Get users most active machine by querying Defender endpoint via Powershell.

[Synthetic_Sentience]

Hi

I'm looking to query MS Defender endpoint info with Powershell.

I'm wondering is this simply a module add on and authentication or is more involved or not possible.

One example is I wish to get the most active computer and any outstanding alert's for this computer.

Also I'm curious as to whether Powershell can call an existing KQL query and receive its results into the script.

Thanks

[#2]

https://docs.microsoft.com/en-us/powershell/module/defender/?view=windowsserver2019-ps Perhaps a good start?