User Profile
marktait19
Copper Contributor
Joined 3 years ago
User Widgets
Recent Discussions
Re: FirstDetected Field - where can I find it in the Defender schema?
Hi - my client hasn't opened up the API for me yet. I only have access to Hunting -> Advanced Hunting. Is the cveFirstSeenTimestamp - only available via the API? Is there an equivalent field I can find in Advanced Hunting? Thanks again, MarkFirstDetected Field - where can I find it in the Defender schema?
Hi - in Microsoft 365 Defender, when running Kusto queries - which table will I find the "First Detected" field against a device? I can see it in the Device Summary page, but can't find it in any of the available tables in the schema. Thanks for any advice, MarkRe: Microsoft 365 Defender - where to create a custom list of devices
Robina Hi Robina - thank you for your reply. When I select devices on the Devices page, I do not see "Add to custom list", I only see: Manage Tags Initiate Automated Investigation Device Value Exclude Report Inaccuracy I've attached a screenshot. Have I missed something, or is it perhaps that I don't have specific permissions to create custom lists? Thanks again, MarkKQL to filter by Tags - is it possible?
Hi - is it possible within Advanced Hunting, to filter based on an associated Tag? I have added a "where Tag..." in the KQL below, but I can't actually see where the Tags are held and how to filter. Any help would be appreciated, Thanks, Mark DeviceNetworkInfo | join DeviceTvmSoftwareVulnerabilities on DeviceId | join DeviceTvmSoftwareVulnerabilitiesKB on CveId | where Tag has_any ( "tag1", "tag2" )
