Find Isolated Devices list
This query retrieves the most recent record for each device and filters the results to show devices that are currently isolated. • The DeviceInfo table contains details about each device and its status over time. • The summarize arg_max(Timestamp, *) by DeviceName part selects the latest entry (based on Timestamp) for every device. • The where MitigationStatus contains "Isolated" filter ensures that only devices with an isolation-related mitigation status are displayed.
Microsoft Sentinel (KQL)
