Query

MicrosoftGraphActivityLogs
| extend GeoIPInfo = geo_info_from_ip_address(IPAddress)
| extend country = tostring(parse_json(GeoIPInfo).country), state = tostring(parse_json(GeoIPInfo).state), city = tostring(parse_json(GeoIPInfo).city), latitude = tostring(parse_json(GeoIPInfo).latitude), longitude = tostring(parse_json(GeoIPInfo).longitude)
| project-reorder IPAddress, country, state, RequestUri

About this query

MicrosoftGraphActivityLogs IP Enrichment

Query Information

Description

The IP information can be enriched using the geo_info_from_ip_address() function, which returns the country, state, city, latitude and longitude of each IPv4 and IPv6 address.

References

https://learn.microsoft.com/en-us/graph/microsoft-graph-activity-logs-overview#what-data-is-available-in-the-microsoft-graph-activity-logs

Sentinel

Explanation

This query is designed to enhance the data from Microsoft Graph Activity Logs by adding geographical information based on IP addresses. Here's a simple breakdown of what it does:

Data Source: It starts with data from MicrosoftGraphActivityLogs, which contains logs of activities from Microsoft Graph.
IP Enrichment: The query uses a function called geo_info_from_ip_address() to gather geographical details for each IP address in the logs. This function provides information such as the country, state, city, latitude, and longitude associated with each IP address.
Extracting Geo Information: The query extracts specific geographical details (country, state, city, latitude, and longitude) from the enriched data and assigns them to new fields.
Reordering Columns: Finally, it rearranges the columns to display the IP address, country, state, and request URI in a specific order.

In summary, this query enriches the activity logs with geographical information based on IP addresses and organizes the output to make it easier to analyze the location-related data.

KQL Search