Defender SmartScreen
MDE Defender Smart Screen Events
Query
// Defender SmartScreen and Network Protection
DeviceEvents
| where ActionType in ("SmartScreenUrlWarning","SmartScreenUserOverride","SmartScreenAppWarning","ExploitGuardNetworkProtectionAudited","ExploitGuardNetworkProtectionBlocked")
// | distinct ActionType,InitiatingProcessFileName, RemoteUrl
| extend data = parse_json(AdditionalFields)
| extend Experience = parse_json(data).Experience
| extend ApplicationName = parse_json(data).Experience
| extend ResponseCategory = parse_json(data).ResponseCategoryAbout this query
Explanation
The query is used to find events related to Windows Defender SmartScreen. It includes different queries to retrieve information about SmartScreen warnings, such as when a user overrides a warning and continues to open an untrusted app or URL. It also includes queries for SmartScreen browser warnings, custom indicators, app warnings, and network protection events. The queries extract specific fields like timestamp, device name, action type, remote URL, experience, initiating process file name, and initiating process account UPN.
Details
Alex Verboon
Released: June 4, 2023
Tables
DeviceEvents
Keywords
DevicesIntuneUser
Operators
whereextendparse_jsonprojecttostringindistinct