Question

During a threat hunt in Microsoft Defender XDR Advanced Hunting, you must identify all outbound connections that internal endpoints made to a specific set of 12 known malicious IP addresses supplied by your threat intelligence team. You want a single, efficient KQL query that returns the device name, remote IP, remote port, and initiating process for each matching connection over the last 7 days. Which approach best meets this requirement?

Accepted Answer

Query the DeviceNetworkEvents table, filter RemoteIP with the in operator against the list of IPs, and project DeviceName, RemoteIP, RemotePort, and InitiatingProcessFileName.

Answer

Query the DeviceEvents table and filter ActionType for NetworkConnectionEvents, then project the network and process columns.

Answer

Query the DeviceFileEvents table and filter on RemoteUrl matching the malicious IP addresses.

Answer

Query the DeviceProcessEvents table and filter InitiatingProcessRemoteIP against the IP list.