{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/", "slug": "dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries", "url": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/" }, "title": "Preserve source-event identifiers in aggregated Defender detection queries", "summary": "How should an aggregated custom detection query retain the event context needed for its alert?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:07+00:00", "modified_at": "2026-09-17T16:38:44+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 210, "potentially_affected": "Use this review when converting a Microsoft Defender hunting query into a custom detection, especially after adding aggregation or a projection. Name the source table and intended affected asset before reviewing the output.", "dse_recommendation": "DSE recommends reviewing the query output as an alert contract.", "primary_source": { "name": "Create custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For Defender for Endpoint tables, Microsoft recommends returning DeviceId and ReportId so alerts carry the correct device-group scope and can build the process tree. For other Defender tables, Timestamp and ReportId should come from the same event to preserve original-event identification and enrichment. Microsoft illustrates retaining the latest event’s timestamp and report identifier when summarizing by an entity. Microsoft Learn.

\n

Applicability

\n

Use this review when converting a Microsoft Defender hunting query into a custom detection, especially after adding aggregation or a projection. Name the source table and intended affected asset before reviewing the output.

\n

DSE recommendation

\n

DSE recommends reviewing the query output as an alert contract. For each aggregation, document which original event represents the result and keep its identifiers together. Have the detection owner inspect sample result rows before enabling automated response, paying particular attention to groups containing several events.

\n

Verification

\n

Run a controlled query against known test events and trace each returned identifier back to its source event. Inspect the resulting alert’s asset scope and available event context in an approved detection test. Record missing enrichment as a failed acceptance item rather than accepting the query merely because it returns rows.

\n

Official references

\n

Microsoft Learn: Create custom detection rules in Microsoft Defender XDR. Source reviewed September 17, 2026.

", "content_text": "Source facts\nFor Defender for Endpoint tables, Microsoft recommends returning DeviceId and ReportId so alerts carry the correct device-group scope and can build the process tree. For other Defender tables, Timestamp and ReportId should come from the same event to preserve original-event identification and enrichment. Microsoft illustrates retaining the latest event’s timestamp and report identifier when summarizing by an entity. Microsoft Learn.\nApplicability\nUse this review when converting a Microsoft Defender hunting query into a custom detection, especially after adding aggregation or a projection. Name the source table and intended affected asset before reviewing the output.\nDSE recommendation\nDSE recommends reviewing the query output as an alert contract. For each aggregation, document which original event represents the result and keep its identifiers together. Have the detection owner inspect sample result rows before enabling automated response, paying particular attention to groups containing several events.\nVerification\nRun a controlled query against known test events and trace each returned identifier back to its source event. Inspect the resulting alert’s asset scope and available event context in an approved detection test. Record missing enrichment as a failed acceptance item rather than accepting the query merely because it returns rows.\nOfficial references\nMicrosoft Learn: Create custom detection rules in Microsoft Defender XDR. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nFor Defender for Endpoint tables, Microsoft recommends returning DeviceId and ReportId so alerts carry the correct device-group scope and can build the process tree. For other Defender tables, Timestamp and ReportId should come from the same event to preserve original-event identification and enrichment. Microsoft illustrates retaining the latest event’s timestamp and report identifier when summarizing by an entity. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules).\n\n## Applicability\n\nUse this review when converting a Microsoft Defender hunting query into a custom detection, especially after adding aggregation or a projection. Name the source table and intended affected asset before reviewing the output.\n\n## DSE recommendation\n\nDSE recommends reviewing the query output as an alert contract. For each aggregation, document which original event represents the result and keep its identifiers together. Have the detection owner inspect sample result rows before enabling automated response, paying particular attention to groups containing several events.\n\n## Verification\n\nRun a controlled query against known test events and trace each returned identifier back to its source event. Inspect the resulting alert’s asset scope and available event context in an approved detection test. Record missing enrichment as a failed acceptance item rather than accepting the query merely because it returns rows.\n\n## Official references\n\n[Microsoft Learn: Create custom detection rules in Microsoft Defender XDR](https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/", "url": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Preserve source-event identifiers in aggregated Defender detection queries", "item": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/", "url": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/", "headline": "Preserve source-event identifiers in aggregated Defender detection queries", "description": "How should an aggregated custom detection query retain the event context needed for its alert?", "abstract": "How should an aggregated custom detection query retain the event context needed for its alert?", "articleBody": "Source facts\nFor Defender for Endpoint tables, Microsoft recommends returning DeviceId and ReportId so alerts carry the correct device-group scope and can build the process tree. For other Defender tables, Timestamp and ReportId should come from the same event to preserve original-event identification and enrichment. Microsoft illustrates retaining the latest event’s timestamp and report identifier when summarizing by an entity. Microsoft Learn.\nApplicability\nUse this review when converting a Microsoft Defender hunting query into a custom detection, especially after adding aggregation or a projection. Name the source table and intended affected asset before reviewing the output.\nDSE recommendation\nDSE recommends reviewing the query output as an alert contract. For each aggregation, document which original event represents the result and keep its identifiers together. Have the detection owner inspect sample result rows before enabling automated response, paying particular attention to groups containing several events.\nVerification\nRun a controlled query against known test events and trace each returned identifier back to its source event. Inspect the resulting alert’s asset scope and available event context in an approved detection test. Record missing enrichment as a failed acceptance item rather than accepting the query merely because it returns rows.\nOfficial references\nMicrosoft Learn: Create custom detection rules in Microsoft Defender XDR. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:34:07+00:00", "dateModified": "2026-09-17T16:38:44+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-053-preserve-source-event-identifiers-in-aggregated-defender-detection-queries/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Preserve source-event identifiers in aggregated Defender detection queries" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 210, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create custom detection rules in Microsoft Defender XDR - Microsoft Defender XDR | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/defender-xdr/custom-detection-rules" } } ] } }