Forum Widgets
Latest Discussions
Advanced Hunting Data Schema
Hello everyone, I have a question regarding the use of schema for Advanced Hunting queries. We are an organization with several companies under our holding. I need to recover the USB connections on the machines but only for one company and not the others. I need to sort on Company Name for the user. But in the Advanced Hunting schema there are no fields to filter on this. I looked specifically in UserInfo and DeviceInfo. Here's the query I use to detect USBs. I need to filter by CompanyName to retrieve the list of devices or users for this company only. DeviceEvents | where ActionType == “PnpDeviceConnected” | extend parsed=parse_json(AdditionalFields) | project Timestamp, DeviceName, DeviceId=tostring(parsed.DeviceId), ClassName=tostring(parsed.ClassName) | where ClassName == “DiskDrive” | summarize UsbFirstSeen=min(Timestamp), UsbLastSeen=max(Timestamp) by DeviceId, DeviceName; Is there another solution ? Thanks in advance for your answers, HKN
Deploying Defender for Business without o365 accounts
Hi, I have few SMB customers, who due to nature of their buiness do not want/need o365 accounts. Beside, their company policy does not allow them to store any business data in clouds abroad. However, they all have their local AD domain and Windows-only environment. Now, I would like to setup Defender for Business + Huntress MDR as a good and affordable threat protection combo, but here my questions begin. Please, shed some light on this: Does Defender for Business actually need endpoint users to be actually signed-in into their o365 accounts for full protection to work properly? What if they aren't - would full protection still be in place, or would Defender for business functionality drop down to basic antivirus, like regular Defender? Is Defender for Business in my case really so complicated and hard to install and setup? I've read some instructions and there is a ton of documentation, Ps scripts and tools, like Intune and such and despite being 40+ years in computer engineering, I got lost. Mostly because I do not use a ton of Microsoft products daily. Does Defender for Business have some easy to manage Cloud management tool, where I would see and manage all installed Defenders for Business? Or must I learn those Intunes, Azure, o365 Security and Defender portals, which are total overkill for those SMB which I manage? Thank you!
How to get the Protection History from a device
Hello, I would like to get the Protection History without the user intervention. I don't understand why is not in the device page in Microsoft 365 Defender initially... I tried to find a way to doing it in the Advanced hunting, but it's new for me, if some one have the command, thanks in advance. I tried with the Live response, but you can only use the CMD(Is it a way to initiate the Live response with Powershell ?) run a powershell script and tried to get the output file, but i got every time the error : Empty file, even if i doing a -outfile with my PP script and tried to get this specific file... Someone can help me please 🙂 ? Thanks
Security Baselines section disappears
I arrived here from this page... https://learn.microsoft.com/en-us/defender-xdr/entity-page-device ... which details all the possible sections of a given device when located within the Assets->Devices section of the Defender portal. When I click on a machine, I see most of the sections along the top (Overview, Incidents & alerts, Timeline, etc) and I can click on each one but as soon as I click on a device, the 'Security Baseline' section momentarily appears then disappears. The link to Security Baselines is also broken in the link I pasted above. can anyone else access this section? Regards, Graham
MS Defender XDR API missing Alerts
The Microsoft Defender XDR API is missing Alerts that are visible in the console (https://security.microsoft.com). The number of Alerts returned by the Incident API is limits to 150. This information is no where in the documentation. If you have an Incident with greater than 150 Alerts, the API will not provide all the Alerts for a given Incident. https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents My team has confirmed this behavior across hundreds of tenants and thousands of Incidents. MS Premier Support has not been helpful in understanding if this is a known issue or a bug. Has anyone encountered this issue and have any information? Obviously closing the Incident will solve the problem, but for ongoing investigations this is not alway an option.
Pending actions notification via KQL / Graph API
Hello, I'm looking for a way to get notifications when an investigation is in Pending Approval state. I have tried searching the logs in Defender and Sentinel and have tried finding a graph request that could get this information, but no luck. Is this something that exists? Thank you for any help regarding this topic. Kristof
Defender - Cloud Activity Logs suspicious
Hi, I just noticed this logs from Defender - Cloud Apps > Activity Logs, seems all our Microsoft Cloud PC has these logs, looks suspicious for me as it is querying our Domain Admins account it seems, but would like to confirm. If this is suspicious, can help how to mitigate this please, thank you.
