Query

DeviceEvents
| where ActionType startswith 'ASR'
| project DeviceName, ActionType
| evaluate pivot(ActionType)

About this query

List the triggered ASR events for each device in a pivot table

Query Information

Description

This query returns a row for each device with a count for each Attack Surface Reduction trigger type. This can be used to find devices that trigger a lot of ASR rules. The reference can be used to find more information on each specific ASR rule.

References

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide

Defender XDR

Explanation

This query is designed to analyze security events related to Attack Surface Reduction (ASR) on devices. Here's a simple breakdown of what it does:

Data Source: It uses the DeviceEvents table, which contains records of various security events on devices.
Filter: It filters the events to only include those where the ActionType starts with 'ASR', indicating they are related to Attack Surface Reduction.
Select Columns: It selects two columns: DeviceName (the name of the device) and ActionType (the type of ASR event).
Pivot Table: It transforms the data into a pivot table format, where each row represents a device, and each column represents a different ASR trigger type. The cells contain counts of how many times each ASR type was triggered on each device.

In summary, this query helps identify which devices are frequently triggering ASR rules by providing a table that counts the occurrences of each ASR event type per device. This can be useful for security monitoring and identifying devices that may need further investigation or configuration adjustments.

KQL Search