Forum Discussion
DeviceNetworkEvents table, UDP and IGMP events
Does DeviceNetworkEvents table get all network events or are there any caveats. Want to know if Defender Agents on the Machines collect all the TCP/UDP/ICMP/IGMP events or there are any specific ev...
As you already suspect, it does not log every network event. In order to conserve bandwidth and storage space, there is some sort of logic to drop repeat, uninteresting, or extremely common events. I don't know of any source that details the specific of that logic though, I imagine it can change from time to time as MS implements different detections.