Antivirus detections

Description

Query for Microsoft Defender Antivirus detections. Query #1: Query for Antivirus detection events.

Query · kql

DeviceEvents
| where ActionType == "AntivirusDetection"
| extend ParsedFields=parse_json(AdditionalFields)
| project ThreatName=tostring(ParsedFields.ThreatName),
          WasRemediated=tobool(ParsedFields.WasRemediated),
          WasExecutingWhileDetected=tobool(ParsedFields.WasExecutingWhileDetected),
          FileName, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine,
          DeviceName, Timestamp
| limit 100
Raw source Antivirus detections · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: aa9ad4ae-a19a-4262-b151-8a723227bc4e
name: Antivirus detections
description: |
  Query for Microsoft Defender Antivirus detections.
  Query #1: Query for Antivirus detection events.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
query: |
  DeviceEvents
  | where ActionType == "AntivirusDetection"
  | extend ParsedFields=parse_json(AdditionalFields)
  | project ThreatName=tostring(ParsedFields.ThreatName),
            WasRemediated=tobool(ParsedFields.WasRemediated),
            WasExecutingWhileDetected=tobool(ParsedFields.WasExecutingWhileDetected),
            FileName, SHA1, InitiatingProcessFileName, InitiatingProcessCommandLine,
            DeviceName, Timestamp
  | limit 100

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.