Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
Expanding on DeviceEvents output with Attack Surface Reduction (ASR) rule descriptions. The ActionType values of the ASR events already explain what rule was matched and if it was audited or blocked. However, it could still be useful to have a more human-friendly description in the results. Also, this query is a good example for how you could define your own lookup tables and join with them. The events in the DeviceEvents table contain a GUID for the various ASR rules rather than a full descript
| Attribute | Value |
|---|---|
| Type | Hunting Query |
| Solution | GitHub Only |
| ID | 8ab60d62-b4a3-431b-8cd9-9a080213afc0 |
| Required Connectors | MicrosoftThreatProtection |
| Source | View on GitHub |
This content item queries data from the following tables:
| Table | Selection Criteria | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|---|
DeviceEvents |
ActionType startswith "Asr" |
✓ | ✗ | ? |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊