MDE Advanced Hunting Local csv returning only 2 results

[AlzheimerZA]

When using a local csv from MDE Advance Hunting there is only two lines returned, but the csv contains 1285 lines of good data.
I'm getting this in two separate environments and if I use the App Control Wizard the csv data pulls in correct.

Am I missing something here?

I am using the query in the below:
https://github.com/MicrosoftDocs/WDAC-Toolkit/blob/main/WDAC-Policy-Wizard/docs/using/advanced-hunting.md

[HotCakeX]

You are using a query that has tailored formatting, designed for another app (the document you linked to wasn't written by me). You're using AppControl Manager so not sure why you expect that query to work with it. AppControl Manager doesn't need any such special formatting, it takes in raw data.

In the app, there are example queries you can copy and use.

• https://github.com/HotCakeX/Harden-Windows-Security/wiki/How-to-Use-Microsoft-Defender-for-Endpoint-Advanced-Hunting-With-WDAC-App-Control
• https://github.com/HotCakeX/Harden-Windows-Security/wiki/Create-Policy-From-MDE-Advanced-Hunting

[HotCakeX]

Please let me know if using those queries and still not getting the events you're looking for or if there's a feature you'd like to see added in the app.

[AlzheimerZA]

Using those worked fine thanks. Was exploring the two tools and ended up getting confused with the query I was using. Thanks for the quick reply

[HotCakeX]

Glad to know that, anytime ☺️