Forum Discussion

Jacques van Zijl's avatar
Jacques van Zijl
Icon for Microsoft rankMicrosoft
Apr 30, 2019

how do i quarry a process in Kusto for MATP (Microsoft advance threat protection)

Hi guys, I'm pretty new to the channel and also kusto quarrying so my apologies if i do get things wrong, i have done some research and i'm trying to build a Kusto quarry to detect when a program s...
Jacques van Zijl's avatar
Jacques van Zijl
Icon for Microsoft rankMicrosoft
May 02, 2019

Daniel Naim ok good news its a better report thank you for that, question why is it showing AnyDesk.exe failed to establish connection with 172.107.198.38:80 but i do have a connection?? see attached screen shot

Daniel Naim's avatar
Daniel Naim
Former Employee
May 12, 2019
Failed to established connection means that in this instance the connection didn't go through. If you do have a successful connection from this process to this IP this can appear later in time in advanced hunting or machine timeline