Linux Desktop Public Egress Baseline Low Noise

Query

let LinuxDeviceIds =
    DeviceInfo
    | where OSPlatform == "Linux"
    | distinct DeviceId;
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where DeviceId in (LinuxDeviceIds)
| where RemoteIPType == "Public"
| where RemoteIP !startswith "127."
| where InitiatingProcessFileName !in (
    "sensecm",
    "snapd",
    "networkmanager",
    "fwupdmgr"
)
| where InitiatingProcessFolderPath !startswith "/usr/lib/apt/"
| where InitiatingProcessCommandLine !contains "ubuntu-release-upgrader"
| project
    Timestamp,
    DeviceName,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine,
    RemoteIP,
    RemotePort,
    Protocol
| order by Timestamp desc

About this query

Explanation

This query is designed to monitor and analyze outbound public network traffic from Linux desktop or workstation devices, such as Ubuntu desktops, developer virtual machines, and user laptops, over the past 24 hours. The focus is on identifying user-initiated or tool-driven network activities while filtering out routine operating system activities that could clutter the data.

Key Points:

Target Devices: The query specifically looks at devices running Linux.
Time Frame: It examines network events from the last 24 hours.
Public Traffic: It filters for network events where the remote IP is public, excluding local IPs like "127.x.x.x".
Exclusions:
- It excludes traffic from common background services and system processes such as:
  - Defender for Endpoint agent (sensecm)
  - Snap infrastructure (snapd)
  - Network management (networkmanager)
  - Firmware updates (fwupdmgr)
  - Package management (APT methods)
  - OS upgrade checks (ubuntu-release-upgrader)
Output: The query provides details like the timestamp, device name, process initiating the connection, command line used, remote IP and port, and protocol.
Use Cases:
- Validating Endpoint Detection and Response (EDR) solutions on Linux workstations.
- Investigating user-driven network activities.
- Reducing noise in network traffic data to focus on potentially significant activities.

By excluding expected system processes, this query helps in quickly identifying unusual or user-driven network activities, which could be relevant for security investigations or monitoring developer activities.

KQL Search