Microsoft Defender AV mode device count

Description

'Provides the Anti virus mode and device count falling under that AV mode.'

Query · kql

DeviceTvmInfoGathering
| extend AvMode = iif(tostring(AdditionalFields.AvMode) == '0', 'Active', iif(tostring(AdditionalFields.AvMode) == '1', 'Passive',iif(tostring(AdditionalFields.AvMode) == '2', 'Disabled', iif(tostring(AdditionalFields.AvMode) == '5', 'PassiveAudit',iif(tostring(AdditionalFields.AvMode) == '4', 'EDR Blocked' ,'Unknown')))))  
| summarize DeviceCount = count() by AvMode
Raw source Microsoft Defender AV mode device count · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 9FDDF2F5-88AC-4186-BA48-7A4187A4F755
name: Microsoft Defender AV mode device count
description: |
  'Provides the Anti virus mode and device count falling under that AV mode.'
requiredDataConnectors: []
tactics: []
relevantTechniques: []
query: |
    DeviceTvmInfoGathering
    | extend AvMode = iif(tostring(AdditionalFields.AvMode) == '0', 'Active', iif(tostring(AdditionalFields.AvMode) == '1', 'Passive',iif(tostring(AdditionalFields.AvMode) == '2', 'Disabled', iif(tostring(AdditionalFields.AvMode) == '5', 'PassiveAudit',iif(tostring(AdditionalFields.AvMode) == '4', 'EDR Blocked' ,'Unknown')))))  
    | summarize DeviceCount = count() by AvMode

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.