Bert-Jan Pals unknown stable kql

ASR Rule Configuration

This query returns a row for each device and states for every rule the configurationstate. This can help to prioritize rules that are not enabled or misconfigurations in the policy.

View Source

Detection Logic

DeviceTvmInfoGathering
| summarize arg_max(Timestamp, DeviceId, DeviceName, AdditionalFields) by DeviceId
| extend ASRConfig = AdditionalFields.AsrConfigurationStates
| evaluate bag_unpack(ASRConfig)

Field Validations

Loading…

Comments (0)

Loading comments...