Endpoint.Ports includes extraneous events

[SkyeLowry]

The events from body.category="AdvancedHunting-DeviceNetworkEvents" includes all events, though body.properties.ActionType has values:

ConnectionSuccess
NetworkSignatureInspected
ListeningConnectionCreated
ConnectionFailed
InboundConnectionAccepted
ConnectionFound
ConnectionRequest
ConnectionAcknowledged
ConnectionAttempt

I am not certain which events should be included, though I do see "NetworkSignatureInspected" results in CIM events that don't seem to relate to the uses of the data model.

The problems this is creating shows up in this example:
The report [Endpoint - Listening Ports Tracker - Lookup Gen] from SA-EndpointProtection then adds those events to the listeningports_tracker lookup but those events are not listening ports, and result in entries with transport=null in the output.

Also, state=listening makes sense for an ActionType of ListeningConnectionCreated. I think when ActionType=ConnectionSuccess|InboundConnectionAccepted the state should be established. (I don't know what other field values are possible.

I think process_id could map to body.properties.InitiatingProcessId, process_guid could have a match, though I am not sure which value.

[inspired]

Hi Skye,

do you by any chance have an anonymized data sample you could share so I can look into this?

[SkyeLowry]

I will create one. I will try to get a sample of each of the body.properties.ActionType values.

[GArayaR]

//Identifies potential DNS tunnelling over HTTPS
//Microsoft Sentinel query
DeviceNetworkEvents
| where ActionType == "NetworkSignatureInspected"
| extend AF = parse_json(AdditionalFields)
| extend NetworkSignature = AF.SignatureName
//Search for network signatures that are DNS but not on regular DNS ports including Netbios & LLMNR if those are in use
| where NetworkSignature == "DNS_Request" and RemotePort !in ("53", "137", "5353", "5355")
//Exclude traffic where the remote IP is a private/local IP address, you can remove this if also interested in that traffic
| where not(ipv4_is_private(RemoteIP))
| project
TimeGenerated,
DeviceName,
NetworkSignature,
LocalIP,
LocalPort,
RemoteIP,
RemotePort,
RemoteUrl

//Advanced Hunting query
DeviceNetworkEvents
| where ActionType == "NetworkSignatureInspected"
| extend AF = parse_json(AdditionalFields)
| extend NetworkSignature = AF.SignatureName
//Search for network signatures that are DNS but not on regular DNS ports including Netbios & LLMNR if those are in use
| where NetworkSignature == "DNS_Request" and RemotePort !in ("53", "137", "5353", "5355")
//Exclude traffic where the remote IP is a private/local IP address, you can remove this if also interested in that traffic
| where not(ipv4_is_private(RemoteIP))
| project
Timestamp,
DeviceName,
NetworkSignature,
LocalIP,
LocalPort,
RemoteIP,
RemotePort,
RemoteUrl

[inspired]

@SkyeLowry I'm doing some cleanup and want to get this fixed. Do you have the samples?