Hunt devices supporting MDE Containment

Group by: Containment
Author: Robbe Van den Daele
Source: github.com/HybridBrothers/Hunting-Queries-Detection-Rules

This hunting query can help you finding which Defender for Endpoint enrolled devices support device containment. This is being done by looking at the client version and estimated time the version was available.

References

Telemetry coverage

Platform	Record / event type
Microsoft Defender for Endpoint	`DeviceInfo` action `any`: Device information

Rule body

// Paste your query here
// Gets the onboarded windows devices and checks containment support nuances
let onboardedWindows = DeviceInfo
| where OnboardingStatus == "Onboarded" and OSPlatform contains "Windows"
| distinct DeviceId, DeviceName, ClientVersion, OSPlatform
| parse ClientVersion with Major:int "." Minor:int "." Build:int "." Revision:int
// Reference: https://learn.microsoft.com/en-us/defender-endpoint/windows-whatsnew
| extend Date = case(
    Minor >= 8760, "July-2024", 
    Minor >= 8750, "May-2024",
    Minor >= 8735, "Feb-2024",
    Minor >= 8672, "Dec-2023",
    Minor >= 8560, "Sept-2023",
    Minor > 8295, "May-2023",
    Minor == 8295 and Revision >= 1023, "May-2023",
    Minor == 8295 and Revision between (1019 .. 1023), "Jan/Feb-2023",
    Minor > 8210, "Dec-2022", 
    Minor == 8210 and Build >= 22621 and Revision >= 1016, "Dec-2022", 
    Minor == 8210 and not(Build >= 22621 and Revision >= 1016), "Aug-2022", 
    "< Aug-2022"
)
// Containment without AH Audit supported from Nov-2022
// Containment with AH Audit supported from Mar-2023
| extend Containment = case(
    Minor >= 8295, "Supported with AH Audit",
    (Minor == 8210 and Build >= 22621 and Revision >= 1016) or Minor > 8210, "Supported without AH Audit",
    "Unsupported"
);
// Gets onboarded non-windows devices, since containment is not supported here
let onboardedNonWindows = DeviceInfo
| where OnboardingStatus == "Onboarded" and OSPlatform !contains "Windows"
| distinct DeviceId, DeviceName, ClientVersion, OSPlatform
| extend Containment = "Unsupported";
// Get not-onboarded Servers
let notOnboardedServers = DeviceInfo
| where OnboardingStatus != "Onboarded" and DeviceType == "Server"
| distinct DeviceId, DeviceName, ClientVersion, OSPlatform
| extend Containment = "Unsupported";
// Union all and show diagram
union onboardedNonWindows, onboardedWindows, notOnboardedServers
| summarize count() by Containment
| render piechart

Stages and Predicates

Stage 0: `let`

let onboardedWindows = DeviceInfo <inlined as stages below>;
let onboardedNonWindows = DeviceInfo <inlined as stages below>;
let notOnboardedServers = DeviceInfo <inlined as stages below>;

Stage 1: `source`

let onboardedWindows

Stage 2: `source`

let onboardedNonWindows

Stage 3: `source`

let notOnboardedServers

Stage 4: `union`

union of 3 branches

Stage 5: `source`

DeviceInfo

Stage 6: `where`

where not (OSPlatform contains "Windows") and OnboardingStatus =~ "Onboarded"

Stage 7: `distinct`

distinct ClientVersion, DeviceId, DeviceName, OSPlatform

Stage 8: `extend`

extend Containment

Stage 9: `source`

DeviceInfo

Stage 10: `where`

where OSPlatform contains "Windows" and OnboardingStatus =~ "Onboarded"

Stage 11: `distinct`

distinct ClientVersion, DeviceId, DeviceName, OSPlatform

Stage 12: `parse`

parse

Stage 13: `extend`

extend Date

Date =

ifMinor >= 8760"July-2024"

elifMinor >= 8750"May-2024"

elifMinor >= 8735"Feb-2024"

elifMinor >= 8672"Dec-2023"

elifMinor >= 8560"Sept-2023"

elifMinor > 8295"May-2023"

elifMinor == 8295 and Revision >= 1023"May-2023"

elifMinor == 8295 and (Revision >= 1019 and Revision <= 1023)"Jan/Feb-2023"

elifMinor > 8210"Dec-2022"

elif(Minor == 8210 and Build >= 22621) and Revision >= 1016"Dec-2022"

elifMinor == 8210 and not ((Build >= 22621 and Revision >= 1016))"Aug-2022"

else"< Aug-2022"

Stage 14: `extend`

extend Containment

Containment =

ifMinor >= 8295"Supported with AH Audit"

elif(((Minor == 8210 and Build >= 22621) and Revision >= 1016) or Minor > 8210)"Supported without AH Audit"

else"Unsupported"

Stage 15: `source`

DeviceInfo

Stage 16: `where`

where DeviceType =~ "Server" and OnboardingStatus !~ "Onboarded"

Stage 17: `distinct`

distinct ClientVersion, DeviceId, DeviceName, OSPlatform

Stage 18: `extend`

extend Containment

Stage 19: `summarize`

summarize by Containment

Stage 20: `render`

render

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DeviceType`	eq	`Server`	`field:"DeviceType" kind:eq value:"Server"`
`OSPlatform`	contains	`Windows`	`field:"OSPlatform" kind:contains value:"Windows"`
`OnboardingStatus`	eq	`Onboarded`	`field:"OnboardingStatus" kind:eq value:"Onboarded"`
`OnboardingStatus`	ne	`Onboarded`	`field:"OnboardingStatus" kind:ne value:"Onboarded"`

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`OSPlatform`	contains	`Windows`	`excludes:OSPlatform` `field:"OSPlatform" value:"Windows"`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Containment`	`summarize`

Hunt devices supporting MDE Containment

References

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: let

Stage 1: source

Stage 2: source

Stage 3: source

Stage 4: union

Stage 5: source

Stage 6: where

Stage 7: distinct

Stage 8: extend

Stage 9: source

Stage 10: where

Stage 11: distinct

Stage 12: parse

Stage 13: extend

Stage 14: extend

Stage 15: source

Stage 16: where

Stage 17: distinct

Stage 18: extend

Stage 19: summarize

Stage 20: render