Mar 16 2023 11:52 AM
Anyone know how network event are being collected in MS Defender for Endpoint. Look like DeviceNetworkEvents does not have all network events. We did a testing using nslookup. Do a nslookup to domain 1. Another hour later do a nslookup to domain 2. Then another hour later do a nslookup to domain 3.
DeviceNetworkEvents only have record for the first nslookup. It did not collect the network events for the second and third nslookup.
DeviceProcessEvents did have all these three nslookup process.
Thanks
Jun 16 2024 08:44 AM
Jun 17 2024 06:37 AM
Jun 19 2024 01:06 AM
Jun 20 2024 07:13 AM