KQL Search

Query Details

Device Removed From Isolation

Query

CloudAppEvents
| where Timestamp > ago(30d)
| where ActionType == "ReleaseFromIsolation"
| extend ReleasedDevice = tostring(parse_json(RawEventData).DeviceName), ReleaseComment = tostring(parse_json(RawEventData).ActionComment)
| project-rename InitiatedByAccountName = AccountDisplayName, InitiatedByAccounttId = AccountId
// Lookup Isolation Reason
| lookup kind=leftouter (CloudAppEvents
    | where Timestamp > ago(30d)
    | where ActionType == "IsolateDevice"
    | extend IsolatedDevice = tostring(parse_json(RawEventData).DeviceName), IsolationComment = tostring(parse_json(RawEventData).ActionComment), IsolationScope = tostring(parse_json(RawEventData).ActionScope)
    | project-rename IsolationInitiatedByAccountName = AccountDisplayName, IsoaltionInitiatedByAccounttId = AccountId, IsolationTime = Timestamp
    | project IsolationTime, IsolatedDevice, IsolationComment, IsolationScope, IsolationInitiatedByAccountName, IsoaltionInitiatedByAccounttId) on $left.ReleasedDevice == $right.IsolatedDevice
|project-reorder Timestamp, ReleasedDevice, ReleaseComment, InitiatedByAccountName, InitiatedByAccounttId, IsolationTime, IsolationComment, IsolationScope, IsolationInitiatedByAccountName, IsoaltionInitiatedByAccounttId

About this query

Explanation

This query is designed to track and review devices that have been removed from isolation by Microsoft Defender for Endpoint within the last 30 days. It provides a detailed overview of each removal action, including:

  1. Device Information: The name of the device that was removed from isolation.
  2. Removal Details: Comments explaining why the device was removed from isolation and the account that initiated the removal.
  3. Original Isolation Details: Information about the initial isolation, including the reason for isolation, the scope of the isolation, and the account that initiated it.

The query works by first identifying all "ReleaseFromIsolation" actions within the last 30 days. It then matches these actions with the corresponding "IsolateDevice" actions to provide context on why the device was initially isolated. This helps in understanding the full lifecycle of the isolation and removal process for each device. The query is structured to work with both Defender XDR and Sentinel environments, with slight differences in timestamp field names.

Details

Bert-Jan Pals profile picture

Bert-Jan Pals

Released: December 1, 2024

Tables

CloudAppEvents

Keywords

Devices

Operators

whereagoextendtostringparse_jsonproject-renamelookupkindprojectonproject-reorder

Actions

GitHub