KQL Search

Query Details

Defender SmartScreen

MDE Defender Smart Screen Events

Query

// Defender SmartScreen and Network Protection
DeviceEvents
| where ActionType in ("SmartScreenUrlWarning","SmartScreenUserOverride","SmartScreenAppWarning","ExploitGuardNetworkProtectionAudited","ExploitGuardNetworkProtectionBlocked")
// | distinct ActionType,InitiatingProcessFileName, RemoteUrl
| extend data = parse_json(AdditionalFields)
| extend Experience = parse_json(data).Experience
| extend ApplicationName = parse_json(data).Experience
| extend ResponseCategory = parse_json(data).ResponseCategory

About this query

Explanation

The query is used to find events related to Windows Defender SmartScreen. It includes different queries to retrieve information about SmartScreen warnings, such as when a user overrides a warning and continues to open an untrusted app or URL. It also includes queries for SmartScreen browser warnings, custom indicators, app warnings, and network protection events. The queries extract specific fields like timestamp, device name, action type, remote URL, experience, initiating process file name, and initiating process account UPN.