Custom rule detection in Advance hunting ATP

[moderndesktop]

Hi guys , 

I am trying to achieve below goal 

We want to detect if CIRT tools l ( like universal forwarder for splunk , Nessus , umbrella roaming client etc ) is installed on win 10 machine or not and based on that device should be marked as compliant if installed and non compliant if not and further based on compliance status we can control access to company resources via conditional access OR put machine in isolation if any of the CIRT tool mentioned above is not installed to client machine.

After going through ATP documentation , i came to know we can also create custom detection rule based on KQL and then specify action based on result . Result would be like device Isolation from the network which exactly meet our requirement .

Now , i am not sure if my requirement can be met by creating a custom detection rule or not .

If yes , then what's the way ( resources , guides ) to create custom rule

If not , then is there any other solution from microsoft which we can meet our requirement ?

Note: we do have ATP and AAD premium p2 license and very adaptive to use any of the Microsoft technology . Please help

[#2]

@moderndesktop 

You can do something similar to what was done here: https://techcommunity.microsoft.com/t5/microsoft-defender-atp/automated-machine-tagging-in-just-a-fe....

You can simply run a scheduled query to produce a list of systems which are missing the tool and run an isolation action through Microsoft flow or Logic apps. Isolating a system might be a nuclear option since you won't be able to reach it and deploy the app to make it compliant. From what I know, only Defender ATP can reach out to the system after isolation so you can look at installing the application through ATP Live response or creating something like a service now ticket through Logic apps to get someone to deploy the software.

[#3]

@blankachu  Thanks buddy