Monitoring new network interface connections (USB NICs) via BIOC / XQL — Looking for best practices

[W.Medina624153]

Hi everyone,
I am looking for guidance or community insights on how to monitor and track the connection and usage of networkndevices (especially USB Ethernet adapters, Wi-Fi dongles, and USB tethering) on Windows endpoints.

Our goal is to detect whenever a new network interface is attached/enabled, capture its timestamp, and ideally trigger an alert using a BIOC or Correlation Rule.
So far, I've been trying to inspect the xdr_data dataset (filtering by event_type = DEVICE and looking at PnP/hardware connection events), but I am struggling to extract actionable or granular data regarding network interfaces. Unlike USB mass storage devices, network adapters do not seem to populate clear, usable attributes in xdr_data that allow reliable BIOC rule creation.
Has anyone found a working method or best practice to achieve this within Cortex XDR? Specifically:
 1. Has anyone successfully built a BIOC or Correlation Rule to detect new physical/USB network adapters?
2. Which specific dataset, fields, or XQL queries are you using to capture network interface initialization?
 3. Do you rely on ingesting Windows Event Logs (e.g., Kernel-PnP or TCPIP Event ID 4201) into Cortex via the
agent/Broker VM, or is there native telemetry in the Cortex XDR agent that I might be overlooking?
Any advice, sample queries, or recommendations would be greatly appreciated.
Thanks in advance!

[susekar]

Hello @W.Medina624153 ,

Greetings for the day.

Cortex XDR does not currently provide native EDR/BIOC telemetry to reliably detect the connection or initialization of new physical network adapters, such as USB Ethernet adapters, Wi-Fi dongles, or USB tethering.

• The endpoints dataset reports the currently active network interface/IP and does not retain historical adapter changes.xdr_data provides USB-related events, but these are not designed to track network-adapter lifecycle events.
• Device Control can block supported USB network devices and generate a Device Control Violation event.
• For reliable detection and alerting, Windows Event Logs should be collected and ingested into Cortex XDR.
• With the required XTH capability, logs can be collected directly through the agent. Alternatively, Broker VM/WEC or Cortex XDR Collector can be used.
• Once ingested into microsoft_windows_raw, XQL Correlation Rules can be created to detect relevant adapter events.
  
  

In summary: Native Cortex XDR telemetry has a limitation for historical network-adapter tracking. Windows Event Log collection with XQL correlation is the recommended approach for this use case.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar