How to check the events for Attack surface reduction in Audit mode using Advanced hunting

[Naresh2174]

Hello Team,

We have deployed ASR rules using Microsoft System Center Configuration Manager in audit mode. I found that the  ASR events in audit mode can only be checked in Event logs by configuring event forwarder. 

  I want to know whether there is any Kusto query to run in Advanced Hunting and get the list of files in audit mode. This help us in whitelisting the ASR rules

[#2]

I used this very simple advanced hunting search to find all events and then use the filters to drill into specific rules and amend the search timefrme.
DeviceEvents
| where ActionType startswith "Asr"

Each action type will include the rule and a status of Audited or Blocked. If you wanted to search for all audited events on Untrusted Executables for example you could amend search to:
DeviceEvents
| where ActionType == "AsrUntrustedExecutableAudited"

I found that there isn't always a need to exclude files listed in the audit before turning on block mode. I was able to turn on the LSASS Credential Theft rule for example without any exclusions being identified and I've had no complaints. Something to bear in mind if you find hundreds of audited events.