ExploitGuardAsrDescriptions

Expanding on DeviceEvents output with Attack Surface Reduction (ASR) rule descriptions. The ActionType values of the ASR events already explain what rule was matched and if it was audited or blocked. However, it could still be useful to have a more human-friendly description in the results. Also, this query is a good example for how you could define your own lookup tables and join with them. The events in the DeviceEvents table contain a GUID for the various ASR rules rather than a full description of the rule. This query will create a table which has the description for each ASR rule as per https://docs.microsoft.com/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction. This table is then joined to the output of a query against the DeviceEvents table and shows a summary count of the events by the newly defined description. This query shows the ability to use joins and custom dimension tables. See https://docs.loganalytics.io/docs/Language-Reference/Tabular-operators/join-operator for more information on the join syntax. For more questions on this query, feel free to ping @FlyingBlueMonki on twitter or mattegen@microsoft.com via email. First lets start by creating a table of the rule descriptions to rule guids.