ConnectedNetworkDeviceDiscovery

Description

Find devices connected to a monitored network. Please Note line 5 needs to have a monitored network name put in place or commented out to pull everything.

Query · kql

DeviceNetworkInfo
| mv-expand parse_json(IPAddresses)
| mv-expand parse_json(ConnectedNetworks)
| where IPAddresses.IPAddress !contains ":" and IPAddresses.IPAddress <> ""
| where ConnectedNetworks.Name == "YourNetworkHere" and ConnectedNetworks.Name <> "" //Change the YourNetworkHere to the display
| summarize arg_max(Timestamp, *) by DeviceName
| project DeviceName, IPAddress=IPAddresses.IPAddress, ConnectedNetworks_value=ConnectedNetworks.Name
Raw source ConnectedNetworkDeviceDiscovery · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: c7813a5c-ef11-4ee9-8feb-731402f31259
name: ConnectedNetworkDeviceDiscovery
description: |
  Find devices connected to a monitored network. 
  Please Note line 5 needs to have a monitored network name put in place or commented out to pull everything.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkEvents
query: |
    DeviceNetworkInfo
    | mv-expand parse_json(IPAddresses)
    | mv-expand parse_json(ConnectedNetworks)
    | where IPAddresses.IPAddress !contains ":" and IPAddresses.IPAddress <> ""
    | where ConnectedNetworks.Name == "YourNetworkHere" and ConnectedNetworks.Name <> "" //Change the YourNetworkHere to the display
    | summarize arg_max(Timestamp, *) by DeviceName
    | project DeviceName, IPAddress=IPAddresses.IPAddress, ConnectedNetworks_value=ConnectedNetworks.Name

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.