How to use Defender Endpoint to find versions of SSL and TLS on the network

Question

I'd like to use Defender Endpoint to identify all open SSL and TLS ports, and the versions of SSL and TLS on them, on the network covered by Defender Endpoint. Can that be done with a Kusto query? If so, what is the query? I've been looking in the query interface itself, plus Github and web searches and can't find anything.

Or, is there another way of finding that information in the Defender Endpoint web interface?

Thanks

Answer 1

@PCVan Thanks for reaching out and apologies for delay. I checked this in my setup.

We do not do packet level analysis to find the cryptographic HTTPS connections. The most you can see is if the connection was HTTPS or HTTP and the port 443 if HTTPS and porta 80 if HTTP. You will not be able to find the SSL, or TLS version with this.

That kind of information needs in depth network monitoring tools.
Currently you will be able to get port number pertaining to HTTPS or HTTP :

-----------------------------------------------------------------------------------------------------------------

If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.