KQL Search

This KQL (Kusto Query Language) query is designed to detect the usage of Quick Assist within an organization by monitoring network events. Here's a simple breakdown of what it does:

1. Source Table: It looks at the DeviceNetworkEvents table, which logs network activities on devices.
2. Filter by Action Type: It filters the events to only include those where the action type is HttpConnectionInspected, meaning HTTP connections that have been inspected.
3. Filter by Port: It further narrows down the events to those where the remote port is 443, which is commonly used for secure HTTPS connections.
4. Extract Additional Information: It extracts additional connection information from the AdditionalFields column and stores it in a new column called ConnectInfo.
5. Extract Host Information: From the ConnectInfo, it extracts the host field and stores it in a new column called HttpHost.
6. Filter by Host: Finally, it filters the events to only include those where the HttpHost is remoteassistance.support.services.microsoft.com:443, which is the host used by Quick Assist.

In summary, this query helps security operations teams monitor and detect when Quick Assist is being used in their organization by looking for specific network connections to the Quick Assist service.