KQL Search

Query Details

Confirm Successful Device Onboarding To MDE By Device Name

Query

// Confirm specific device is successfully onboarded to MDE (saves waiting for the portal to update)
DeviceInfo
| where Timestamp > ago(7d)
| where DeviceName startswith "DEVICE-NAME-HERE"
| summarize arg_max(Timestamp, *) by DeviceId
| project Timestamp, DeviceName, DeviceId,
          OnboardingStatus, SensorHealthState,
          MergedToDeviceId, ClientVersion
| order by Timestamp desc

Explanation

This KQL (Kusto Query Language) query is designed to check if a specific device has been successfully onboarded to Microsoft Defender for Endpoint (MDE) without having to wait for the portal to update. Here's a simplified breakdown of what the query does:

  1. Data Source: It starts by looking at data from the DeviceInfo table.

  2. Time Filter: It filters the data to include only records from the last 7 days.

  3. Device Filter: It further narrows down the data to include only records for devices whose names start with "DEVICE-NAME-HERE".

  4. Latest Record: It uses summarize arg_max(Timestamp, *) by DeviceId to find the most recent record for each device, based on the Timestamp.

  5. Select Columns: It selects specific columns to display: Timestamp, DeviceName, DeviceId, OnboardingStatus, SensorHealthState, MergedToDeviceId, and ClientVersion.

  6. Order Results: Finally, it orders the results by Timestamp in descending order, showing the most recent records first.

In summary, this query retrieves the latest onboarding status and related information for a specific device from the last week, helping to confirm if the device is successfully onboarded to MDE.