Forum Discussion

mmikac's avatar
mmikac
Copper Contributor
Nov 28, 2022

MacOS devices visibility in Sentinel query

Greetings all.

 

I'm working on a query to see when the users are logged in on their devices. For Windows devices I can get all the information I need, but when I try to get the info for MacOS devices, I don't get any.

 

Is there a query that shows info for MacOS?

 

Any help would be great.

 

Thank you

KQL
kusto
Log Data
Reports
  • samikroy's avatar
    samikroy
    Brass Contributor
    Nov 28, 2022
    mmikac - Could you please specify what the log source you are using
    are they SecurityEvents or DeviceInfo or another logs for windows machines !
    • mmikac's avatar
      mmikac
      Copper Contributor
      Nov 28, 2022
      samikroy in this particular query I'm using DeviceInfo log.
      We are trying to see which devices are inactive for a longer period of time since some of our employees use client equipment

Resources