Microsoft Defender - Engine, Platform and update states

MDE Defender Engine

Query

DeviceTvmInfoGathering
| extend xAVMode = parse_json(AdditionalFields.AvMode)
| where isnotempty(xAVMode)
| extend AF = parse_json(AdditionalFields)
| evaluate bag_unpack(AF, columnsConflict='keep_source'): (
    Timestamp: datetime, 
    DeviceName: string, 
    OSPlatform: string, 
    AsrConfigurationStates: dynamic, 
    AvEnginePublishTime: datetime, 
    AvEngineRing: string, 
    AvEngineUpdateTime: datetime,
    AvEngineVersion: string,
    AvIsEngineUptodate: string ,
    AvIsPlatformUptodate: string,
    AvIsSignatureUptoDate: string,
    AvMode: string,
    AvPlatformPublishTime: datetime,
    AvPlatformRing: string,
    AvPlatformUpdateTime: datetime,
    AvPlatformVersion: string,
    AvScanResults: string,
    AvSignatureDataRefreshTime: datetime, 
    AvSignaturePublishTime: datetime,
    AvSignatureRing: string,
    AvSignatureUpdateTime: datetime, 
    AvSignatureVersion: string,
    CloudProtectionState: string,
    AdditionalFields: dynamic)

About this query

Explanation

This KQL (Kusto Query Language) script is designed to retrieve and summarize information about the status of Microsoft Defender Antivirus on devices. Here's a simple breakdown of what the query does:

Data Extraction: The query pulls data from a table called DeviceTvmInfoGathering, which contains information about devices and their Microsoft Defender Antivirus status.
Data Parsing: It extracts and parses additional fields related to antivirus mode and other attributes to make them easier to work with.
Detailed Information: The query retrieves detailed information about the antivirus engine, platform, and signature updates, including their version numbers, update times, and whether they are up-to-date.
Summarization:
- It summarizes the number of devices for each antivirus engine version.
- It summarizes the number of devices for each platform version.
- It summarizes the number of devices for each signature version.
Update Rings: It projects information about the update rings for the engine, platform, and signatures, which are used to manage the rollout of updates.
Core Service Information: The query also retrieves information about the MpDefenderCoreService.exe process from another table called DeviceNetworkEvents, focusing on the latest event for each device. It then joins this information with the main dataset to provide a comprehensive view.

Overall, this query helps administrators understand the current state of Microsoft Defender Antivirus across their devices, including which versions are in use and whether they are up-to-date.

Details

Alex Verboon

Released: August 20, 2024

Tables

DeviceTvmInfoGatheringDeviceNetworkEvents

Keywords

DeviceTimestampDeviceNameOSPlatformAsrConfigurationStatesAvEnginePublishTimeAvEngineRingAvEngineUpdateTimeAvEngineVersionAvIsEngineUptodateAvIsPlatformUptodateAvIsSignatureUptoDateAvModeAvPlatformPublishTimeAvPlatformRingAvPlatformUpdateTimeAvPlatformVersionAvScanResultsAvSignatureDataRefreshTimeAvSignaturePublishTimeAvSignatureRingAvSignatureUpdateTimeAvSignatureVersionCloudProtectionStateAdditionalFieldsDeviceNetworkEventsInitiatingProcessFileNameInitiatingProcessVersionInfoProductVersionCoreDeviceName

Operators

extendparse_jsonwhereisnotemptyevaluatebag_unpackprojectsummarizeletjoinarg_maxproject-rename

Actions

GitHub

KQL Search