Can Be Onboarded Devices

Description

This query surfaces devices that were discovered by Microsoft Defender for Endpoint and can be onboarded

Query · kql

// Can Be Onboarded devices
let CanBeOnboarded = "Can be onboarded";
DeviceInfo
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus == CanBeOnboarded
Raw source Can Be Onboarded Devices · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 90f30a21-5de6-4c5e-85cf-d81347361aec
name: Can Be Onboarded Devices
description: |
  This query surfaces devices that were discovered by Microsoft Defender for Endpoint and can be onboarded
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceInfo
tactics:
- Resource Development
- Initial Access
relevantTechniques: []
query: |
  // Can Be Onboarded devices
  let CanBeOnboarded = "Can be onboarded";
  DeviceInfo
  | summarize arg_max(Timestamp, *) by DeviceId
  | where OnboardingStatus == CanBeOnboarded

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.