// sigma convert -t kusto -p microsoft_365_defender. NOT run against a live tenant. Replace the 192.0.2.10 placeholder.
// ===== net_firewall_netscaler_console_public_source.yml (-p microsoft_365_defender)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== netscaler_adc_command_from_console.yml (-p microsoft_365_defender)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== netscaler_console_deviceconfig_command.yml (-p microsoft_365_defender)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== netscaler_console_password_recovered_default.yml (-p microsoft_365_defender)
// NOT CONVERTED: this pipeline has no table mapping for the rule's logsource. Use the matching KQL hunt instead.

// ===== win_net_netscaler_console_connection.yml (-p microsoft_365_defender)
DeviceNetworkEvents
| where RemoteIP =~ "192.0.2.10"

