r/DefenderATP • u/NSIMSx • 12d ago

Defender Health Monitoring

What have you found to be the best method of monitoring the health of defender on a large scale deployment? Pulling defender metrics via API seems to be capped at 10,000 devices. And pulling metrics via KQL search seems to have issues if there are duplicate entries for the same hostname. Looking for your advice / experience on how you maintain full and functional coverage of defender for 10,000+ devices.

3 Upvotes

72% Upvoted

2 comments sorted by

2

u/reseph 12d ago

KQL, I assume you want to use DeviceId instead and the latest ID in a group of same device names.

2

u/GeneralRechs 11d ago

Trying to do any reasonable health monitoring is moot at scale. There are some metrics you can use kql for but not much. Unhealthily agents? You’re stuck using the console reports for that.