How to query Defender for Cloud coverage

Question

How to query Defender for Cloud coverage

Youngseo Lee 30

Hi. I'd like to query the red and blue areas of the next image with KQL.

Is there any references I can refer to? User's image

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2023-12-11T05:26:43.1466667+00:00

Hi @Youngseo Lee ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Anonymous

2024-02-20T14:04:22.9133333+00:00

By any chance can I get the query? I'm trying the same
Youngseo Lee 30 Reputation points

2024-02-23T00:07:51.1066667+00:00

Hi. You can get the query from "open query" in MDC Inventory menu.

But If you want to get same answer what I wanted, I also haven't gotten it yet.

1 answer

Your answer

Shweta Mathur 30,296 Reputation points Microsoft Employee Moderator

2023-12-11T05:26:43.1466667+00:00

Hi @Youngseo Lee ,

Just checking in to see if the below answer helped. If this answers your query, please don’t forget to click "Accept Answer" which might be beneficial to other community members reading this thread. And, if you have any further query do let us know.
Anonymous

2024-02-20T14:04:22.9133333+00:00

By any chance can I get the query? I'm trying the same
Youngseo Lee 30 Reputation points

2024-02-23T00:07:51.1066667+00:00

Hi. You can get the query from "open query" in MDC Inventory menu.

But If you want to get same answer what I wanted, I also haven't gotten it yet.

Answer 1

JamesTran-MSFT 36,906 Microsoft Employee Moderator

@Youngseo Lee

Thank you for your post!

When it comes to Microsoft Defender for Cloud Workload Protection, the resources shown in your screenshot are ones that are eligible for protection by Defender for Cloud within your subscription. For more info.

To hopefully help point you in the right direction or resolve your issue, you should be able to use the KQL query on the Microsoft Defender for Cloud Inventory list, after filtering for the appropriate workload protection resources.

For more info - How to use asset inventory.

Note: Since the KQL query is over 100 lines and contains my subscription info, I'm not able to sure it fully here.

User's image

Additional Links:

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.

Youngseo Lee 30 Reputation points

2023-12-07T02:31:06.7366667+00:00

Thank you for answering but the result of KQL query doesn't represent below.
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-12-07T21:11:36.82+00:00

@Youngseo Lee

Thank you for following up on this!

I've reached out to our Microsoft Defender for Cloud team to see if they can take a look into your issue and will update as soon as possible.

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.
JamesTran-MSFT 36,906 Reputation points Microsoft Employee Moderator

2023-12-12T18:07:47.1466667+00:00

@Youngseo Lee

Thank you for your time and patience on this!

I haven't received a response from the Microsoft Defender for Cloud team, but if you're still having issues with the query and would like to work closer with their team through a one-time free technical support request, please let me know.

Thank you again for your time and patience throughout this issue.

Share via

How to query Defender for Cloud coverage

1 answer

Your answer