Security Policy Errors

How to Export Attack Surface Reduction Rule Results in Microsoft 365 Defender

Ayan Masood Oct 19, 2026 868 views

Question details

The user needs to export device-level information regarding Attack Surface Reduction (ASR) rule results from Microsoft 365 Defender for further analysis.

How to Export Attack Surface Reduction Rule Results in Microsoft 365 Defender

Product: Microsoft 365 Defender
Device & OS: not provided
Scenario: Reviewing detailed device counts in Block, Warn, and Audit modes after applying Attack Surface Reduction (ASR) policies.
Observed behavior: The default ASR rules report does not provide an option to directly export device-level information, limiting detailed data analysis.

Before you start

Ensure you have the necessary administrative privileges in Microsoft 365 Defender and access to the Advanced Hunting features to query device-level security data.

Solution 1Recommended

Use Advanced Hunting for Device-Level ASR Queries

Utilize the Advanced Hunting feature in Microsoft 365 Defender to run custom Kusto Query Language (KQL) queries and export the specific device-level results.

Since the standard ASR rules report summarizes data, Advanced Hunting allows security administrators to access up to 30 days of raw event data. By querying the DeviceEvents table, you can isolate ASR triggers and export a comprehensive device-level list.

Access Advanced Hunting

Log in to the Microsoft 365 Defender portal using your administrative credentials. Navigate to the 'Hunting' section in the left-hand menu and select 'Advanced hunting'.

Run a KQL Query

Write or paste a Kusto Query Language (KQL) query targeting the DeviceEvents table to filter for ASR rule triggers (for example, where ActionType starts with 'Asr'). Click 'Run query'.

Export the Results

Once the query populates the device-level report, click the 'Export' button located above the results pane to download the data as a CSV file for your records.

Use Advanced Hunting for Device-Level ASR Queries

Query Customization: You can modify your KQL query to specifically group and filter devices based on whether the ASR rule triggered in Block, Warn, or Audit mode.

Solution 2

Consult Official Microsoft Forums for Reporting Scripts

If default reporting lacks necessary export options and you need tailored scripts, consult Microsoft's specialized forums for custom query and reporting solutions.

Free Microsoft Office alternative

Analyze Your Exported Defender Reports with WPS Office

While Microsoft 365 Defender handles your security policies, analyzing the exported ASR report CSV files requires a robust spreadsheet tool. WPS Office provides a lightweight, highly compatible alternative to Microsoft Office for all your data analysis needs.

1. Download and Install: Download WPS Office Free from the official website and install it on your computer.
2. Open the Exported CSV: Launch WPS Spreadsheet and open the ASR device-level report CSV file you just exported from Microsoft 365 Defender.
3. Analyze the Security Data: Use WPS Spreadsheet's PivotTable and data filtering tools to categorize and summarize your Block, Warn, and Audit device counts effortlessly.

Fully compatible with Microsoft Excel (.xlsx, .csv) formats for seamless security report analysis.Lightweight and fast, effortlessly handling large event data exports from security portals.Free to use with a familiar, easy-to-navigate tabbed user interface for quick adoption.

microsoft office alternative - wps office

Frequently Asked Questions

Why can't I export device-level data directly from the ASR rules report?

The default Attack Surface Reduction (ASR) rules report in Microsoft 365 Defender provides aggregated, high-level views of Block, Warn, and Audit modes for general monitoring. For detailed, device-level exports, administrators are required to use Advanced Hunting queries to extract raw event logs.

What is Advanced Hunting in Microsoft 365 Defender?

Advanced Hunting is a query-based threat hunting tool that allows administrators to explore up to 30 days of raw data across their network. By using Kusto Query Language (KQL), you can inspect specific events, including ASR rule triggers, and export the exact data points you need.

How can I easily analyze the exported ASR CSV file?

Once you export your ASR results as a CSV file using Advanced Hunting, you can open it in a powerful spreadsheet application like WPS Spreadsheet. From there, you can utilize PivotTables and advanced filtering to sort your device counts by rule ID, device name, and action mode.

Microsoft Office Security Issues