Hi,

I’m creating a detection rule to search for servers which are not onboarded to Defender. What’s strange about this query is that I get the same device (same devicename but different deviceid) with both Onboarding status, which is “Onboarded” and “Can be onboarded”.

Anyone knows why? This way I get uncorrect results on my detection rule.

Thanks

​Hi,I’m creating a detection rule to search for servers which are not onboarded to Defender. What’s strange about this query is that I get the same device (same devicename but different deviceid) with both Onboarding status, which is “Onboarded” and “Can be onboarded”.Anyone knows why? This way I get uncorrect results on my detection rule.Thanks   Read More

​