Microsoft Defender for Endpoint

Nuances and common questions when using Microsoft Defender for Endpoint

Contents

• Contents
• How are queries built?
• Is there a rate limit?

How are queries built?

Surveyor builds queries to fit the format

<INSERT_YOUR_QUERY_PARAMETERS>
| <INSERT_FILTERS>
| project DeviceName, AccountName, ProcessCommandLine, FolderPath, Timestamp

So when using the --query parameter or the query field in a definition file, you need to format your query to fill in the <INSERT_YOUR_PARAMETERS> section.

That is followed by the <INSERT_FILTERS> section which is populated if you use the --hostname, --username, or time filter parameters.

Is there a rate limit?

Yes, Microsoft outlines the limits here: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/run-advanced-query-api?view=o365-worldwide#limitations