Devices By Specific DeviceType and DeviceSubtype

Description

This query finds devices by DeviceType and/or DeviceSubtype

Query · kql

// Specify the wanted DeviceType and/or DeviceSubtype
let HuntedDeviceType = "NetworkDevice";
let HuntedDeviceSubtype = "Router";
DeviceInfo
| summarize arg_max(Timestamp, *) by DeviceId
| where DeviceType == HuntedDeviceType and DeviceSubtype  == HuntedDeviceSubtype
Raw source Devices By Specific DeviceType and DeviceSubtype · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 88adf141-5058-4f0f-a665-cd56eed754a5
name: Devices By Specific DeviceType and DeviceSubtype
description: |
  This query finds devices by DeviceType and/or DeviceSubtype
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceInfo
tactics: []
relevantTechniques: []
query: |
  // Specify the wanted DeviceType and/or DeviceSubtype
  let HuntedDeviceType = "NetworkDevice";
  let HuntedDeviceSubtype = "Router";
  DeviceInfo
  | summarize arg_max(Timestamp, *) by DeviceId
  | where DeviceType == HuntedDeviceType and DeviceSubtype  == HuntedDeviceSubtype

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.