Skip to content
Sign In
Telemetry

edr:mde DeviceNetworkEvents:InboundConnectionAccepted

DeviceNetworkEvents / InboundConnectionAccepted

Log source
Microsoft Defender for Endpoint device tables
Host type
EDR sensors (product telemetry, cross-platform)
Tier, host type
Listed
Techniques
0
Rules depending on it
Microsoft Sentinel 1

Why this tier

By role

RoleTierBasis
Windows workstationEDR pathListed
Windows member serverEDR pathListed
Windows domain controllerEDR pathListed
Windows web server (IIS), internet-facingEDR pathListed
Linux serverEDR pathListed
Linux web server, internet-facingEDR pathListed
macOS endpointEDR pathListed

Techniques it helps detect

No ATT&CK analytic names this event. Its standing comes from the standards and rules below.

Rules that depend on it

Microsoft Sentinel 1

Dataset version 0.5.3, built 2026-11-08, from public sources only. Vendor rule names, requirement text and ATT&CK content are reproduced as published; the links between them are the authors' analysis. See the references for each source, its version and its license.