Forum Discussion

Sergio-Vargas's avatar
Sergio-Vargas
Copper Contributor
Aug 26, 2023

Microsoft 365 Defender KQL script

Hi All,

 

Is there a way to set a KQL script to identify all the devices in Microsoft 365 Defender with the tag "Pending restart" and, at the same time, identify the user who started a session on those devices?

 

I've been triying several approaches and visiting different websites, which seem complex. I would greatly appreciate any assistance, insights, or suggestions the community can provide to help me troubleshoot and resolve this issue.

 

Thanks.

automation
microsoft defender for endpoint

1 Reply

  • BillClarksonAntill's avatar
    BillClarksonAntill
    Iron Contributor
    Aug 31, 2023
    This could be a way forward for you, different unions can be used within this but as a crude example

    union DeviceEvents, DeviceInfo
    | where DeviceManualTags == "Pending Restart"
    | where ActionType == "LogonAttempted"