Join active threat indicators to endpoint network events
Use active IP indicators from Sentinel threat intelligence to find matching endpoint network connections.
advancedthreat-intelligenceendpoint
- Run surface
- Sentinel Logs
- Required tables
- ThreatIntelIndicatorsDeviceNetworkEvents
- License context
- Microsoft Defender for Endpoint P2
kql
let lookback = {lookback};
let activeIndicators = ThreatIntelIndicators
| where TimeGenerated > ago(30d)
| where Active == true
| where isnotempty(NetworkIP)
| summarize arg_max(TimeGenerated, *) by NetworkIP
| project IndicatorIP=NetworkIP, ThreatType, ConfidenceScore, Description, IndicatorSource=SourceSystem;
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where isnotempty(RemoteIP)
| join kind=inner activeIndicators on $left.RemoteIP == $right.IndicatorIP
| project Timestamp, DeviceName, InitiatingProcessAccountUpn, RemoteIP, RemoteUrl, InitiatingProcessFileName, ThreatType, ConfidenceScore, IndicatorSource, Description
| order by Timestamp descSource: KQLMSPress/definitive-guide-kql Chapter 3: Advanced KQL/Query Samples. Adapted from join and threat-intelligence pivot patterns for modeled Sentinel and MDE tables.