[IC] - Identifying methods used to establish secure communication over insecure channels
In this case, I have been researching about the 'curve' value into AdditionalFields field of DeviceNetworkEvents table which I identified into iana.org as two groups 'Elliptic curve' and 'Diffie-Hellman groups'. These 2 kinds of encryption groups work to secure communication over an insecure channel, are classified by Internet Assigned Numbers Authority (IANA), as if are 'recommended' and the Datagram Transport Layer Security status. In addition, to take into account, the mentioned site mention: "If an item is not marked as 'Recommended', it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases" Therefore, this KQL Query is oriented to identify if the current encryption to secure your communications is enough or if due to the level of sensitive of your information, would need to be reviewed.
Microsoft Sentinel (KQL)
