Sentinel - KQL for High tags

Question

Sentinel - KQL for High tags

karthik palani 1,036

Hi All,

Need your suggestion and support please

We have Defender for endpoint, VIP devices are tagged as HIGH value assets under "Device Value" settings. Now i want to run advanced hunting queries which pulls "High" tagged devices with below parameters and create alerts. Please suggest

DeviceNetworkEvents,

DeviceLogonEvents

DeviceProcessEvents

1 answer

Your answer

Answer 1

Givary-MSFT 35,626 Microsoft Employee Moderator

@karthik palani Thank you for reaching out to us, just check the below query if it helps to achieve your ask.

let HVdev = (DeviceInfo
| where AssetValue == "High" | summarize arg_max(Timestamp,*) by DeviceId);
DeviceNetworkEvents
| join kind=leftsemi HVdev on DeviceId

Let me know if you have any further questions, feel free to post back.

StephanG 826

I adapted your query but do not get results what is wrong here?

let Highassets = DeviceInfo | where AssetValue == "High" | summarize arg_max(Timestamp,*) by DeviceId;
DeviceNetworkEvents
| where RemotePort == "3389"
| where ActionType == "ConnectionSuccess"
| where InitiatingProcessFileName != "Microsoft.Tri.Sensor.exe"
| join kind=leftsemi Highassets on DeviceId

Share via

Sentinel - KQL for High tags

1 answer

Your answer