App Control - Advanced Hunting imports show blocked signed exe and dll as unsigned in signature status

[itsablast]

Hi,
I regularly use Publisher information to whitelist exe and dll from vendors like Intel, Lenovo, AMD etc., so that non-managed-updates mostly work (unless the vendor changes their PcaCertificate sometime in the future).

This is really easy to do when installing the software on a test laptop and scanning the event log with App Control Manager.
But when I use Scan advanced hunting, signing data information is missing and exe dll appear as unsigned.

Is there anything I can improve to get the same information from remote laptops?

This is my kql query I use to export the csv in advanced hunting:
DeviceEvents
| where ActionType startswith "AppControlCodeIntegrityPolicyAudited"
and DeviceName == "l12345.xxx.com"

[itsablast]

Oh I figured it out. Using this simpler query below, also includes AppControlCodeIntegrityOriginAudited, which adds the missing info. My life could have been much easier in the past months. I think I used the more specific query in the beginning to reduce the output when querying all devices. Which was too much for App Control Manager. Since I'm now using the per device approach, including more info is no longer an issue.

DeviceEvents
| where ActionType startswith "AppControlCodeIntegrity"
and DeviceName == "l12345.xxx.com

[HotCakeX]

Just to provide more info, AppControl Manager can handle and process millions of records very efficiently and quickly, so no matter how big the CSV data is, the app will handle them for you. If the data returned by MDE Advanced Hunting includes the fields you are looking for, the app will show them too.

When you mentioned "it was too much for AppControl Manager", did you experience any slow downs or freezing?