All Detections

MDE_Evidenceforasingledevice

Azure Sentinel@AzureSentinel
updated Jun 9, 20251013

Find all alert evidence for a single endpoint. This is handy for exporting to a third-party SIEM.

Microsoft Sentinel (KQL)