// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Hosts that ran a self-hosted analytics or BI server in the last 30 days,
// and how many public IP addresses connected to them in the last 7 days.
let AnalyticsHosts = DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where ProcessCommandLine has_any ("metabase.jar", "superset", "redash", "grafana-server")
    | summarize Commands = make_set(ProcessCommandLine, 3), LastSeen = max(Timestamp)
        by DeviceId, DeviceName;
let Exposure = DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where DeviceId in (AnalyticsHosts | project DeviceId)
    | where ActionType == "InboundConnectionAccepted" and RemoteIPType == "Public"
    | summarize PublicSources = dcount(RemoteIP), Ports = make_set(LocalPort, 10) by DeviceId;
AnalyticsHosts
| join kind=leftouter Exposure on DeviceId
| project DeviceName, LastSeen, PublicSources = coalesce(PublicSources, 0), Ports, Commands
| order by PublicSources desc