The "QuickAction - Query Device Timeline on MS Defender for Endpoint" workflow template empowers security analysts to efficiently investigate device timeline events across eight Microsoft 365 Defender Advanced Hunting tables. By providing a search term, timeframe, device, and selecting tables to query, analysts can generate a comprehensive HTML timeline report. This tool is essential for identifying suspicious user activity and conducting thorough threat hunting, enhancing incident response capabilities.
Use Cases
Suspicious User Activity , Threat Hunting
Workflow Breakdown
Interact Trigger: search term, timeframe, device selection and table selection.
Date calculation: JQ converts preset/custom timeframe to start/end datetimes.
Device resolution: reads Sensor ID from case custom fields; falls back to manual input.
Table queries: runs KQL against each selected table.
Report generation: Merges all results, sorts by Timestamp, builds HTML report.
Vendors
Scripting, Utils, Microsoft 365, Torq Cases
Workflow Output
HTML report to be used in an Interact Operator or download it to a file for further reference,