Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Device events queries

Copper Contributor

Hello I noticed when I am trying to run a query in advanced hunting that deviceevents is marked with red and is not recognised.

the section device is totally missing so I cannot get info about asr.

is there a way I can add it ?

thank you!

3 Replies
it sound like you dont have right access or permission assigned. your access to endpoint data is determined by role-based access control (RBAC) settings in Microsoft Defender for Endpoint
I can run other queries and I am a global admin.
share the query you are trying to run