KQL Search

This query is looking at network events on devices and filtering them based on specific criteria:

1. It checks for events where the initiating process (the process that started the network activity) is "wscript.exe".
2. It further filters these events to only include those where the remote IP address is of the type "Public".
3. Finally, it excludes events where the remote URL ends with ".entrust.net".

In simple terms, the query is identifying network activities initiated by "wscript.exe" that are connecting to public IP addresses, but excluding connections to URLs ending in ".entrust.net".