Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Defender for Endpoint supports network connection monitoring from different levels of the network stack. A challenging case is when the network uses a forward proxy as a gateway to the Internet.
The proxy acts as if it was the target endpoint. When a forward proxy acts as the target endpoint, simple network connection monitors audit the connections with the proxy that is correct but has lower investigation value.
Defender for Endpoint supports advanced HTTP level monitoring through network protection. When network protection is turned on, a new type of event is surfaced that exposes the real target domain names.
Use network protection to monitor connections behind a forward proxy or firewall
Monitoring network connection behind a forward proxy is possible due to other network events that originate from network protection. To see these network events on a device timeline, turn on network protection (at the minimum in audit mode).
Network protection can be controlled using the following modes:
- Block: Users or apps are blocked from connecting to dangerous domains. You'll be able to see this activity in the Defender portal.
- Audit: Users or apps won't be blocked from connecting to dangerous domains. However, you'll still see this activity in the Defender portal.
If you turn off network protection, users or apps won't be blocked from connecting to dangerous domains. You won't see any network activity in Microsoft Defender XDR.
If you don't configure it, network blocking is turned off by default.
For more information, see Enable network protection.
How network protection reveals real targets behind forward proxies
When network protection is turned on, a device's timeline shows the proxy IP address while also displaying the real target address.
Additional network protection connection events are available to surface the real domain names even behind a proxy.
Event's information:
Hunt for connection events using advanced hunting
The network protection connection events are also available through advanced hunting. You can find them in the DeviceNetworkEvents table under the ConnectionSuccess action type.
The following query returns all relevant ConnectionSuccess events:
DeviceNetworkEvents
| where ActionType == "ConnectionSuccess"
| take 10
You can also filter out events that are related to connection to the proxy itself.
Use the following query to filter out the connections to the proxy:
DeviceNetworkEvents
| where ActionType == "ConnectionSuccess" and RemoteIP != "ProxyIP"
| take 10