Microsoft Entra Suite Tech Accelerator
Aug 14 2024, 07:00 AM - 09:30 AM (PDT)
Microsoft Tech Community

Device events queries

Copper Contributor

Hello I noticed when I am trying to run a query in advanced hunting that deviceevents is marked with red and is not recognised.

the section device is totally missing so I cannot get info about asr.

is there a way I can add it ?

thank you!

3 Replies
it sound like you dont have right access or permission assigned. your access to endpoint data is determined by role-based access control (RBAC) settings in Microsoft Defender for Endpoint https://learn.microsoft.com/en-us/microsoft-365/security/defender/custom-roles?view=o365-worldwide https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-overview?view=o36...
I can run other queries and I am a global admin.
share the query you are trying to run