How does NetworkCommunicationsEvents > RemoteURL entity get filled?

Brass Contributor
Hi team,
With WDATP EDR available for Mac I wanted to investigate the RemoteURL field for all Firefox processes, but we don't seem to be capturing that data.
| where InitiatingProcessFileName == "firefox"
| summarize by RemoteURL
RemoteIP is correctly filled, but not RemoteURL.
Any ideas?
3 Replies

Hi @fedecharosky 


are you sure the process is called "firefox". You are doing a == that means it has to match exactly. Do a NetworkCommunicationEvents without anything else in the query and check what you get back. I bet its more like "firefox.exe" ..




Blog: | Podcast:

@Jan Geisbauer Is there a dictionary that describes the source for each fields value?

@fedecharosky Hi ,


If it was encrypted URL it won't be captured as I've observed this issue before, however below query can provide you better context about your inquiry.

| where Timestamp > ago(2d)
| where InitiatingProcessFileName has "firefox"
| project Timestamp, InitiatingProcessAccountName, DeviceName, ActionType, LocalIP, LocalPort, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine



Screen Shot 2020-07-09 at 3.04.31 AM.png


I hope that helps, let me know if you want any further information.