Microsoft Defender for Endpoint - Troubleshooting Mode
MDE Troubleshooting Mode
Query
//let deviceName = "<deviceName>"; // update with device name
let deviceId = "<deviceID>"; // update with device id
DeviceEvents
| where DeviceId == deviceId
//| where DeviceName == deviceName
| where ActionType == "AntivirusTroubleshootModeEvent"
| extend _tsmodeproperties = parse_json(AdditionalFields)
| project Timestamp,DeviceId, DeviceName, _tsmodeproperties,
_tsmodeproperties.TroubleshootingState, _tsmodeproperties.TroubleshootingPreviousState, _tsmodeproperties.TroubleshootingStartTime,
_tsmodeproperties.TroubleshootingStateExpiry, _tsmodeproperties.TroubleshootingStateRemainingMinutes,
_tsmodeproperties.TroubleshootingStateChangeReason, _tsmodeproperties.TroubleshootingStateChangeSourceAbout this query
Explanation
The queries provided retrieve information about Microsoft Defender for Endpoint Troubleshooting mode states.
The first query retrieves information about the troubleshooting mode states for a specific device. You can search by either device ID or device name by commenting out the respective lines.
The second query identifies devices that are currently in troubleshooting mode. It filters for events that occurred within the last 3 hours and have a troubleshooting state change reason of "started". It then summarizes the data by device ID and orders the results by the most recent timestamp.
The third query provides a count of troubleshooting mode instances by device. It filters for events with a troubleshooting state change reason of "started" within the last 30 days. It then summarizes the data by device ID and sorts the results by the count of instances.
The fourth query provides a total count of troubleshooting mode instances within a specified time range. It filters for events with a troubleshooting state change reason of "started" between 2 days ago and 1 day ago. It then summarizes the data and filters for instances with a count greater than 5.
Details
Alex Verboon
Released: June 4, 2023
Tables
Keywords
Operators