Forum Discussion

james1987's avatar
james1987
Occasional Reader
Mar 16, 2023

Not all network events are on DeviceNetworkEvents table

Anyone know how network event are being collected in MS Defender for Endpoint. Look like DeviceNetworkEvents does not have all network events. We did a testing using nslookup. Do a nslookup to domain...
HA13029's avatar
HA13029
Brass Contributor
Jun 19, 2024
Hello,

First, thanks a lot for your help.
I also find that without Real time protection/RTP enabled, most of the traffic is not logged...

Regards,

HA
jbmartin6's avatar
jbmartin6
Iron Contributor
Jun 20, 2024
OH, that is interesting, we haven't noticed that. It might explain some weird things we saw in the lab though, I will check it out.

Resources