Seen Connected Networks

Description

This query uncovers seen connected networks

Query · kql

// 
DeviceNetworkInfo
| summarize arg_max(Timestamp, *) by DeviceId
| mv-expand todynamic(ConnectedNetworks)
| where isnotempty( ConnectedNetworks.Name)
| summarize by NetworkNames = tostring(ConnectedNetworks.Name)
Raw source Seen Connected Networks · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: cd1492a0-7e53-4615-9e63-f930576a3f6b
name: Seen Connected Networks
description: |
  This query uncovers seen connected networks
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkInfo
tactics: []
relevantTechniques: []
query: |
  // 
  DeviceNetworkInfo
  | summarize arg_max(Timestamp, *) by DeviceId
  | mv-expand todynamic(ConnectedNetworks)
  | where isnotempty( ConnectedNetworks.Name)
  | summarize by NetworkNames = tostring(ConnectedNetworks.Name)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.