Endpoint

← All KQL categories

Platform

Endpoint

5 queries tagged with this platform.

• Cost & Ingest / Cost By Table Top 10 Billable MDE Tables

  Top 10 most expensive Microsoft Defender for Endpoint tables over the last 90 days.

• Hunting Hunt Blockchain Rpc C2 Dead Drop

  C2 traffic hidden inside blockchain-RPC calls to public utilities (QuickNode, Alchemy) — 'the dead drop is a public utility.'

• Hunting Hunt DNS Aaaa Record Covert Recovery Channel

  Project CAV3RN's DNS AAAA-record recovery channel — IPv6 addresses returned in AAAA queries that decode as ASCII or structured config.

• Posture Which Devices Are Internet Facing

  Identify internet-facing devices — walks through what "public" actually means for both IPv4 and IPv6 before matching.

• Posture Which Devices Or Software Are EOL

  Devices running at least one end-of-support / end-of-life software title or version, from `DeviceTvmSoftwareInventory`.