NotOnboarded Devices by DeviceName Suffix

Description

This query searches for not onboarded devices with a specific Suffix

Query · kql

//
let Onboarded = "Onboarded";
let DeviceNameSuffix = "-pc";
DeviceInfo
| summarize arg_max(Timestamp, *) by DeviceId
| where OnboardingStatus != "Onboarded"
| where DeviceName endswith DeviceNameSuffix
Raw source NotOnboarded Devices by DeviceName Suffix · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: bfb4c0e1-aa4b-45c4-9035-75c9ae63ce21
name: NotOnboarded Devices by DeviceName Suffix
description: |
  This query searches for not onboarded devices with a specific Suffix
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceInfo
tactics: []
relevantTechniques: []
query: |
  //
  let Onboarded = "Onboarded";
  let DeviceNameSuffix = "-pc";
  DeviceInfo
  | summarize arg_max(Timestamp, *) by DeviceId
  | where OnboardingStatus != "Onboarded"
  | where DeviceName endswith DeviceNameSuffix

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.