Suspicious Inbound Connection Attempts to Internet-Facing Devices

Subash Ghimire@iamsubashg

•updated Aug 14, 2026•30•0•93

This KQL query identifies potentially suspicious inbound connection attempts to internet-facing devices. It filters and correlates data from DeviceInfo (device metadata) and DeviceNetworkEvents (network activity) to pinpoint external threats based on multiple connection attempts (3+) from the same public IP address. It also provides geographical context for the source of threats.