MDE - Device - Isolation Status
MDE Device Isolationstate
Query
DeviceInfo
| extend MitigationStatusObject = parse_json(MitigationStatus)
| extend IsolationStatus = MitigationStatusObject.Isolated
| where IsolationStatus == "true"About this query
MDE - Device - Isolation Status
Query Information
Description
DESCRIPTION
References
Microsoft 365 Defender
Explanation
This query checks the isolation status of devices in Microsoft 365 Defender. It looks at the MitigationStatus of each device and filters for devices that are currently isolated.
Details
Alex Verboon
Released: June 24, 2024
Tables
DeviceInfo
Keywords
DeviceInfoMitigationStatusObjectIsolationStatus
Operators
extendparse_jsonwhere