Network footprint (1)

id: 42b5b09c-7132-4f37-a2fd-4efeed2c540c
name: Network footprint (1)
description: |
  Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
  Ensure to update RemoteIP and RemoteURL variable.
  For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
query: |
  // Query 2 shows you any network communication that happened from endpoints through a specific file to an Remote IP or Remote URL
  //Ensure to update RemoteIP, RemoteURL and InitatingProcessFileName
  // For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email
  let IP = "IP ADDRESS GOES HERE";
  let DNS = "DNS ENTRY GOES HERE";
  let FILENAME = "FILENAME GOES HERE";
  DeviceNetworkEvents
  | where (RemoteIP == IP or RemoteUrl endswith DNS) and InitiatingProcessFileName =~ FILENAME
  | project Timestamp, DeviceName, ActionType, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine