External Access
Query
//This is an example line of KQL query for external data retrieval.
//This example queries IP-API with an IP address and returns country, region, regionName, and city.
//This is a way to do this while developing a KQL query in the Logs blade.
//You can also do this (IP-API query) with a Playbook to add additional context to an Incident in the comments
//See: https://secureinfra.blog/2020/09/03/how-to-add-geographical-data-for-ip-addresses-to-an-azure-sentinel-incident/
externaldata(status:string, country:string, countryCode:string, region:string, regionName:string, city:string, zip:string, lat:string, lon:string, timezone:string, isp:string, org:string, as:string)[@"http://ip-api.com/json/174.98.173.42"] with(format="json")Explanation
This KQL query retrieves geographical and organizational information about a specific IP address from an external data source. It uses the IP-API service to get details such as the country, region, city, and more for the IP address "174.98.173.42". The data is fetched in JSON format and includes fields like country, region, city, latitude, longitude, and internet service provider (ISP) details. This type of query can be useful for adding context to security incidents, such as in Azure Sentinel, by providing additional geographical information about IP addresses involved in the incidents.
Details
Rod Trent
Released: April 24, 2024
Tables
No tables are used in this query.
Keywords
ExternaldataCountryRegionRegionNameCityZipLatLonTimezoneIspOrgAs
Operators
externaldatawith