Microsoft Defender for Endpoint - Troubleshooting Mode
MDE Troubleshooting Mode
Query
DeviceEvents
| where ActionType == "AntivirusTroubleshootModeEvent"
| extend _tsmodeproperties = parse_json(AdditionalFields)
| where Timestamp > ago(2d) //beginning of time range
| where Timestamp < ago(1d) //end of time range
| where _tsmodeproperties.TroubleshootingStateChangeReason contains "started"
| summarize (Timestamp, ReportId)=arg_max(Timestamp, ReportId), count()
| where count_ > 5 // choose your max # of TS mode instances for your time rangeAbout this query
Explanation
The queries provided retrieve information about Microsoft Defender for Endpoint Troubleshooting mode states.
The first query retrieves information about the troubleshooting mode states for a specific device. You can search by either device ID or device name by commenting out the respective lines.
The second query identifies devices that are currently in troubleshooting mode. It filters for events that occurred within the last 3 hours and have a troubleshooting state change reason of "started". It then summarizes the data by device ID and orders the results by the most recent timestamp.
The third query provides a count of troubleshooting mode instances by device. It filters for events with a troubleshooting state change reason of "started" within the last 30 days. It then summarizes the data by device ID and sorts the results by the count of instances.
The fourth query provides a total count of troubleshooting mode instances within a specified time range. It filters for events with a troubleshooting state change reason of "started" between 2 days ago and 1 day ago. It then summarizes the data and filters for instances with a count greater than 5.
Details
Alex Verboon
Released: June 4, 2023
Tables
Keywords
Operators