[IC] - Identifying Devices by Vendor based on Inbound Connections
This KQL Query focuses on summarising the number of devices attempting to connect to exposed servers, categorised by vendor, by decoding their MAC addresses. This information can help you to identify unexpected devices vendors, detect virtual devices or correlate specific manufacturers with known threats.
Microsoft Sentinel (KQL)
