>Device Investigator

Triaging a potentially compromised endpoint? Enter its hostname or MDE device ID and, as your investigation progresses, add the IOCs you find (IPs, domains, file hashes, file names/paths). Every hunt below scopes to that device and narrows to your IOCs; add IOCs and a fleet-wide "which other devices touched this" sweep appears. Pick your platform, Microsoft Defender XDR (Advanced Hunting, Timestamp) or Microsoft Sentinel (Log Analytics, TimeGenerated). Every table here needs Microsoft Defender for Endpoint (in Sentinel, the MDE data connector must stream the Device* tables). Nothing is sent anywhere: this all runs in your browser. Powered by the >SudoTrace engine.