Microsoft Defender XDR Blind Spot Can Hide Public Connections Behind FourToSixMapping

Security teams relying on Microsoft Defender XDR’s DeviceNetworkEvents table for hunting and detection may be missing critical external network connections due to a lesser-known IP address classification quirk. The issue centers on FourToSixMapping, a RemoteIPType value that can cause public…

appeared first on IT Security News.