DNS Request detection in defender ATP

[DefenderEnthusiast]

We have cisco umbrella in endpoints as well as defender ATP. when we compare the results
defender atp recorded the dns request only once where as umbrella recorded the count as 100. can any one provide some insight on this. 

[#2]

Defender ATP KQL query please. (seem to be working on same thing)