Defender for Endpoint Day 4: advanced hunting, and fixing portal and TVM problems

My Day 4 notes on Defender for Endpoint, rewritten as a "what breaks, why, how to fix" guide and checked against Microsoft Learn (October 2026).
Day 3 covered the device timeline, inventory and vulnerability management (MDE Day 3: device timeline and TVM). Day 4 is the day those pages stop behaving.

The classic Day 4 moment: you copy a hunting query from the docs, press Run query, and get zero rows. Ten minutes later someone asks why the server you excluded yesterday is still on the vulnerability report. Neither one is a bug. One is a column that doesn't exist, the other is a clock that hasn't caught up.

All screenshots come from my own lab tenant. Device names and URLs are blacked out or cropped.

TL;DR

• Before you fix anything, find the layer: browser, access, license, time, or the query itself.
• Vulnerability management has slow clocks: exclusions take up to 10 hours, an add-on trial up to 6 hours.
• Advanced hunting gives you 30 days of data, in UTC. Most "zero rows" problems are a wrong table or column, not missing data.

Table of contents

• 1. Portal errors: if you see X, check Y
• 2. Capture the problem before you fix it
• 3. Vulnerability management problems
• 4. Advanced hunting: what breaks
• 5. Four queries that actually run
• 6. From query to custom detection and actions
• Gotchas
• Day 4 checklist
• Sources

1. Portal errors: if you see X, check Y

The Microsoft Defender portal (security.microsoft.com) has a short list of errors that cover most "the portal is broken" moments:

In my lab every blank tile was one of the last two rows. Try a clean browser profile before you rewrite roles.

Source: Troubleshoot onboarding issues and error messages

2. Capture the problem before you fix it

My original note says "PSR + HAR": record the steps, record the network. Both ideas still hold, but one tool changed.

• Steps Recorder (psr.exe) is deprecated. Microsoft stopped updating it (announced November 2023) and will remove it in a future Windows release. Use Snipping Tool, Xbox Game Bar or Clipchamp to record the screen instead.
• A HAR file shows which request failed and with what status code. In Edge or Chrome:
  1. Sign in to the portal first, so the trace has less account data in it.
  2. Go to the page just before the problem. Press F12, open Network, tick Preserve log.
  3. Clear the log, start recording, reproduce the problem, stop recording.
  4. Export HAR (sanitized). Also save the Console output as text.

Warning: browser traces can contain authentication tokens. Don't post a HAR file in a forum or a chat. Share it only with someone who needs it, and use the sanitized export.

Sources: Capture a browser trace for troubleshooting · Deprecated features for Windows client

3. Vulnerability management problems

Microsoft Defender Vulnerability Management (the "TVM" in my notes) fails in four predictable ways.

3.1 Pages are empty or "access denied"

Empty Vulnerability management pages while alerts work fine? Check the role. In the classic Defender for Endpoint roles, vulnerability data is its own View data checkbox, and fixing things needs separate Exception, Remediation and Application handling permissions.

With unified RBAC it's the same idea: Read to view software, weaknesses, missing KBs and baselines; Manage to handle remediation and exceptions. New tenants since February 16, 2025 only get unified RBAC.

Sources: Assign user access (MDE roles) · Defender Vulnerability Management prerequisites

3.2 Security baselines, browser extensions or certificates are missing

These are premium features. Defender for Endpoint Plan 2 includes the core (vulnerability and configuration assessment, software inventory, remediation tracking). Security baselines, blocking vulnerable apps, browser extensions, certificates, network shares and firmware need the add-on (or the standalone product).

If you just started the add-on trial: it runs 90 days, needs a Global Administrator to start, and features can take up to six hours to show. The product also appears in the Microsoft 365 admin center, and it's licensed per user, so assign it.

In my lab the trial arrived with 1,000,000 available licenses and 0 assigned. Looks generous, does nothing until you assign it.

Sources: Compare Defender Vulnerability Management plans · Get Defender Vulnerability Management

3.3 The tenant is really on Defender for Business

Defender for Business (part of Microsoft 365 Business Premium, up to 300 users) has its own experience. Two facts my notes collected that explain a lot:

• Mixed licensing doesn't mix. A tenant with Defender for Business plus some Defender for Endpoint Plan 2 users defaults to the Defender for Business experience for everyone.
• Defender Vulnerability Management isn't currently offered with Defender for Business, and its capability list doesn't include threat hunting.

So on a small tenant with no hunting menu, check the plan first.

Sources: Defender for Business FAQ · Compare Defender Vulnerability Management plans

3.4 "I excluded that device. Why is it still there?"

Excluding a device (device page, ... menu, Exclude) removes it from vulnerability pages, reports, exposure score and Secure Score. It stays in the device inventory, marked as excluded. The portal even tells you it isn't instant (screenshots in Day 3):

• Up to 10 hours to be fully excluded. Stopping an exclusion takes up to 8 hours.
• To list them: Device inventory > Filter > Exclusion state.
• Offboarded devices are different: they turn Inactive within 7 days, their data stays visible for the retention period (usually 180 days), and devices inactive for 30 days drop out of the exposure score.

Sources: Manage device scope with tags and exclusions · Offboard a device from Defender for Business

4. Advanced hunting: what breaks

Advanced hunting is KQL over your Defender data, in guided mode (query builder) or advanced mode (raw KQL). The fastest way in is the Go hunt action on a device or entity, which writes the query for you:

What trips people up:

Also: KQL is case-sensitive for table and column names. deviceinfo is not a table.

Sources: Advanced hunting overview · Handle advanced hunting errors · KQL overview · Go hunt

5. Four queries that actually run

Query 1: PowerShell download activity (the note's query, fixed)

My note had union DeviceProcessEvents, DeviceNetworkEvents | where FileName in~ (...). It runs, but DeviceNetworkEvents has no FileName or ProcessCommandLine columns, so the network half never matches. Split it:

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("powershell.exe", "powershell_ise.exe")
| where ProcessCommandLine has_any ("DownloadFile", "DownloadString", "http", "https")
| project Timestamp, DeviceId, DeviceName, ReportId, InitiatingProcessFileName, ProcessCommandLine
| top 100 by Timestamp

For the network side, use the initiating process columns:

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFileName in~ ("powershell.exe", "powershell_ise.exe")
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| top 100 by Timestamp

Query 2: device health and exclusion state in one view

When the portal and your gut disagree:

DeviceInfo
| where Timestamp > ago(1d)
| summarize arg_max(Timestamp, *) by DeviceId
| project DeviceName, OSPlatform, OnboardingStatus, SensorHealthState, IsExcluded, ExclusionReason, ExposureLevel

DeviceInfo sends a full snapshot per update, so arg_max keeps the latest row per device.

Query 3: does this device have vulnerability data at all?

DeviceTvmSoftwareVulnerabilities
| summarize Total = count(),
            Critical = countif(VulnerabilitySeverityLevel == "Critical"),
            High = countif(VulnerabilitySeverityLevel == "High")
  by DeviceName
| order by Critical desc

No where Timestamp here, on purpose: this table has no Timestamp column. Add one and you get a semantic error. A device that's missing from this list is either excluded, not onboarded, or on an unsupported OS.

Query 4: a query that's ready to become a detection

DeviceEvents
| where ingestion_time() > ago(1d)
| where ActionType == "AntivirusDetection"
| summarize (Timestamp, ReportId) = arg_max(Timestamp, ReportId), count() by DeviceId
| where count_ > 5

It returns Timestamp, ReportId and DeviceId, which section 6 needs.

Sources: Advanced hunting query language · DeviceNetworkEvents · DeviceInfo · DeviceTvmSoftwareVulnerabilities · Custom detection rules

6. From query to custom detection and actions

Create detection rule turns a query into a scheduled rule. When it fails, it's usually one of these:

• Missing columns. For device tables, return Timestamp, DeviceId and ReportId. Without them, alerts lose their device group scope and the process tree.
• No permission. You need Security settings (manage) or Security Administrator. Security Operator only works if Defender for Endpoint RBAC is off.
• Can't edit someone's rule. You need permissions on every device in the rule's scope. A rule on "All devices" needs access to all devices.
• Continuous (NRT) greyed out. NRT rules use one table only: no joins, no unions, no comments.
• Duplicate alerts. The lookback is longer than the frequency. A rule saved as "every 24 hours" first checks the past 30 days, then runs on schedule. Each run creates at most 150 alerts.

Take actions from results works the same way: device actions need DeviceId; file quarantine needs SHA1, SHA256 or the InitiatingProcess variants plus DeviceId; deleting the sender's copy of an email needs EmailDirection and SenderFromAddress. If a button is greyed out, select Show empty columns and check what's missing. Everything lands in Action center > History.

Sources: Custom detection rules · Take action on advanced hunting results

Gotchas

• Entity tables are snapshots. Use arg_max per device or you'll count the same server many times.
• Don't filter detections on Timestamp. Custom detections pre-filter by their lookback; use ingestion_time() as in query 4.
• A copied query isn't proof. If the column isn't in the table, the filter quietly matches nothing.
• Exclusion hides data, not risk. The excluded device is still on your network.

Day 4 checklist

• [ ] Portal URLs and *.security.windows.com allowed in browser and proxy
• [ ] Roles include vulnerability management view (and manage where needed)
• [ ] Plan confirmed: Plan 2, add-on assigned, or Defender for Business
• [ ] Exclusions given 10 hours before anyone panics
• [ ] Queries use real columns, a time filter, and UTC
• [ ] Detection queries return Timestamp, DeviceId, ReportId
• [ ] A HAR and a screen recording ready for anything still broken

Day 5 is next: onboarding requirements, network and Intune. What's the strangest "zero rows" query you've debugged?

Sources

• Troubleshoot onboarding issues and error messages
• Capture a browser trace for troubleshooting
• Deprecated features for Windows client
• Assign user access to the Microsoft Defender portal (MDE roles)
• Defender Vulnerability Management prerequisites and permissions
• Compare Microsoft Defender Vulnerability Management plans and capabilities
• Get Microsoft Defender Vulnerability Management
• Microsoft Defender for Business FAQ
• Offboard a device from Microsoft Defender for Business
• Manage device scope and relevance with tags and exclusions
• Advanced hunting overview
• Handle advanced hunting errors
• Advanced hunting quotas and usage parameters
• Kusto Query Language overview
• Quickly hunt for entity or event information with go hunt
• Learn the advanced hunting query language
• DeviceNetworkEvents table
• DeviceInfo table
• DeviceTvmSoftwareVulnerabilities table
• Create and manage custom detection rules
• Take action on advanced hunting query results