Network footprint (2)

Description

Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL. Ensure to update RemoteIP and RemoteURL variable. For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.

Query · kql

// Query 3 allows you to find network communication to an IP or URL in the DeviceNetworkEvents table, as well as in DeviceEvents for other events (SmartScreen, launch browser with URL, more)
// Ensure to update RemoteIP and RemoteURL variable.
find in (DeviceEvents, DeviceNetworkEvents)
where RemoteIP == "IP ADDRESS GOES HERE" or RemoteUrl =~ "URL GOES HERE"
project DeviceName, ActionType, FileName, Timestamp
Raw source Network footprint (2) · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: b18cae1a-d089-44b8-bf33-f135ee615f2a
name: Network footprint (2)
description: |
  Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
  Ensure to update RemoteIP and RemoteURL variable.
  For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
  - DeviceEvents
query: |
  // Query 3 allows you to find network communication to an IP or URL in the DeviceNetworkEvents table, as well as in DeviceEvents for other events (SmartScreen, launch browser with URL, more)
  // Ensure to update RemoteIP and RemoteURL variable.
  find in (DeviceEvents, DeviceNetworkEvents)
  where RemoteIP == "IP ADDRESS GOES HERE" or RemoteUrl =~ "URL GOES HERE"
  project DeviceName, ActionType, FileName, Timestamp

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.