List Recently Found Devices That Can Be On-boarded
Description
This KQL query lists devices that can be on-boarded to Defender For Endpoint and have recently been detected. You can determine what recently is by using the RecentDetection parameter.
Risk
Devices that are not on-boarded can be misused without detection.\
Query
Microsoft Defender For Endpoint
Kusto
let RecentDetection = 10d;
DeviceInfo
| where Timestamp > ago(RecentDetection)
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == "Can be onboarded"
| summarize TotalDevices = dcount(DeviceId), DeviceNames = make_set(DeviceName) by OSPlatform, DeviceTypeMicrosoft Sentinel
Kusto
let RecentDetection = 10d;
DeviceInfo
| where TimeGenerated > ago(RecentDetection)
| summarize arg_max(TimeGenerated, *) by DeviceId
| where OnboardingStatus == "Can be onboarded"
| summarize TotalDevices = dcount(DeviceId), DeviceNames = make_set(DeviceName) by OSPlatform, DeviceType