Defender for Endpoint Day 4: advanced hunting, and fixing portal and TVM problems
My Day 4 notes on Defender for Endpoint, rewritten as a "what breaks, why, how to fix" guide and checked against Microsoft Learn (October 2026). Day 3 covered the device timeline, inventory and vulnerability management ( MDE Day 3: device timeline and TVM ). Day 4 is the day those pages stop behaving. The classic Day 4 moment: you copy a hunting query from the docs, press Run query , and get zero…
Day 4 of Defender for Endpoint brought new challenges and insights. One persistent issue was the device timeline and TVM (Threat and Vulnerability Management) portal behaving erratically. Copying hunting queries from documentation often resulted in zero rows returned, while devices excluded yesterday still appeared on vulnerability reports. These were not bugs but rather issues with missing columns or time sync problems.
After troubleshooting, it became clear that the root cause could often be traced back to a specific layer: browser, access, license, time, or the query itself. For vulnerability management, clocks were notoriously slow. Exclusions could take up to 10 hours to propagate, while adding an add-on could take up to 6 hours.
Advanced hunting queries returned results in UTC, in 30-day intervals, and most zero rows problems stemmed from incorrect tables or columns, not missing data. To capture and document issues before attempting fixes, it was recommended to use Snipping Tool, Xbox Game Bar, or Clipchamp instead of the deprecated Steps Recorder. In addition, any browser traces should be sanitized before sharing.
For vulnerability management, empty pages or access denied errors could be resolved by checking roles, ensuring the correct licensing tier, and verifying the subscription status. Missing data, such as security baselines and browser extensions, were premium features that required separate add-ons or standalone products, which may require up to six hours to be available. Lastly, devices excluded from vulnerability management would still appear if the exclusion hadn't fully propagated, requiring patience and follow-up.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
