KQL Search

The query retrieves network protection events from Microsoft 365 Defender. It filters the events based on the ActionType, and in some cases, the InitiatingProcessAccountName. The query also includes parsing and projecting specific fields from the AdditionalFields column. There are separate queries for Defender Network Protection, Defender SmartScreen, and a combination of both. Additionally, there is a query that joins AlertInfo and AlertEvidence tables to retrieve suspicious connection alerts blocked by network protection.