Network Protection

MDE Defender Network Protection Events

Query

DeviceEvents
| where ActionType in ("SmartScreenUrlWarning","SmartScreenUserOverride","ExploitGuardNetworkProtectionAudited","ExploitGuardNetworkProtectionBlocked")
 | distinct ActionType, AdditionalFields, RemoteUrl
| extend data = parse_json(AdditionalFields)
| extend Category = iff(ActionType == "SmartScreenUrlWarning",tostring(parse_json(data).Experience),
                    iff(ActionType == "ExploitGuardNetworkProtectionAudited",tostring(parse_json(data).ResponseCategory),
                    iff(ActionType == "ExploitGuardNetworkProtectionBlocked",tostring(parse_json(data).ResponseCategory),
                    iff(ActionType == "SmartScreenUserOverride",tostring(parse_json(data).ResponseCategory),""))))
| extend Application = iff(ActionType == "SmartScreenUrlWarning",tostring(parse_json(data).ApplicationName),
                    iff(ActionType == "ExploitGuardNetworkProtectionAudited",RemoteUrl,
                    iff(ActionType == "ExploitGuardNetworkProtectionBlocked",RemoteUrl,
                    iff(ActionType == "SmartScreenUserOverride",tostring(parse_json(data).ApplicationName),""))))
| extend IsAudit = parse_json(data).IsAudit
| extend Allow = parse_json(data).Allow
| extend UserSid = parse_json(data).UserSid

About this query

Explanation

The query retrieves network protection events from Microsoft 365 Defender. It filters the events based on the ActionType, and in some cases, the InitiatingProcessAccountName. The query also includes parsing and projecting specific fields from the AdditionalFields column. There are separate queries for Defender Network Protection, Defender SmartScreen, and a combination of both. Additionally, there is a query that joins AlertInfo and AlertEvidence tables to retrieve suspicious connection alerts blocked by network protection.