List Antivirus Scan Activities
Manual Antivirus Scans
Query
CloudAppEvents
| where ActionType == "RunAntiVirusScan"
| extend DeviceName = tostring(parse_json(RawEventData).DeviceName), ActionComment = tostring(parse_json(RawEventData).ActionComment), ActionScope = tostring(parse_json(RawEventData).ActionScope)
| summarize TotalAntivirusScans = count(), ScanTypes = make_set(ActionScope), Comments = make_set(ActionComment) by DeviceNameAbout this query
List Antivirus Scan Activities
Query Information
Description
This query lists all manual (and playbook related) anvitius actions that are initiated and the related comments per device.
References
- https://learn.microsoft.com/en-us/defender-endpoint/mdav-scan-best-practices
- https://kqlquery.com/posts/audit-defender-xdr/
Defender XDR
Sentinel
CloudAppEvents
| where ActionType == "RunAntiVirusScan"
| extend DeviceName = tostring(parse_json(RawEventData).DeviceName), ActionComment = tostring(parse_json(RawEventData).ActionComment), ActionScope = tostring(parse_json(RawEventData).ActionScope)
| summarize TotalAntivirusScans = count(), ScanTypes = make_set(ActionScope), Comments = make_set(ActionComment) by DeviceName
Explanation
This query is designed to list all antivirus scan activities that have been manually initiated or triggered by a playbook on various devices. It extracts and organizes information about these scan activities from the CloudAppEvents data source. Here's a breakdown of what the query does:
-
Filter Events: It looks for events where the action type is "RunAntiVirusScan," which indicates that an antivirus scan was initiated.
-
Extract Information: For each event, it extracts the device name, any comments associated with the action, and the scope of the action (e.g., full scan, quick scan) from the raw event data.
-
Summarize Data: The query then summarizes the data by device name, providing:
- The total number of antivirus scans initiated on each device.
- A set of different scan types (scopes) that were executed on each device.
- A set of comments related to the scan actions on each device.
This summary helps in understanding the frequency and types of antivirus scans performed on each device, along with any additional context provided through comments. The query is applicable to both Defender XDR and Sentinel environments, as indicated by the identical KQL used for both.
Details
Bert-Jan Pals
Released: December 1, 2024
Tables
Keywords
Operators