Skip to content

Latest commit

 

History

History
27 lines (24 loc) · 817 Bytes

DefenseEvasionAlerts.md

File metadata and controls

27 lines (24 loc) · 817 Bytes

Defense Evasion Alerts Generated by Defender For Endpoint

Query Information

Description

This query lists the Defense Evasion Alerts Generated by Defender For Endpoint.

Defender XDR

CloudAppEvents
| where ActionType == 'DefenseEvasion'
| extend
     AlertUri = parse_json(RawEventData).AlertUri,
     AlertDisplayName = parse_json(RawEventData).AlertDisplayName,
     AlertSeverity = parse_json(RawEventData).AlertSeverity
| project AlertUri, AlertDisplayName, AlertSeverity

Sentinel

CloudAppEvents
| where ActionType == 'DefenseEvasion'
| extend
     AlertUri = parse_json(RawEventData).AlertUri,
     AlertDisplayName = parse_json(RawEventData).AlertDisplayName,
     AlertSeverity = parse_json(RawEventData).AlertSeverity
| project AlertUri, AlertDisplayName, AlertSeverity