Machine Onboarded Azure Arc

Description

Lists the onboarded machines to Azure Arc. The HostName is the hostname that is used within Azure and Defender For Endpoint, this may differ from the actual hostname of the local system.

Query · kql

AzureActivity
| where OperationNameValue =~ "MICROSOFT.HYBRIDCOMPUTE/MACHINES/WRITE"
| where ActivityStatusValue =~ "Success"
| extend HostName = tostring(parse_json(Properties).resource)
| project-reorder TimeGenerated, Caller, HostName, ResourceGroup
Raw source Machine Onboarded Azure Arc · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Machine Onboarded Azure Arc

## Query Information

#### Description
Lists the onboarded machines to Azure Arc. The HostName is the hostname that is used within Azure and Defender For Endpoint, this may differ from the actual hostname of the local system.

## Sentinel
```KQL
AzureActivity
| where OperationNameValue =~ "MICROSOFT.HYBRIDCOMPUTE/MACHINES/WRITE"
| where ActivityStatusValue =~ "Success"
| extend HostName = tostring(parse_json(Properties).resource)
| project-reorder TimeGenerated, Caller, HostName, ResourceGroup
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.