Function: ListPublicIPs()
List Public I Ps
Query
let ListPublicIPs = arg("").Resources
| where type == "microsoft.network/publicipaddresses"
| extend ipAddress = tostring(properties.ipAddress), publicIPAllocationMethod = tostring(properties.publicIPAllocationMethod)
| where isnotempty(ipAddress)
| distinct ipAddress;
ListPublicIPsAbout this query
Function: ListPublicIPs()
Query Information
Description
List all public IPs that are returned by Azure Resource Graph. This can be used for enrichment or filtering.
References
- https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview
- https://learn.microsoft.com/en-us/azure/governance/resource-graph/samples/starter?tabs=azure-portal
Log Analytics (Sentinel)
Explanation
The query "ListPublicIPs()" retrieves a list of all public IP addresses returned by Azure Resource Graph. It can be used to enrich or filter data. The query filters for resources of type "microsoft.network/publicipaddresses" and extracts the IP address and allocation method. It then removes any empty IP addresses and returns a distinct list of IP addresses.
Details
Bert-Jan Pals
Released: September 22, 2023
Tables
microsoft.network/publicipaddresses
Keywords
DevicesIntuneUser
Operators
argResourceswheretype=="microsoft.network/publicipaddresses"extendipAddresstostringproperties.ipAddresspublicIPAllocationMethodisnotemptydistinct