Skip to content

Latest commit

 

History

276 Commits

Folders and files

NameName
Last commit message
Last commit date
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Defender XDR Advanced Hunting Queries (KQL)

Overview of available queries

  • Entra ID Sign-in and Audit Log Analysis, e.g. PIM evaluation, SMS/Voice Authentication Method Retirement Audit
  • MDE Attack Surface Reduction Rules Report
  • MDE Controlled Folder Access Report
  • MDE Device Control Events
  • MDE Device Network and IP Information Report
  • MDE Endpoint Agent Health Status Report
  • MDE Exploit Protection Report
  • MDE Threat and Vulnerability Management (TVM) SCID Overview
  • MDAV Scan Status
  • MDAV Status Overview
  • SmartScreen
  • Network Protection
  • WSL1, WSL2 and HyperV instances

About

Defender XDR Advanced Hunting Queries (MDE, MDAV, Device Discovery)

Topics

Resources

Stars

13 stars

Watchers

1 watching

Forks

Releases

Packages

Contributors

Languages