KQL Search

Query Details

Defender for Endpoint - Device Control

MDE Device Control

Query

DeviceEvents
| where ActionType == "PnpDeviceBlocked" or ActionType == "PnpDeviceAllowed"
| extend parsed=parse_json(AdditionalFields)
| extend MediaClassGuid = tostring(parsed.ClassGuid)
| extend MediaInstanceId = tostring(parsed.DeviceInstanceId)
| extend MediaDeviceId = tostring(parsed.MatchingDeviceId)
| project Timestamp , DeviceId, DeviceName, ActionType, MediaClassGuid, MediaDeviceId, MediaInstanceId, AdditionalFields
| order by Timestamp desc

About this query

Explanation

This KQL (Kusto Query Language) script is designed to help you monitor and analyze events related to Device Control in Microsoft Defender for Endpoint. Here's a simple breakdown of what each part of the script does:

  1. Device Installation Events:

    • This query retrieves events where devices are either blocked or allowed to connect to a system. It extracts and displays details like the device's class, instance, and ID, along with the event timestamp and device information.

  2. Device Installation Policy Changes:

    • This query checks if there have been any changes to the device installation policy on a machine. It specifically looks for modifications in the Windows registry related to device installation policies.

  3. Removable Storage Policy Events:

    • This query captures events triggered by policies enforcing rules on removable storage devices, such as USB drives. It provides detailed information about the storage device and the policy verdict.

  4. Removable Storage File Events:

    • This query gathers information about file operations on removable storage devices, such as copying or moving files. It includes details about the file, the operation, and the storage device.

  5. Printer Protection Events:

    • This query identifies instances where print jobs are blocked by the Device Control Printer Protection policy. It includes details about the blocked print job, such as the file name and printer used.

  6. USB Printer Identification:

    • This query finds USB printers connected to a device by extracting and displaying their Vendor ID (VID) and Product ID (PID), along with other relevant information.

Overall, these queries help you monitor and enforce security policies related to device control, including device installation, removable storage access, and printer protection, using Microsoft Defender for Endpoint.

Details

Alex Verboon profile picture

Alex Verboon

Released: April 16, 2026

Tables

DeviceEventsDeviceRegistryEvents

Keywords

DeviceEventsRegistryIdNameActionTypeTimestampAdditionalFieldsMediaClassGuidInstanceRemovableStorageAccessPolicyVerdictBusProductVendorSerialNumberFolderPathFileSizeInitiatingProcessAccountRuleInformationOperationEvidenceLocationPrintedPrintPortPrinterDescriptionVidPidIds

Operators

`|``where``==``or``extend``parse_json()``tostring()``project``order by``contains``split()``replace_string()``strcat()`

Actions

GitHub