Blog Post

Microsoft Defender for Endpoint Blog
13 MIN READ

Enrich your advanced hunting experience using network layer signals from Zeek

Christos_Ventouris's avatar
Christos_Ventouris
Icon for Microsoft rankMicrosoft
Apr 17, 2023
UPDATE : July 9, 2023 The article has been updated to include new signatures added for SSL, DNS and NTLM protocols.   UPDATE : May 22, 2023 On July 18, 2023, Microsoft will be deprecating a s...
Updated Jul 17, 2023
Version 6.0
John_McCash's avatar
John_McCash
Copper Contributor
May 16, 2023

Also, and this makes me crazy... You're using url % encoding to include the binary packet data, but the KQL url_decode function doesn't work on nonprintable characters... That makes parsing through this data a huge pain.