deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-28 13:17:23 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Updating example queries layout

Browse Source
This commit is contained in:
valemieux 2022-02-17 17:33:21 -08:00
parent f5cf7fa36e
commit 424fdec1e8
1 changed files with 2 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md
View File

@ -53,6 +53,8 @@ This capability is supported beginning with Windows version 1607.
Learn more about the [Understanding Application Control event IDs (Windows)](event-id-explanations.md)
## Example Advanced Hunting Application Control Queries ##
Query Example 1: Query the application control action types summarized by type for past seven days
Here's a simple example query that shows all the WDAC events generated in the last seven days from machines being monitored by Microsoft Defender for Endpoint:
@ -71,16 +73,6 @@ The query results can be used for several important functions related to managin
- Monitoring blocks from policies in enforced mode
Policies deployed in enforced mode may block executables or scripts that fail to meet any of the included allow rules. Legitimate new applications and updates or potentially unwanted or malicious software could be blocked. In either case, the Advanced hunting queries report the blocks for further investigation.
## Example Advanced Hunting Application Control Queries ##
Query Example 1: Query the application control action types summarized by type for past seven days
```
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType startswith "AppControl"
| summarize Count = count() by ActionType
| order by Count desc
```
Query Example #2: Query to determine audit blocks in the past seven days