Does Defender Smartscreen trigger an MDE alert.

Hi, Was wondering if there was a way to see Defender SmartScreen event/alert in MDE Security portal? For example, lets says Defender Smartscreen is configured and try the Defender Smartscree...

Jonhed

Steel Contributor

Nov 18, 2021

Jean-Philippe Breton

Not 100% sure if an alert will be generated, but you should be able to see events from Advanced Hunting.

This is a query I used lately to find malicious URLs blocked by smartscreen and network protection.

DeviceEvents
| where (ActionType == "ExploitGuardNetworkProtectionBlocked" and parse_json(AdditionalFields).ResponseCategory != "CustomPolicy") or
 (ActionType == "SmartScreenUrlWarning" and parse_json(AdditionalFields).Experience != "CustomPolicy")

The ActionType "SmartScreenUrlWarning" shows the Smartscreen browser events, and I think there was a "SmartScreenFileWarning" for file events too.

Jean-Philippe Breton

Iron Contributor

Nov 18, 2021

Oh thanks for the query !!
It will be very helpful.

I just find it weird that Smartscreen event do not show up in Alerts dashboard in MDE...

Forum Discussion

Does Defender Smartscreen trigger an MDE alert.