Review and assess devices in Microsoft Defender for Endpoint

Device discovery allows you to improve your visibility into unmanaged devices, assess their security posture, and take appropriate actions to secure them.

This article describes how to review and assess devices discovered by device discovery in Microsoft Defender for Endpoint. You also learn how to get data on devices that aren't onboarded to Microsoft Defender for Endpoint, and how to query data on discovered devices.

Prerequisites

Before you can review and assess discovered devices, make sure the following requirements are met:

• Your organization has a Microsoft Defender for Endpoint Plan 2 license.
• You have at least one device onboarded to Defender for Endpoint. Onboarded devices act as network sensors and data sources for discovering non-onboarded devices.
• You have access to the Microsoft Defender portal with appropriate permissions to view the device inventory and run advanced hunting queries.

Supported operating systems

Device discovery supports the following operating systems:

• Windows 10 and later
• Windows Server 2019 and later.

Monitor non-onboarded devices in the device inventory

You can review the device inventory for discovered devices that aren't onboarded to Defender for Endpoint.

To assess these devices, navigate to the device inventory, and use the Onboarding status filter, with one of the following values:

Onboard unmanaged devices

You can onboard unmanaged devices manually. Unmanaged endpoints in your network introduce vulnerabilities and risks to your network. Onboarding them to the service can increase the security visibility on them.

Use advanced hunting on discovered devices

You can use advanced hunting queries to gain visibility on discovered devices. Find details about discovered devices in the DeviceInfo table, or network-related information about those devices, in the DeviceNetworkInfo table.

Explore devices in the network

Use the following advanced hunting query to identify onboarded devices connected to a specific network. The query retrieves devices with connected network data from the last seven days, filtered by network name from the networks list in the device discovery settings.

DeviceNetworkInfo
| where Timestamp > ago(7d)
| where ConnectedNetworks  != ""
| extend ConnectedNetworksExp = parse_json(ConnectedNetworks)
| mv-expand bagexpansion = array ConnectedNetworks=ConnectedNetworksExp
| extend NetworkName = tostring(ConnectedNetworks ["Name"]), Description = tostring(ConnectedNetworks ["Description"]), NetworkCategory = tostring(ConnectedNetworks ["Category"])
| where NetworkName == "<your network name here>"
| summarize arg_max(Timestamp, *) by DeviceId

Get device information

You can use the following advanced hunting query to get the latest complete information on a specific device.

DeviceInfo
| where DeviceName == "<device name here>" and isnotempty(OSPlatform)
| summarize arg_max(Timestamp, *) by DeviceId

Query details for discovered devices

The following query retrieves the latest known record for each discovered device that isn't onboarded, excluding invalidated or merged entries. Use it to identify unmanaged devices and review their most up-to-date details:

DeviceInfo
| summarize arg_max(Timestamp, *) by DeviceId  // Get latest known good per device Id
| where isempty(MergedToDeviceId) // Remove invalidated/merged devices
| where OnboardingStatus != "Onboarded"

By invoking the SeenBy function, in your advanced hunting query, you can get detail on which onboarded device a discovered device was seen by. This information can help determine the network location of each discovered device and subsequently, help to identify it in the network.

The following query retrieves the latest record for each non-onboarded device, excludes merged entries, and invokes the SeenBy function to show which onboarded device discovered it:

DeviceInfo
| where OnboardingStatus != "Onboarded"
| summarize arg_max(Timestamp, *) by DeviceId 
| where isempty(MergedToDeviceId) 
| limit 100
| invoke SeenBy()
| project DeviceId, DeviceName, DeviceType, SeenBy

For more information, see the SeenBy() function.

Query network related information

Device discovery leverages Defender for Endpoint onboarded devices as a network data source to attribute activities to non-onboarded devices. The network sensor on the Defender for Endpoint onboarded device identifies two new connection types:

• ConnectionAttempt - An attempt to establish a TCP connection (syn)
• ConnectionAcknowledged - An acknowledgment that a TCP connection was accepted (syn\ack)

These connection types mean that when a non-onboarded device attempts to communicate with an onboarded Defender for Endpoint device, the attempt generates a DeviceNetworkEvent and the non-onboarded device activities can be seen on the onboarded device timeline, and through the Advanced hunting DeviceNetworkEvents table.

The following query returns the 10 most recent connection attempts and acknowledged connections, so you can verify which non-onboarded devices are communicating with onboarded endpoints:

DeviceNetworkEvents
| where ActionType == "ConnectionAcknowledged" or ActionType == "ConnectionAttempt"
| take 10

Assess vulnerabilities on discovered devices

Microsoft Defender Vulnerability Management finds risks on your devices. It also checks unmanaged devices in the network.

To review vulnerabilities, go to Exposure management > Recommendations in the Defender portal.

For example, search for SSH to find SSH vulnerabilities on unmanaged and managed devices.

To learn more, see Microsoft Defender Vulnerability Management.