license

Microsoft Defender for Endpoint P2

Microsoft Defender for Endpoint Plan 2 provides the full Defender for Endpoint capability set, including advanced hunting over endpoint telemetry.

licensesMDE P2Current

Relationships

Microsoft Defender for Endpoint
Licensed productproduct Attack Surface Reduction
Included capabilitycapability Endpoint Detection and Response
Included capabilitycapability Automated Investigation and Response
Included capabilitycapability Advanced Hunting
Included capabilitycapability Microsoft Defender Unified RBAC
Included capabilitycapability Threat and Vulnerability Management
Included capabilitycapability

Related KQL

Detect file modification bursts by process

Summarize high-volume file create/modify activity by device, account, and initiating process as a ransomware-style triage signal.

detection candidate

advancedendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceFileEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let minimumEvents = {minimum_events};
DeviceFileEvents
| where Timestamp > ago(lookback)
| where ActionType has_any ("FileCreated", "FileModified", "FileRenamed")
| summarize FileEvents=count(), Extensions=make_set(tolower(extract(@"\.([^.\\]+)$", 1, FolderPath)), 20), FirstSeen=min(Timestamp), LastSeen=max(Timestamp) by DeviceName, InitiatingProcessAccountUpn, InitiatingProcessFileName, InitiatingProcessCommandLine
| where FileEvents >= minimumEvents
| order by FileEvents desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from ransomware TTP themes into a generic file-burst query for modeled MDE tables.

Join active threat indicators to endpoint network events

Use active IP indicators from Sentinel threat intelligence to find matching endpoint network connections.

template

advancedthreat-intelligenceendpoint

Run surface: Sentinel Logs
Required tables: ThreatIntelIndicators DeviceNetworkEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let activeIndicators = ThreatIntelIndicators
| where TimeGenerated > ago(30d)
| where Active == true
| where isnotempty(NetworkIP)
| summarize arg_max(TimeGenerated, *) by NetworkIP
| project IndicatorIP=NetworkIP, ThreatType, ConfidenceScore, Description, IndicatorSource=SourceSystem;
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where isnotempty(RemoteIP)
| join kind=inner activeIndicators on $left.RemoteIP == $right.IndicatorIP
| project Timestamp, DeviceName, InitiatingProcessAccountUpn, RemoteIP, RemoteUrl, InitiatingProcessFileName, ThreatType, ConfidenceScore, IndicatorSource, Description
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 3: Advanced KQL/Query Samples. Adapted from join and threat-intelligence pivot patterns for modeled Sentinel and MDE tables.

Review Intune policy changes by operator

Summarize Intune audit activity by operation, identity, and result to spot policy edits, assignment changes, and deletions.

template

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneAuditLogs
License context: Microsoft Defender for Endpoint P2

kql

IntuneAuditLogs
| where TimeGenerated > ago({lookback})
| where OperationName has_any ("Create", "Update", "Delete", "Assign")
| summarize Events=count(), Failures=countif(ResultType !in ("Success", "Succeeded")), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by OperationName, Identity, ResultType
| order by LastSeen desc

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from Intune operational diagnostics themes for existing IntuneAuditLogs coverage.

Review suspicious PowerShell process launches

Find PowerShell process executions with common download, encoded-command, hidden-window, or bypass indicators.

detection candidate

intermediateendpointransomware

Run surface: Defender XDR Advanced Hunting, Sentinel Logs
Required tables: DeviceProcessEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let suspiciousTerms = dynamic(["-enc", "encodedcommand", "downloadstring", "invoke-webrequest", "iex", "-w hidden", "bypass"]);
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any (suspiciousTerms)
| project Timestamp, DeviceName, AccountUpn=InitiatingProcessAccountUpn, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 5: KQL for Cyber Security/Query Samples. Adapted from endpoint and ransomware hunting themes with common PowerShell indicators.

Trend Intune operational failures

Chart Intune operational failures by operation and category to troubleshoot device-management service issues.

workbook dashboard

beginnerintuneoperational-excellence

Run surface: Sentinel Logs, Azure Monitor Logs
Required tables: IntuneOperationalLogs
License context: Microsoft Defender for Endpoint P2

kql

IntuneOperationalLogs
| where TimeGenerated > ago({lookback})
| summarize Events=count(), Failures=countif(Result !in ("Success", "Succeeded")) by bin(TimeGenerated, 1h), OperationName, Category
| where Failures > 0
| order by TimeGenerated desc

Source: KQLMSPress/definitive-guide-kql Chapter 4: Operational Excellence/Query Samples. Adapted from operational excellence and Intune diagnostic query themes.