查找程序的 网络通信情况
DeviceNetworkEvents | where Timestamp > ago(30d) | where InitiatingProcessFileName == "example.exe" | project Timestamp, DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort, RemoteUrl | sort by Timestamp desc
DeviceNetworkEvents | where ActionType has "" | where DeviceName has "" | where InitiatingProcessFolderPath has "" | where InitiatingProcessCommandLine has "xxx.exe" | where InitiatingProcessAccountName has "" | where RemoteIP has "" //| where RemoteUrl has "" //| where RemotePort == //| where LocalIP has "" //| where LocalPort == | where Protocol has "" | project Timestamp, ActionType, InitiatingProcessFolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, LocalIP, LocalPort, RemoteIP, RemoteUrl, RemotePort, DeviceName, InitiatingProcessAccountName | sort by Timestamp