Query

DeviceInfo
| summarize arg_max(TimeGenerated,*) by DeviceId
| where DeviceCategory == "IoT"
| summarize count() by ExposureLevel

About this query

Microsoft Defender for Endpoint - Enterprise IOT Exposure

Query Information

Description

Use the below queries to retreive the expore level information for MDE discovered EIOT devices.

References

Get started with enterprise IoT monitoring in Microsoft 365 Defender

Microsoft Defender XDR

Count of devices by exposure level

Count of devices broken down by EIOT Device Type and Exposure level

DeviceInfo
| summarize arg_max(TimeGenerated,*) by DeviceId
| where DeviceCategory == "IoT"
| summarize count() by DeviceType, DeviceSubtype, ExposureLevel

Explanation

This KQL query is designed to analyze data from Microsoft Defender for Endpoint, specifically focusing on enterprise IoT (EIOT) devices. Here's a simple breakdown of what each part of the query does:

Count of Devices by Exposure Level:
- The query retrieves the most recent information for each IoT device by using arg_max(TimeGenerated,*) to get the latest record for each DeviceId.
- It filters the data to include only devices categorized as "IoT".
- Finally, it counts the number of IoT devices for each exposure level, providing a summary of how many devices fall into each risk category.
Count of Devices by EIOT Device Type and Exposure Level:
- Similar to the first query, it retrieves the latest information for each IoT device.
- It filters the data to include only IoT devices.
- The query then counts the number of devices, breaking them down by their type (DeviceType), subtype (DeviceSubtype), and exposure level. This provides a more detailed view of the types of devices and their associated risk levels.

Overall, these queries help in understanding the security exposure of IoT devices within an enterprise by categorizing them based on their risk levels and types.

KQL Search