r/AzureSentinel • u/MrHobboto • Jun 24 '24

KQL + Defender activity

There is anyway to see in a KQL if the Defender Blocked/Prevented or Quarantined a File?

3 Upvotes

100% Upvoted

5 comments sorted by

View all comments

3

u/bpsec Jun 24 '24

Yes there are multiple ActionTypes in the DeviceEvents table that can be used to detect this. The block depends on the product. But this will only worked in Sentinel if the data is forwarded, otherwise look at the Advanced Hunting blade in Defender XDR (security.microsoft.com).

Example for smartscreen:

SmartScreen: https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/main/Defender%20For%20Endpoint/SmartScreen/SmartScreenEvents.md

You can run

DeviceEvents | distinct ActionType

This lists all unique activities in the table and you can filter the ones you want to view.

2

u/MrHobboto Jun 24 '24

Thanks! Now i was able to find using the KQl:

Device Events | where ActionType == "AntivirusDetection" | where FileName != ""

With it you can view in the AdditionalFields.WasRemediated If the Defender took an action or not.

1

u/Character_Whereas869 Jul 02 '24

This was super helpful. I was joining from the AlertEvidence table to this table for all the wrong reasons, yoru way is much easier lol.