Preserve source-event identifiers in aggregated Defender detection queries

Source facts

For Defender for Endpoint tables, Microsoft recommends returning DeviceId and ReportId so alerts carry the correct device-group scope and can build the process tree. For other Defender tables, Timestamp and ReportId should come from the same event to preserve original-event identification and enrichment. Microsoft illustrates retaining the latest event’s timestamp and report identifier when summarizing by an entity. Microsoft Learn.

Applicability

Use this review when converting a Microsoft Defender hunting query into a custom detection, especially after adding aggregation or a projection. Name the source table and intended affected asset before reviewing the output.

DSE recommendation

DSE recommends reviewing the query output as an alert contract. For each aggregation, document which original event represents the result and keep its identifiers together. Have the detection owner inspect sample result rows before enabling automated response, paying particular attention to groups containing several events.

Verification

Run a controlled query against known test events and trace each returned identifier back to its source event. Inspect the resulting alert’s asset scope and available event context in an approved detection test. Record missing enrichment as a failed acceptance item rather than accepting the query merely because it returns rows.

Official references

Microsoft Learn: Create custom detection rules in Microsoft Defender XDR. Source reviewed September 17, 2026.