Share via

How do i track a user browsing activities in intune or defender?

Yong Chin Kuo 0 Reputation points
2024-10-11T07:32:32.76+00:00

Dear All,

I would like to review a user browsing history.

In Defender advance hunting, i had entered the following queries (from copilot) but when i run, there is no data returned, anyone know how modify the code so that it return the user browsing activities?

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where InitiatingProcessAccountName == "[email protected]"
| where RemoteUrl contains ".com"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, ActionType
| order by Timestamp desc
Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,423 questions

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. James Hamil 25,866 Reputation points Microsoft Employee
    2024-10-14T21:56:11.97+00:00

    Hi @Yong Chin Kuo , there isn't a direct way to track history, but you can access related data. For example, you can use UrlClickEvents or hunt linked downloads. For full browser history access you'd need to use a third party tool.

    Please let me know if you have any questions and I can help you further.

    If this answer helps you please mark "Accept Answer" so other users can reference it.

    Thank you,

    James

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.