Hunt devices supporting MDE Containment

Group by: Containment
Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This hunting query can help you finding which Defender for Endpoint enrolled devices support device containment. This is being done by looking at the client version and estimated time the version was available.

References

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceInfo` action `any`: Device information

Rule body

// Paste your query here
// Gets the onboarded windows devices and checks containment support nuances
let onboardedWindows = DeviceInfo
| where OnboardingStatus == "Onboarded" and OSPlatform contains "Windows"
| distinct DeviceId, DeviceName, ClientVersion, OSPlatform
| parse ClientVersion with Major:int "." Minor:int "." Build:int "." Revision:int
// Reference: https://learn.microsoft.com/en-us/defender-endpoint/windows-whatsnew
| extend Date = case(
    Minor >= 8760, "July-2024", 
    Minor >= 8750, "May-2024",
    Minor >= 8735, "Feb-2024",
    Minor >= 8672, "Dec-2023",
    Minor >= 8560, "Sept-2023",
    Minor > 8295, "May-2023",
    Minor == 8295 and Revision >= 1023, "May-2023",
    Minor == 8295 and Revision between (1019 .. 1023), "Jan/Feb-2023",
    Minor > 8210, "Dec-2022", 
    Minor == 8210 and Build >= 22621 and Revision >= 1016, "Dec-2022", 
    Minor == 8210 and not(Build >= 22621 and Revision >= 1016), "Aug-2022", 
    "< Aug-2022"
)
// Containment without AH Audit supported from Nov-2022
// Containment with AH Audit supported from Mar-2023
| extend Containment = case(
    Minor >= 8295, "Supported with AH Audit",
    (Minor == 8210 and Build >= 22621 and Revision >= 1016) or Minor > 8210, "Supported without AH Audit",
    "Unsupported"
);
// Gets onboarded non-windows devices, since containment is not supported here
let onboardedNonWindows = DeviceInfo
| where OnboardingStatus == "Onboarded" and OSPlatform !contains "Windows"
| distinct DeviceId, DeviceName, ClientVersion, OSPlatform
| extend Containment = "Unsupported";
// Get not-onboarded Servers
let notOnboardedServers = DeviceInfo
| where OnboardingStatus != "Onboarded" and DeviceType == "Server"
| distinct DeviceId, DeviceName, ClientVersion, OSPlatform
| extend Containment = "Unsupported";
// Union all and show diagram
union onboardedNonWindows, onboardedWindows, notOnboardedServers
| summarize count() by Containment
| render piechart

Stages and Predicates

union (3 sources)

Each leg below queries one source; the rule matches if any leg does. Sources: onboardedNonWindows, onboardedWindows, notOnboardedServers

Leg 1: `onboardedNonWindows`

Leg 2: `onboardedWindows`

Leg 3: `notOnboardedServers`

Applied to the combined result

| summarize count() by Containment | render piechart

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`OSPlatform`	contains	`Windows`	`excludes:OSPlatform` `field:"OSPlatform" value:"Windows"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DeviceType`	eq	`Server`	`field:"DeviceType" kind:eq value:"Server"`
`OSPlatform`	contains	`Windows`	`field:"OSPlatform" kind:contains value:"Windows"`
`OnboardingStatus`	eq	`Onboarded`	`field:"OnboardingStatus" kind:eq value:"Onboarded"`
`OnboardingStatus`	ne	`Onboarded`	`field:"OnboardingStatus" kind:ne value:"Onboarded"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Containment`	`summarize`