// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// File servers rarely need to open connections to the internet. List every public destination they reached.
// Expect update, Defender and backup traffic at first; add reviewed destinations to Expected.
let Since = ago(30d);
let FileServers = dynamic(["REPLACE_WITH_FILE_SERVER_1", "REPLACE_WITH_FILE_SERVER_2"]);
let Expected = dynamic(["REPLACE_WITH_REVIEWED_DOMAIN"]);
DeviceNetworkEvents
| where Timestamp > Since
| where DeviceName has_any (FileServers)
| where ActionType == "ConnectionSuccess" and RemoteIPType == "Public"
| where not(RemoteUrl has_any (Expected))
| summarize Connections = count(), Ports = make_set(RemotePort, 10),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl
| order by Connections desc
| take 500