Successful network connections towards SpamHaus's DROP ranges, excluding common browsers as client

gistfile1.txt

// This is a prototype, do not run against long periods before tuning 
let SpamHausDROP = externaldata(cidr: string) [@"https://www.spamhaus.org/drop/drop_v4.json"] with (format="json", ignoreFirstRecord=False);
DeviceNetworkEvents
| where LocalIPType == 'Private' and RemoteIPType == 'Public'and ActionType == 'ConnectionSuccess'
| where not(InitiatingProcessFileName has_any ('chrome.exe','firefox.exe','msedge.exe','brave.exe'))
| evaluate ipv4_lookup(SpamHausDROP, RemoteIP, cidr, return_unmatched = false)
| where isnotempty(cidr)
| summarize InitiatingProcessCommandLine=make_set(InitiatingProcessCommandLine), RemoteUrl=make_set(RemoteUrl), LastSeen=max(Timestamp) by RemoteIP