Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Enrich DeviceNetworkEvents with the port number Service name information
// Enrich DeviceNetworkEvents with the port number Servicename information
let iana_port_assignments = (externaldata(entry: string ) [@""]
with (format="txt",ignoreFirstRecord=true))
// Service Name,Port Number,Transport Protocol,Description,Assignee,Contact,Registration Date,Modification Date,Reference,Service Code,Unauthorized Use Reported,Assignment Notes
| extend data = parse_csv(entry)
| extend ServiceName = tostring(data[0])
| extend PortNumber = toint(data[1])
| project ServiceName, PortNumber
| summarize any(ServiceName) by PortNumber
| extend ServiceName = any_ServiceName;
| join kind=rightouter (DeviceNetworkEvents
// | where DeviceName contains "DESKTOP-1234"
on $left. PortNumber == $right.RemotePort
| project-away any_ServiceName
| summarize EventCount=count() by PortNumber, ServiceName
| sort by PortNumber asc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment