Forum Discussion
How does NetworkCommunicationsEvents > RemoteURL entity get filled?
Hi team, With WDATP EDR available for Mac I wanted to investigate the RemoteURL field for all Firefox processes, but we don't seem to be capturing that data. NetworkCommunicationEvents | w...
Hi fedecharosky
are you sure the process is called "firefox". You are doing a == that means it has to match exactly. Do a NetworkCommunicationEvents without anything else in the query and check what you get back. I bet its more like "firefox.exe" ..
Cheers,
Jan
Blog: emptyDC.com | Podcast: HairlessInTheCloud.com
Jan Geisbauer Is there a dictionary that describes the source for each fields value?
