Device Count by DNS Suffix

Description

This query will count the number of devices in Defender ATP based on their DNS suffix. For a full list of devices with the DNS suffix, comment out or remove the last line.

Query · kql

DeviceInfo
| where isnotempty(OSPlatform)
| summarize arg_max(Timestamp, DeviceName) by DeviceId
| extend DeviceMachineName = split(DeviceName, '.')[0]
| extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)
| summarize count() by DeviceDomain
Raw source Device Count by DNS Suffix · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: fcd06834-86f9-43ce-817a-b5104ef279e0
name: Device Count by DNS Suffix
description: |
  This query will count the number of devices in Defender ATP based
  on their DNS suffix.  For a full list of devices with the DNS
  suffix, comment out or remove the last line.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceInfo
query: |
  DeviceInfo
  | where isnotempty(OSPlatform)
  | summarize arg_max(Timestamp, DeviceName) by DeviceId
  | extend DeviceMachineName = split(DeviceName, '.')[0]
  | extend DeviceDomain = substring(DeviceName, strlen(DeviceMachineName) + 1, strlen(DeviceName) - strlen(DeviceMachineName) - 1)
  | summarize count() by DeviceDomain

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.