Merge pull request #65 from FlyingBlueMonkey/patch-1

Create ExploitGuardNetworkProtectionEvents.txt
microsoft · Apr 22, 2020 · e437abd · e437abd
2 parents 5aa4bb9 + c285209
commit e437abd
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/Protection events/ExploitGuardNetworkProtectionEvents.txt b/Protection events/ExploitGuardNetworkProtectionEvents.txt
@@ -5,3 +5,4 @@ DeviceEvents
 | where  ActionType  =~ "ExploitGuardNetworkProtectionBlocked"
 | summarize count(RemoteUrl) by InitiatingProcessFileName, RemoteUrl, Audit_Only=tostring(parse_json(AdditionalFields).IsAudit)
 | sort by count_RemoteUrl desc
+