Device Discovery
MDE Device Discovery
Query
let deviceId = ""; // Fill ID for specific device, leave blank for all
let lookback = ago(7d);
let machines = DeviceInfo
| where Timestamp >= lookback
| where isempty(deviceId) or DeviceId == deviceId
| where OnboardingStatus != "Onboarded" and isempty(MergedToDeviceId)
| summarize arg_max(Timestamp, *) by DeviceId
| join kind=leftouter (DeviceNetworkInfo | where Timestamp > lookback) on DeviceId
| summarize arg_max(Timestamp, *) by DeviceId
| mv-expand todynamic(SeenBy)
| extend SeenByDeviceId = tostring(SeenBy.DeviceId), LastEncountered = todatetime(SeenBy.LastEncountered)
| project DeviceName, DeviceId, DeviceType, DeviceSubtype, OnboardingStatus, OSPlatform, Vendor, SeenByDeviceId, LastEncountered, IPAddresses
;
machines
| join (DeviceInfo | where Timestamp > lookback and OnboardingStatus == "Onboarded" and OSPlatform != "") on $left.SeenByDeviceId == $right.DeviceId
| summarize arg_max(Timestamp, *) by DeviceId, SeenByDeviceId
//| join (DeviceNetworkInfo | where Timestamp > lookback) on $left.SeenByDeviceId == $right.DeviceId // Uncomment to extend with more network info as needed
| project DeviceName, DeviceId, SeenByDeviceId, SeenByDeviceName = DeviceName1, DeviceType, DeviceSubtype, OnboardingStatus, OSPlatform, Vendor, IPAddresses, LastEncountered
| summarize SeenByDeviceNames=make_set(SeenByDeviceName), SeenByDeviceIds=make_set(SeenByDeviceId) by DeviceName, DeviceId, DeviceType, DeviceSubtype, OnboardingStatus, OSPlatform, Vendor, IPAddresses
| project-reorder DeviceName, DeviceId, SeenByDeviceNames, SeenByDeviceIds, *About this query
Explanation
The query is used for device discovery in Microsoft Defender for Endpoint. It helps identify unmanaged devices in the corporate network by using onboarded Windows 10 and Server 2019 devices. The query returns information about discovered devices and the onboarded devices that have seen them in the network. It also provides details such as device name, device type, onboarding status, operating system platform, vendor, IP addresses, and last encountered time. The query can be customized to filter specific devices or time periods. Additionally, there are other queries provided to retrieve all discovered devices or to get details on which onboarded device a discovered device was seen by.
Details
Alex Verboon
Released: June 4, 2023
Tables
Keywords
Operators