Publicly Internet-Facing Devices
Identifies devices that have been observed as being directly exposed to the public internet. This is based on Microsoft Defender for Endpoint's device discovery capabilities. Such devices may be at higher risk of attack and should be reviewed to ensure the exposure is intentional and properly secured.
Microsoft Sentinel (KQL)
