Using the SeenBy() function to map discovered network devices to the onboarded device that saw them

SC-200 By islever Editorial Last updated

Configure automation for Microsoft Defender XDR and Microsoft Sentinel

Short answer

A The SeenBy() function returns the onboarded device that discovered each network device in a hunting query.

Question

You have 500 on-premises Windows 11 devices that use Microsoft Defender for Endpoint. You enable Network device discovery. You need to create a hunting query that will identify discovered network devices and return the identity of the onboarded device that discovered each network device. Which built-in function should you use?
  1. SeenBy() Correct Answer
  2. DeviceFromIP()
  3. next()
  4. current_cluster_endpoint()

Key Takeaways

The SeenBy() Kusto function in device-discovery hunting queries maps a discovered network device back to the onboarded device that observed it, which is exactly the identity relationship the query needs.

In a Defender for Endpoint advanced hunting query for network device discovery, the SeenBy() function returns the onboarded device that discovered each network device, letting you identify where each discovered device was seen on the network.

Common mistake: Using DeviceFromIP() or other functions — those resolve different relationships; only SeenBy() returns which onboarded device discovered a given network device.

Expert Analysis

Why the Answer Is Correct

Microsoft Defender for Endpoint device discovery advanced hunting provides the SeenBy function. When you invoke SeenBy in your query, it returns detail on which onboarded device a discovered device was seen by, helping determine the network location of each discovered device. This is the function that answers 'which onboarded device discovered each network device'.

Why the Other Options Are Wrong

DeviceFromIP (B) maps an IP to a device but does not express the 'discovered-by' relationship. next (C) and current_cluster_endpoint (D) are unrelated Kusto helpers not used for device-discovery mapping.

Community Comment Notes

The community is unanimous (A 100). laddu001 and rsanx42 cite the device-discovery documentation, confirming SeenBy returns which onboarded device saw a discovered device. Blasty also links the advanced-hunting-seenby-function reference.

Official Reference

https://learn.microsoft.com/en-us/defender-endpoint/device-discovery

This link opens the official vendor documentation in a new tab.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. laddu001 👍 4
    Seenby function - https://learn.microsoft.com/en-us/defender-endpoint/device-discovery
  2. rsanx42 👍 3 Answered A
    Correct. By invoking the SeenBy function, in your advanced hunting query, you can get detail on which onboarded device a discovered device was seen by. This information can help determine the network location of each discovered device and subsequently, help to identify it in the network. https://learn.microsoft.com/en-us/defender-endpoint/device-discovery
  3. Blasty 👍 1 Answered A
    https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-seenby-function

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide