D%22_blank%22%3E%40Thijs%20Lecomte%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3EThanks%20a%20lot%20for%20the%20recommendation%2C%20much%20appreciated.%20While%20this%20gives%20me%20the%20MachineGroup%20value%2C%20what%20I%20am%20looking%20for%20are%20tags%20that%20are%20assigned%20to%20devices.%20Ideally%20I%20would%20want%20to%20be%20able%20to%20query%20for%20information%20against%20specific%20tags%20OR%20at%20least%20be%20able%20to%20include%20this%20tag%20information%20in%20the%20output%20of%20a%20relevant%20query%20(similar%20to%20what%20MachineGroup)%20is%20giving%20me.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22SebastiaanR_0-1610705831917.png%22%20style%3D%22width%3A%20400px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F246646i6FFCAE1F91139A98%2Fimage-size%2Fmedium%3Fv%3D1.0%26amp%3Bpx%3D400%22%20role%3D%22button%22%20title%3D%22SebastiaanR_0-1610705831917.png%22%20alt%3D%22SebastiaanR_0-1610705831917.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

Good day community,

 

Is there a way to query tags assigned to devices in MDE? Ideally I would want to include such a query in a Power Bi Dashboard to allow for filtering of devices based on tags (location, environment, etc.).

 

From what I can see, it doesn't seem to be possible, but I'm far from being an expert when it comes to advanced queries :)

 

Thanks

5 Replies
You need to join the query with the DeviceInfo table in order to retrieve the machine groups:
DeviceEvents
| take 10
| join kind=leftouter ( DeviceInfo | distinct DeviceId, MachineGroup) on DeviceId
| project-reorder MachineGroup

I would retrieve the DeviceInfo table within PowerBI and enable the correlation there.

@Thijs Lecomte 

Thanks a lot for the recommendation, much appreciated. While this gives me the MachineGroup value, what I am looking for are tags that are assigned to devices. Ideally I would want to be able to query for information against specific tags OR at least be able to include this tag information in the output of a relevant query (similar to what MachineGroup) is giving me.

 

SebastiaanR_0-1610705831917.png

 

Best Response confirmed by SebastiaanR (Occasional Contributor)
Solution
Tags don't show up in the DeviceInfo table, so I fear there is no way to retrieve this through KQL.
You could enrich the information through the API, this exposes the tags

@Thijs Lecomte 

Thanks again for the valuable feedback. Could you perhaps elaborate a little more on this?

At the moment I have a manual export of the devices per location in an Excel data source, but ideally I would want to not use any offline/manual data sources, so if there is a way of retrieving this through API it will solve a huge problem.

 

What I am after is this:

 

SebastiaanR_0-1610788998789.png

 

Everything works as it should, I'm really only trying to get around the manual location bit.

 

I had a look, on your recommendation, and it seems I am able to retrieve all information, including the machineTag value using as an OData feed into PBI. Thank you very much for the guidance, this really makes my life a whole lot easier!