You have a Microsoft 365 subscription that uses Microsoft Defender XDR.

 First selection: ReportId

 Second selection: ReportId

In Microsoft Defender X DR advanced hunting, antivirus detections on endpoints are recorded in DeviceEvents with ActionType == " AntivirusDetection " . To find devices with more than five detections in the last 24 hours , filter the table to the last day, then summarize counts by DeviceId . To avoid returning multiple rows per device and to include a representative “latest” event field, use arg_max(Timestamp, ReportId) within summarize . The arg_max aggregation returns the row associated with the maximum Timestamp per device and keep s the ReportId from that latest event. Because you’re projecting specific fields from arg_max , you must specify the same fields on both sides of the assignment: (Timestamp, ReportId) = arg_max(Timestamp, ReportId) .

Final query pattern:

DeviceEvents

| where ingestion_time() > ago(1d)

| where ActionType == " AntivirusDetection "

| summarize (Timestamp, ReportId) = arg_max(Timestamp, ReportId), count() by DeviceId

| where count_ > 5

ingestion_time() > ago(1d) ensures the last 24 hours relative to ingestion, alig ning with fast, reliable time filtering.

count() tallies detections per device; where count_ > 5 filters to devices exceeding the threshold.

arg_max(Timestamp, ReportId) picks the latest detection per device and carries along a concrete identifier ( ReportI d ) from that event.