Small Defender Data

Ln 1, Col 1 0 / 4000 chars

Results

Write a KQL query and press Shift+Enter to run.

Tip: use | take 100 to limit results for faster queries.

Dataset

In this dataset, I ran AtomicRedTeam to perform some attacks.

Microsoft Defender XDR

Tables 6

DeviceFileEvents Rows: ~16

Loading columns...

DeviceImageLoadEvents Rows: ~4

Loading columns...

DeviceInfo Rows: ~5

Loading columns...

DeviceNetworkEvents Rows: ~221

Loading columns...

DeviceNetworkInfo Rows: ~25

Loading columns...

DeviceProcessEvents Rows: ~75

Loading columns...