Find Sensor ID of an Endpoint in MDE

Issue

How do I find the Sensor ID of an endpoint in the the Microsoft Defender console.

Environment

MDE

Resolution

1. Log into the MDE console.
2. Select Advance hunting (Located in the left menu)
3. Run the following query
   

   DeviceInfo
   | where DeviceName == "<Hostname>"
   

   ** Replace <Hostname> with the FQDN of the endpoint, but leave the ""

** Note DeviceId is the Sensor ID in Red Canary.