Blog Post

Microsoft Defender for Endpoint Blog
13 MIN READ

Enrich your advanced hunting experience using network layer signals from Zeek

Christos_Ventouris's avatar
Christos_Ventouris
Icon for Microsoft rankMicrosoft
Apr 17, 2023
UPDATE : July 9, 2023 The article has been updated to include new signatures added for SSL, DNS and NTLM protocols.   UPDATE : May 22, 2023 On July 18, 2023, Microsoft will be deprecating a s...
Updated Jul 17, 2023
Version 6.0
John_McCash's avatar
John_McCash
Copper Contributor
May 18, 2023

Meitar - That does, indeed clarify! So then, anything with an AdditionalFields name beginning with 'Sample' should just be expected to contain more-or-less complete garbage... Not helpful for my analysis, but at least now I know what's going on. Thanks very very much!

John