Network traffic for Windows Update (Firewall logs)

a_n · ‎06-04-2021

Hello,
I am checking a firewall log (Watchguard firebox) to monitor the network traffic for a windows LAN.
I need to filter out the network load related to Windows Updates.
The watchguard fields do not have sni in all records (sometime I have sni=download.microsoft.com, but sometimes sni is empty but destination IP is always available)

Is there a list of the IPs used for windows update?
( I did not manage to find it)
Is there another way to segregate the windows update traffic from other traffics?

Appreciate if you share your ideas.

Thank you.

a_n · ‎07-14-2021

Hello,

Anyone can advise?

Thank you.

Network traffic for Windows Update (Firewall logs)

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Network traffic for Windows Update (Firewall logs)

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future