KQL to filter by Tags - is it possible?

Copper Contributor

Hi - is it possible within Advanced Hunting, to filter based on an associated Tag?


I have added a "where Tag..." in the KQL below, but I can't actually see where the Tags are held and how to filter.


Any help would be appreciated,


Thanks, Mark


| join DeviceTvmSoftwareVulnerabilities on DeviceId
| join DeviceTvmSoftwareVulnerabilitiesKB on CveId
| where Tag has_any (
4 Replies
Have you tried it via DeviceInfo and then using MachineGroup ?

Hi @KarlMZA - I can't see MachineGroup as a table. Do I need specific permissions to view it?


Thank you,



so what I did to show what appears to be Tag information is the following:
| where DeviceName contains "server name"
| project DeviceName, OSPlatform, MachineGroup

Ive spent the majority of the morning trying to see if there was any other way to retrieve information based on a Tag and this is the only way I seem to be able to go about doing it.
Thanks for your help.

In our instance, MachineGroup is blank for all devices - so the "Tag" must be stored somewhere else in our case.

Thank you for trying to help though,

Cheers, Mark