MDATP KQL Query isolated machines

Copper Contributor

How would you write the Hunting query to identify machiens that have been isolated via MDATP?






6 Replies

Good morning @agattsek ,

I can validate that isolate and unisolate are listed on the timeline, but I was unable to find those specific events within advanced hunting today.


I tried to find something in the timeline that corresponded with the isolation event (i.e. a process launch or whatnot), but was unable to find a reliable indicator.


Is this something that would better be suited for say Sentinel or MCAS regarding the ability to perform a query such as this? 

@agattsek Defender ATP \ MTP is definitely the right place to show isolation information in my opinion. This may be an example of whitespace - an area where we need to improve. @Tali Ash for visibility \ comment.

@agattsek We had a blog that posted recently that shows how you can see the isolation actions in the Action Center.  It's not a query, but might solve the need another way: 


Jake Mowrer

We are looking at ingesting this data into advanced hunting as well.

Please provide an update should the query language be identified, tested, and proven to produce the desired results. Thank you! @Tali Ash