KQL Search

This query is designed to identify and track the use of the Nmap tool, which is often used for network reconnaissance, on Linux systems. Here's a simple breakdown of what the query does:

1. Data Source: It looks at network-related events from devices (DeviceNetworkEvents).

2. Filter for Nmap Usage: It specifically searches for events where the command line used includes "nmap" and the tool is located in the typical Linux directory for Nmap (/usr/bin/nmap).

3. Select Information: For each event that matches these criteria, it extracts and displays the following details:

   • The exact command line that was used (InitiatingProcessCommandLine).
   • The name of the device where the command was run (DeviceName).
   • The unique identifier for the device (DeviceId).
   • The time when the event occurred (Timestamp).

In summary, this query helps in detecting and analyzing the use of Nmap on Linux systems by providing details about the command usage and the devices involved.