↳ GitHub sourceAnalytics ruleLow

CTE - Device Enrolled but On Hold

View on GitHub ↗Original file ↗

Description

A device enrollment is on hold, typically due to a license/device-capacity limit being reached.

Rule type: Scheduled
Version: 1.0.0
Query frequency: 30m
Query period: 30m
Trigger: gt 0

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Connectors

cybereinforce_cte

Data types

CybereinforceCTE_CL

KQL query

Original query, unchanged.

CybereinforceCTE_CL
| where EventType == "device.onhold"
| extend d = parse_json(Details)
| extend
    HostName = iff(isnotempty(tostring(d.hostname)), tostring(d.hostname), strcat("cte-device-", substring(EntityId, 0, 8))),
    DeviceId = tostring(d.deviceId),
    DeviceUser = tostring(d.deviceUser),
    DeviceOs = tostring(d.deviceOs),
    AppName = "Cybereinforce"
| project TimeGenerated, TenantId, DeviceId, HostName, DeviceUser, DeviceOs, AppName, Actor, Severity, Category, Source

Declared entities

Host

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

File: Solutions/Cybereinforce/Analytic Rules/DeviceEnrolledButOnHold.yaml ↗
Commit: 9800e51 ↗
Source identifier: 21818920-85eb-4955-a7cc-f62c731f32ac

Additional source files 2

Solutions/Cybereinforce/Analytic Rules/DeviceEnrolledButOnHold.yamlsource ↗Solutions/Cybereinforce/Data/Solution_Cybereinforce.jsonsolution-membership ↗

GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.