Sentinel - KQL for High tags

karthik palani 1,036 Reputation points
2023-08-30T06:30:10.7366667+00:00

Hi All,

Need your suggestion and support please

We have Defender for endpoint, VIP devices are tagged as HIGH value assets under "Device Value" settings. Now i want to run advanced hunting queries which pulls "High" tagged devices with below parameters and create alerts. Please suggest

DeviceNetworkEvents,

DeviceLogonEvents

DeviceProcessEvents

Windows for business | Windows Client for IT Pros | Devices and deployment | Configure application groups
Microsoft Security | Intune | Security
Microsoft Security | Microsoft Sentinel
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Givary-MSFT 35,626 Reputation points Microsoft Employee Moderator
    2023-08-31T06:49:56.44+00:00

    @karthik palani Thank you for reaching out to us, just check the below query if it helps to achieve your ask.

    let HVdev = (DeviceInfo
    | where AssetValue == "High" | summarize arg_max(Timestamp,*) by DeviceId);
    DeviceNetworkEvents
    | join kind=leftsemi HVdev on DeviceId
    

    Let me know if you have any further questions, feel free to post back.

    1 person found this answer helpful.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.