Systems Reportingto Sentinel
Query
//Agented systems reporting to Azure Sentinel
SigninLogs
| union Heartbeat
| where Category == "Direct Agent"
| distinct ComputerExplanation
This query is looking for agented systems that are reporting to Azure Sentinel. It combines the SigninLogs and Heartbeat data, filters for systems in the "Direct Agent" category, and returns only the distinct computer names.