Statistics onboarded devices (OS)
Onboarded Device By OS
Query
DeviceInfo
| where OnboardingStatus == "Onboarded"
| summarize arg_max(Timestamp, *) by DeviceId
| summarize TotalDevices = count() by OSPlatformAbout this query
Statistics onboarded devices (OS)
Query Information
Description
This query lists how many devices have been onboarded per operating system.
References
Defender XDR
Sentinel
DeviceInfo
| where OnboardingStatus == "Onboarded"
| summarize arg_max(Timestamp, *) by DeviceId
| summarize TotalDevices = count() by OSPlatform
Explanation
This query is designed to count the number of devices that have been successfully onboarded, categorized by their operating system. Here's a simple breakdown of what the query does:
-
Filter Onboarded Devices: It starts by filtering the data to include only those devices that have a status of "Onboarded."
-
Select Latest Record Per Device: For each device, it selects the most recent record based on the timestamp. This ensures that only the latest information for each device is considered.
-
Count Devices by OS: Finally, it counts the total number of onboarded devices for each operating system platform.
The result is a summary showing how many devices are onboarded for each type of operating system. This query is the same for both Defender XDR and Sentinel environments.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators