You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint
You enable Network device discovery.
You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device.
Correct Answer:
D
In Microsoft Defender for Endpoint advanced hunting, when Network device discovery is enabled, onboarded devices can detect other devices on the same network. To build a hunting query that identifies discovered network devices and shows which onboarded device discovered each, you use the SeenBy() built-in function.
Microsoft's official Defender XDR KQL function documentation explains:
''The SeenBy() function returns the list of devices that have observed the entity (for example, IP address, URL, or network device). This function is typically used to correlate discovered devices with the onboarded devices that detected them.''
For example, you can write:
DeviceNetworkInfo
| where NetworkDeviceRole == 'Discovered'
| extend DiscoveringDevice = SeenBy()
This function effectively maps the discovered asset to the detecting (onboarded) device.
Other options are not applicable:
current_cluster,endpoint() --- not a valid Defender hunting function.
DeviceFromIP() --- resolves IP addresses to onboarded devices but does not show which device discovered another.
next() --- a general KQL operator for sequencing data, not for correlating network discovery events.
Therefore, to identify discovered network devices and the discovering endpoints, the correct built-in function is SeenBy().
