NotOnboarded Devices by DeviceName Prefix

Description

This query searches for not onboarded devices with a specific prefix

Query · kql

//
let Onboarded = "Onboarded";
let DeviceNamePrefix = "minint";
DeviceInfo
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus != "Onboarded"
| where DeviceName startswith DeviceNamePrefix
Raw source NotOnboarded Devices by DeviceName Prefix · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 6ed94608-316e-4a2d-85dd-91fc9294749e
name: NotOnboarded Devices by DeviceName Prefix
description: |
  This query searches for not onboarded devices with a specific prefix
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceInfo
tactics: []
relevantTechniques: []
query: |
  //
  let Onboarded = "Onboarded";
  let DeviceNamePrefix = "minint";
  DeviceInfo
  | summarize arg_max(Timestamp, *) by DeviceId
  | where OnboardingStatus != "Onboarded"
  | where DeviceName startswith DeviceNamePrefix

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.