MDATP KQL Query isolated machines

[agattsek]

How would you write the Hunting query to identify machiens that have been isolated via MDATP?

Thanks,

Andrew

[#2]

Good morning @agattsek ,

I can validate that isolate and unisolate are listed on the timeline, but I was unable to find those specific events within advanced hunting today.

I tried to find something in the timeline that corresponded with the isolation event (i.e. a process launch or whatnot), but was unable to find a reliable indicator.

[#3]

@MichaelJMelone

Is this something that would better be suited for say Sentinel or MCAS regarding the ability to perform a query such as this? 

[#4]

@agattsek Defender ATP \ MTP is definitely the right place to show isolation information in my opinion. This may be an example of whitespace - an area where we need to improve. @Tali Ash for visibility \ comment.

[#5]

@agattsek We had a blog that posted recently that shows how you can see the isolation actions in the Action Center.  It's not a query, but might solve the need another way: https://techcommunity.microsoft.com/t5/microsoft-threat-protection/the-action-center-in-microsoft-th... 

Thanks,

Jake Mowrer

[#6]

We are looking at ingesting this data into advanced hunting as well.

[#7]

Please provide an update should the query language be identified, tested, and proven to produce the desired results. Thank you! @Tali Ash