Display the Inspected Network Signatures

Query · kql

DeviceNetworkEvents
| where ActionType == "NetworkSignatureInspected"
| extend
     SignatureName = parse_json(AdditionalFields).SignatureName,
     SignatureMatchedContent = 
parse_json(AdditionalFields).SignatureMatchedContent
| summarize count() by tostring(SignatureName)
| render piechart with(title="Inspected Network Signatures")
Raw source Display the Inspected Network Signatures · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Display the Inspected Network Signatures


## Defender XDR

```
DeviceNetworkEvents
| where ActionType == "NetworkSignatureInspected"
| extend
     SignatureName = parse_json(AdditionalFields).SignatureName,
     SignatureMatchedContent = 
parse_json(AdditionalFields).SignatureMatchedContent
| summarize count() by tostring(SignatureName)
| render piechart with(title="Inspected Network Signatures")

```
## Sentinel
```
DeviceNetworkEvents
| where ActionType == "NetworkSignatureInspected"
| extend
     SignatureName = parse_json(AdditionalFields).SignatureName,
     SignatureMatchedContent = 
parse_json(AdditionalFields).SignatureMatchedContent
| summarize count() by tostring(SignatureName)
| render piechart with(title="Inspected Network Signatures")
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.