Advanced hunting does not return network protection logs

Question

Hello,&nbsp;I am able to find network protection logs in event viewer:&nbsp;However, I can't retrieve network protection logs using advanced hunting and KQL query:https://help.redcanary.com/hc/en-us/articles/8265764276375-Turn-on-Microsoft-Network-Protection&nbsp;&nbsp;DeviceNetworkEvents|where ActionType in ('ExploitGuardNetworkProtectionAudited','ExploitGuardNetworkProtectionBlocked')&nbsp;&nbsp;Am I missing something?&nbsp;Thank you

djolenole · Accepted Answer

The logs are in DeviceEvents:https://learn.microsoft.com/en-us/defender-endpoint/network-protection#advanced-huntingDeviceEvents| where ActionType in ('ExploitGuardNetworkProtectionAudited','ExploitGuardNetworkProtectionBlocked')

Forum Discussion

Advanced hunting does not return network protection logs

Share

Resources