Skip to content
Have I Been Squatted logo Have I Been Squatted logo Have I Been Squatted Docs

Network Intelligence guide

Network Intelligence shows which domains your users and devices reach, and which of those your network controls blocked. Have I Been Squatted reads telemetry from a connected provider, counts it per destination per hour, and evaluates network rules on each new record as it lands.

Blocking connectors such as Cloudflare Zero Trust and Microsoft Defender for Endpoint stop traffic to lookalike domains. Network Intelligence closes the loop: it shows whether anyone tried to reach a domain, and whether the block held.

Connect a source

Section titled “Connect a source”
Microsoft Defender Network Intelligence Defender for Endpoint connections, network protection blocks, and SmartScreen warnings, read every 15 seconds.
Cloudflare Gateway Network Intelligence Gateway DNS analytics: which domains your users resolved and which Gateway blocked, read every minute.

Each organization can connect one tenant or account per source. Both sources can be connected together. Each record carries the provider that produced it.

What a record holds

Section titled “What a record holds”

A record counts the traffic from one source to one destination within one hour, in Coordinated Universal Time (UTC). It stores:

  • Destination: the registrable domain reached, such as example.com, or the IP address when no host was named.
  • Kind: what the hour counts. Cloudflare Gateway records count DNS queries (dns). Microsoft Defender records count connections (flow).
  • Hits, allowed hits, and blocked hits: how often the destination was reached, and how often the provider allowed or blocked it.
  • Hosts and IP addresses: a sample of the host names under the destination and the addresses reached.
  • First and last seen: the earliest and latest traffic within the hour.

The provider owns the counts. Each read replaces the counts for the hours it covers, so a record converges on the provider’s totals as late telemetry arrives. Records are kept for 90 days.

Data boundary

Section titled “Data boundary”

Network Intelligence stores destinations and counts, not activity by person or device. It doesn’t store device names, user names, internal source addresses, or full URLs. The provider pages describe exactly what each source reads.

Dashboard

Section titled “Dashboard”

Open Network Intelligence under Detection in the application sidebar.

The Overview shows:

  • Destinations, Connections, and Blocked over the past 14 days, and New destinations over the past 24 hours.
  • Network activity: allowed and blocked connections per hour over the past 7 days.
  • New destinations: destinations reached in the past 24 hours that were not reached in the 30 days before.
  • Most reached: destinations with the most connections in the past 14 days. Operating system update and telemetry services are left out, so the list isn’t dominated by them.
  • Most blocked: destinations your network controls blocked most in the past 14 days.

The Events tab lists the records for one UTC day: hour, destination, kind, source, hosts, IP addresses, and hit counts. Filter it with an Upsilon query over network.* fields, then open the query as a new rule.

network.destination:*paypa1* AND network.allowed_hits:>0

If a connected source fails, the dashboard shows an alert that names the source and the failure. The connector page has the details.

Network rules

Section titled “Network rules”

The network namespace reads Network Intelligence records. See Network signals for the fields.

network.subject:examp1e.com AND network.allowed_hits:>0

Network rules differ from Email and Canary rules in three ways:

  • They read only Network. A rule that combines network.* conditions with Domain, Email, or Canary conditions can’t be saved.
  • They run as records land. A record is evaluated when it’s first written for its hour, and again when an hour that was only blocked gains an allowed hit. A rule doesn’t search back over older records. The builder’s Time window applies to the Matched results preview only.
  • Their alerts belong to the destination. A network alert names the destination domain the rule matched, not a monitored domain.

Network rules can notify through Slack, webhooks, and the SIEM connectors. Blocking, annotation, and takedown responses act on cited lookalike domain records, so they need a Domain condition and aren’t available on network rules. An alert’s evidence opens on the Network source with the records that matched.

Common checks

Section titled “Common checks”

No dashboard data

Section titled “No dashboard data”
  • Confirm a source is connected and enabled on its connector page, and that its status isn’t failing.
  • Allow for provider delay. In testing, Defender for Endpoint made connection events available to Advanced Hunting 3 to 12 minutes after the traffic.
  • For Microsoft Defender, confirm devices are onboarded to Defender for Endpoint.
  • For Cloudflare Gateway, confirm DNS queries reach Gateway, from devices running the Cloudflare One client or from a Gateway DNS location.

A rule didn’t alert

Section titled “A rule didn’t alert”
  • Check that the rule is enabled.
  • Network rules evaluate records as they land. Traffic from before the rule was enabled doesn’t raise an alert, unless a later read writes a new record for that destination.