Query Details

Defender for Endpoint - WDAC

MDE WDAC

Query

DeviceEvents
ActionType startswith "AppControl"
| summarize Machines=dcount(DeviceName) by ActionType
| order by Machines desc

About this query

Explanation

This query looks at Windows Defender Application Control events generated by devices monitored by Microsoft Defender for Endpoint. It summarizes the number of machines by the type of action taken and orders them by the most machines. Additionally, it retrieves and parses Microsoft recommended driver block rules from an external source to analyze and display relevant information.