List SmartScreen Events

Smart Screen Events

Query

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "SmartScreen"
| extend SmartScreenTrigger = iff(ActionType == "SmartScreenUrlWarning", 
RemoteUrl, FileName)
| extend ReasonForTrigger = parse_json(AdditionalFields).Experience
| project
     Timestamp,
     DeviceName,
     ActionType,
     SmartScreenTrigger,
     ReasonForTrigger,
     InitiatingProcessCommandLine

About this query

List SmartScreen Events

Query Information

Description

This query lists all SmartScreen related events.

References

https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/

Defender XDR

Sentinel

DeviceEvents
| where TimeGenerated > ago(30d)
| where ActionType startswith "SmartScreen"
| extend SmartScreenTrigger = iff(ActionType == "SmartScreenUrlWarning", 
RemoteUrl, FileName)
| extend ReasonForTrigger = parse_json(AdditionalFields).Experience
| project
     TimeGenerated,
     DeviceName,
     ActionType,
     SmartScreenTrigger,
     ReasonForTrigger,
     InitiatingProcessCommandLine

Explanation

This query is designed to list events related to SmartScreen, a security feature in Windows that helps protect against phishing and malware. It retrieves data from the past 30 days and focuses on events where the action type begins with "SmartScreen". The query extracts specific details about each event, such as:

Timestamp/TimeGenerated: When the event occurred.
DeviceName: The name of the device where the event was logged.
ActionType: The type of SmartScreen action that was triggered.
SmartScreenTrigger: The URL or file name that triggered the SmartScreen action, depending on the type of warning.
ReasonForTrigger: The reason or experience that caused the SmartScreen action, parsed from additional fields.
InitiatingProcessCommandLine: The command line of the process that initiated the event.

The query is written in KQL (Kusto Query Language) and is intended for use with Microsoft's Defender XDR and Sentinel platforms to help security teams monitor and analyze SmartScreen events.

Details

Bert-Jan Pals

Released: December 1, 2024

Tables

DeviceEvents

Keywords

DeviceEventsSmartScreenTimestampNameActionTypeRemoteUrlFileAdditionalFieldsExperienceInitiatingProcessCommandLine

Operators

agostartswithextendiffparse_jsonproject

Actions

GitHub

KQL Search