table

DeviceNetworkEvents

DeviceNetworkEvents contains network connections and related endpoint network activity reported by Microsoft Defender for Endpoint.

tablesCurrent

Relationships

Microsoft Defender for Endpoint
Source productproduct Microsoft Defender for Endpoint P2
Required licenselicense Microsoft Graph Security API
API accessapi Microsoft Defender for Endpoint APIs
API accessapi Legacy Microsoft Defender XDR APIs
API accessapi DeviceProcessEvents
Related tabletable DeviceEvents
Related tabletable DeviceInfo
Related tabletable

Schema

Field	Type	Description
`Timestamp`	datetime	Date and time when the event was recorded.
`DeviceId`	string	Unique identifier for the device in the service.
`DeviceName`	string	Fully qualified domain name of the device.
`ActionType`	string	Type of network activity that triggered the event.
`RemoteIP`	string	IP address that the device connected to.
`RemotePort`	int	TCP port on the remote device that was connected to.
`RemoteUrl`	string	URL or fully qualified domain name that was connected to.
`LocalIP`	string	Source IP address used during communication.
`Protocol`	string	Protocol used during the communication.
`InitiatingProcessAccountSid`	string	Security identifier of the account that ran the process responsible for the network event.

Related KQL

Join active threat indicators to endpoint network events

Use active IP indicators from Sentinel threat intelligence to find matching endpoint network connections.

template

advancedthreat-intelligenceendpoint

Run surface: Sentinel Logs
Required tables: ThreatIntelIndicators DeviceNetworkEvents
License context: Microsoft Defender for Endpoint P2

kql

let lookback = {lookback};
let activeIndicators = ThreatIntelIndicators
| where TimeGenerated > ago(30d)
| where Active == true
| where isnotempty(NetworkIP)
| summarize arg_max(TimeGenerated, *) by NetworkIP
| project IndicatorIP=NetworkIP, ThreatType, ConfidenceScore, Description, IndicatorSource=SourceSystem;
DeviceNetworkEvents
| where Timestamp > ago(lookback)
| where isnotempty(RemoteIP)
| join kind=inner activeIndicators on $left.RemoteIP == $right.IndicatorIP
| project Timestamp, DeviceName, InitiatingProcessAccountUpn, RemoteIP, RemoteUrl, InitiatingProcessFileName, ThreatType, ConfidenceScore, IndicatorSource, Description
| order by Timestamp desc

Source: KQLMSPress/definitive-guide-kql Chapter 3: Advanced KQL/Query Samples. Adapted from join and threat-intelligence pivot patterns for modeled Sentinel and MDE tables.