Defender ASR log hunting

When enabling ASR rules in Defender for Endpoint it is a good idea to start with audit mode. Microsofts documentation gives a short example on how you can use the Defender portal to search for events generated by your rules.

Here are some more examples to get you started

Show all events for the last 30 days:

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| summarize EventCount=count() by ActionType

And if we want to limit that to only audit events:

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| where ActionType  endswith "Audited"
| summarize EventCount=count() by ActionType

To view events for a specific rule:

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "AsrOfficeCommAppChildProcessAudited"

And to get a list of all filenames that triggered the event:

DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "AsrOfficeCommAppChildProcessAudited"
| summarize EventCount=count() by FileName