Hunt Devices Supporting MDE Containment
This hunting query identifies devices enrolled in Microsoft Defender for Endpoint that support device containment. It determines support by analyzing the client version and estimating when that version became available. The query specifically looks at Windows devices and categorizes them based on their client version's support for containment (with or without AH Audit) or if containment is unsupported. Non-Windows devices are always classified as unsupported for containment.
Microsoft Sentinel (KQL)
