From a7c2a4279d2c40d23409dd145d76cf3363123157 Mon Sep 17 00:00:00 2001
From: jame2O <james.davenport@squaredup.com>
Date: Thu, 2 Jul 2026 10:37:37 +0100
Subject: [PATCH 1/2] chore: bump version number

---
 plugins/MicrosoftDefender/v1/metadata.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/MicrosoftDefender/v1/metadata.json b/plugins/MicrosoftDefender/v1/metadata.json
index d0bfd996..c9dfa098 100644
--- a/plugins/MicrosoftDefender/v1/metadata.json
+++ b/plugins/MicrosoftDefender/v1/metadata.json
@@ -1,7 +1,7 @@
 {
     "name": "microsoft-defender",
     "displayName": "Microsoft Defender",
-    "version": "1.0.3",
+    "version": "1.0.4",
     "author": {
         "name": "SquaredUp Labs",
         "type": "labs"

From 470cf36bb096200fb8834232d85881f82785e6dd Mon Sep 17 00:00:00 2001
From: jame2O <james.davenport@squaredup.com>
Date: Thu, 2 Jul 2026 10:38:31 +0100
Subject: [PATCH 2/2] feat: split device import into 4 steps, using hash() to
 bucket device IDS

---
 .../v1/dataStreams/listDevices.json           |  5 +-
 .../v1/indexDefinitions/default.json          | 50 ++++++++++++++++++-
 2 files changed, 52 insertions(+), 3 deletions(-)

diff --git a/plugins/MicrosoftDefender/v1/dataStreams/listDevices.json b/plugins/MicrosoftDefender/v1/dataStreams/listDevices.json
index 0931e955..90fc63df 100644
--- a/plugins/MicrosoftDefender/v1/dataStreams/listDevices.json
+++ b/plugins/MicrosoftDefender/v1/dataStreams/listDevices.json
@@ -13,12 +13,15 @@
     "expandInnerObjects": true,
     "endpointPath": "runHuntingQuery",
     "postBody": {
-      "Query": "DeviceInfo | where isnotempty(DeviceName) | project Timestamp, DeviceId, DeviceName | summarize arg_max(Timestamp, *) by DeviceId"
+      "Query": "DeviceInfo | where isnotempty(DeviceName) and hash(DeviceId, 4) == {{shardIndex}} | project Timestamp, DeviceId, DeviceName | summarize arg_max(Timestamp, *) by DeviceId"
     },
     "pathToData": "results",
     "getArgs": [],
     "headers": []
   },
+  "ui": [
+    { "name": "shardIndex", "label": "Shard Index", "type": "text", "defaultValue": "0" }
+  ],
   "providesPluginDiagnostics": true,
   "manualConfigApply": true,
   "timeframes": false,
diff --git a/plugins/MicrosoftDefender/v1/indexDefinitions/default.json b/plugins/MicrosoftDefender/v1/indexDefinitions/default.json
index 88c6d2ca..65653d3f 100644
--- a/plugins/MicrosoftDefender/v1/indexDefinitions/default.json
+++ b/plugins/MicrosoftDefender/v1/indexDefinitions/default.json
@@ -1,9 +1,55 @@
 {
     "steps": [
         {
-            "name": "Import Devices",
+            "name": "Import Devices (1)",
             "dataStream": {
-                "name": "listDevices"
+                "name": "listDevices",
+                "config": { "shardIndex": "0" }
+            },
+            "timeframe": "none",
+            "objectMapping": {
+                "id": "DeviceId",
+                "name": "DeviceName",
+                "type": {
+                    "value": "Device"
+                }
+            }
+        },
+        {
+            "name": "Import Devices (2)",
+            "dataStream": {
+                "name": "listDevices",
+                "config": { "shardIndex": "1" }
+            },
+            "timeframe": "none",
+            "objectMapping": {
+                "id": "DeviceId",
+                "name": "DeviceName",
+                "type": {
+                    "value": "Device"
+                }
+            }
+        },
+        {
+            "name": "Import Devices (3)",
+            "dataStream": {
+                "name": "listDevices",
+                "config": { "shardIndex": "2" }
+            },
+            "timeframe": "none",
+            "objectMapping": {
+                "id": "DeviceId",
+                "name": "DeviceName",
+                "type": {
+                    "value": "Device"
+                }
+            }
+        },
+        {
+            "name": "Import Devices (4)",
+            "dataStream": {
+                "name": "listDevices",
+                "config": { "shardIndex": "3" }
             },
             "timeframe": "none",
             "objectMapping": {