List recently found devices that can be onboarded
Devices Can Be Onboarded
Query
let RecentDetection = 10d;
DeviceInfo
| where Timestamp > ago(RecentDetection)
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == "Can be onboarded"
| summarize TotalDevices = dcount(DeviceId), DeviceNames = make_set(DeviceName) by OSPlatform, DeviceTypeAbout this query
List recently found devices that can be onboarded
Query Information
Description
This query lists devices that can be onboarded to Defender For Endpoint and have recently been detected. You can determine what recently is by using the RecentDetection parameter.
Risk
Devices that are not onboarded can be misused without detection.
References
Defender XDR
Sentinel
let RecentDetection = 10d;
DeviceInfo
| where TimeGenerated > ago(RecentDetection)
| summarize arg_max(TimeGenerated, *) by DeviceId
| where OnboardingStatus == "Can be onboarded"
| summarize TotalDevices = dcount(DeviceId), DeviceNames = make_set(DeviceName) by OSPlatform, DeviceType
Explanation
This query is designed to identify devices that have been recently detected and are eligible to be onboarded to Microsoft Defender for Endpoint. Here's a simple breakdown of what the query does:
-
Define Recent Detection Period: It sets a time frame of 10 days (or whatever you choose) to define what "recently detected" means.
-
Filter Recent Devices: It looks at the
DeviceInfodata to find devices that have been detected within this recent period. -
Identify Eligible Devices: Among these recently detected devices, it filters out those that have an onboarding status of "Can be onboarded," meaning they are not yet protected by Defender for Endpoint but can be added.
-
Summarize Results: The query then summarizes the results by counting the total number of such devices and listing their names. It organizes this information by the operating system platform and device type.
The purpose of this query is to help identify and manage devices that are at risk because they are not yet onboarded to the security system, allowing for timely action to enhance security.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators