MDE KQL 使用案例

 

查找程序的 网络通信情况

DeviceNetworkEvents
| where Timestamp > ago(30d)
| where InitiatingProcessFileName == "example.exe"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl
| sort by Timestamp desc

 

DeviceNetworkEvents
| where ActionType has ""
| where DeviceName has ""
| where InitiatingProcessFolderPath has ""
| where InitiatingProcessCommandLine has "xxx.exe"
| where InitiatingProcessAccountName has ""
| where RemoteIP has ""
//| where RemoteUrl has ""
//| where RemotePort ==
//| where LocalIP has ""
//| where LocalPort ==
| where Protocol has ""
| project Timestamp, ActionType, InitiatingProcessFolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, LocalIP, LocalPort, RemoteIP, RemoteUrl, RemotePort, DeviceName, InitiatingProcessAccountName
| sort by Timestamp