Using the SeenBy() function to map discovered network devices to the onboarded device that saw them

Configure automation for Microsoft Defender XDR and Microsoft Sentinel
Answer Correct answer: A — The SeenBy() function returns the onboarded device that discovered each network device in a hunting query.

You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint. You enable Network device discovery. You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device. Which built-in function should you use?

  1. SeenBy() Correct Answer
  2. DeviceFromIP()
  3. next()
  4. current_cluster_endpoint()
defender device discovery seenby advanced hunting function discovered network device

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The SeenBy() Kusto function in device-discovery hunting queries maps a discovered network device back to the onboarded device that observed it, which is exactly the identity relationship the query needs.

In a Defender for Endpoint advanced hunting query for network device discovery, the SeenBy() function returns the onboarded device that discovered each network device, letting you identify where each discovered device was seen on the network.

Using DeviceFromIP() or other functions — those resolve different relationships; only SeenBy() returns which onboarded device discovered a given network device.

Community Discussion (3 comments)

Blasty 👍 1 Selected: A
https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-seenby-function
laddu001 👍 4
Seenby function - https://learn.microsoft.com/en-us/defender-endpoint/device-discovery
rsanx42 👍 3 Selected: A
Correct. By invoking the SeenBy function, in your advanced hunting query, you can get detail on which onboarded device a discovered device was seen by. This information can help determine the network location of each discovered device and subsequently, help to identify it in the network. https://learn.microsoft.com/en-us/defender-endpoint/device-discovery

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender for Endpoint device discovery advanced hunting provides the SeenBy function. When you invoke SeenBy in your query, it returns detail on which onboarded device a discovered device was seen by, helping determine the network location of each discovered device. This is the function that answers 'which onboarded device discovered each network device'.

Why the Other Options Are Wrong

DeviceFromIP (B) maps an IP to a device but does not express the 'discovered-by' relationship. next (C) and current_cluster_endpoint (D) are unrelated Kusto helpers not used for device-discovery mapping.

Community Comment Notes

The community is unanimous (A 100). laddu001 and rsanx42 cite the device-discovery documentation, confirming SeenBy returns which onboarded device saw a discovered device. Blasty also links the advanced-hunting-seenby-function reference.

Official Reference

https://learn.microsoft.com/en-us/defender-endpoint/device-discovery

Related Analysis

You have a Microsoft 365 subscription that uses Microsoft De

S-Grade

You have a Microsoft 365 E5 subscription that contains a dat

A-Grade

You have a Microsoft 365 subscription that uses Microsoft De

A-Grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide