ExploitGuard & SmartScreen Network Protection Detection
This rule detects network traffic blocked by Microsoft Defender Exploit Guard Network Protection or SmartScreen. It categorizes these detections into several types: Indicator of Compromise (IoC) URLs, Web Content Filtering, Malicious/Command & Control, and Cloud App Security Broker (CASB) policy violations. The rule summarizes these events per device, providing counts for each detection category and listing the blocked URLs with timestamps.
Microsoft Sentinel (KQL)
