PUA ThreatName per Computer

Description

Today MDE Alerts do not show PUA/WDAV ThreatName. This is a demonstration of how to get, for example, PUA Threat Names.

Query · kql

DeviceEvents
| where ActionType == "AntivirusDetection"
| extend ParsedFields=parse_json(AdditionalFields)
| where ParsedFields.ThreatName contains "PUA"
| project DeviceName, FileName, SHA1 , ThreatName=tostring(ParsedFields.ThreatName),
          WasRemediated=tobool(ParsedFields.WasRemediated),
          WasExecutingWhileDetected=tobool(ParsedFields.WasExecutingWhileDetected), Timestamp
Raw source PUA ThreatName per Computer · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 1a954599-aa03-421d-a35f-dbe18859bdd5
name: PUA ThreatName per Computer
description: |
  Today MDE Alerts do not show PUA/WDAV ThreatName. This is a demonstration of how to get, for example, PUA Threat Names.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  DeviceEvents
  | where ActionType == "AntivirusDetection"
  | extend ParsedFields=parse_json(AdditionalFields)
  | where ParsedFields.ThreatName contains "PUA"
  | project DeviceName, FileName, SHA1 , ThreatName=tostring(ParsedFields.ThreatName),
            WasRemediated=tobool(ParsedFields.WasRemediated),
            WasExecutingWhileDetected=tobool(ParsedFields.WasExecutingWhileDetected), Timestamp

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.