KQL Search

This query is designed to help you identify any Microsoft Monitoring Agent (MMA) instances on your systems that are still running Defender processes or communicating with the Microsoft Defender for Endpoint (MDE) Workspace. Here's a simplified breakdown:

1. Context:

   • Microsoft is retiring the Log Analytics Agent (MMA) on August 31, 2024.
   • If you're using Windows Server 2012-R2 or 2016, consider switching to the unified agent for Defender for Endpoint.
   • After February 1, 2025, support for MMA agents will gradually decrease, potentially causing compatibility issues.

2. Purpose:

   • The query helps you find devices that are still using the MMA to run Defender processes or communicate with the MDE Workspace.

3. Steps:

   • Workspace ID: You need to update the query with your specific Defender for Endpoint Workspace ID, which you can find in the Defender for Endpoint settings.

4. Queries:

   • First Query: Identifies devices that are still communicating with the MDE Workspace using the MMA.

     • It checks for network events where the initiating process is located in the MMA directory and communicates with the specified Workspace ID.
     • It summarizes the results by device name, listing the URLs and process file names involved.

   • Second Query: Identifies devices where MMA-based Defender processes are still active.

     • It looks for process events where the initiating process is in a specific MMA directory and matches certain target process names (e.g., "pmfexe.exe", "mssenses.exe").
     • It summarizes the results by device name, listing the active process file names.

By running these queries, you can pinpoint which devices need attention to ensure a smooth transition away from the retiring MMA.