Top 10 users with the most ips used to succesfully sign in
Top10users With The Most Sign In I Ps Used
Query
AADSignInEventsBeta
| summarize IPsUsed = make_set(IPAddress), locations = make_set(Country) by AccountObjectId
| extend CountIP = array_length(IPsUsed)
| project-reorder CountIP
| top 10 by CountIPAbout this query
Top 10 users with the most ips used to succesfully sign in
Query Information
Description
Collect the top 10 user with the most IP used to succefully sign in to a tenant. This query displays the 10 users that have used the most IP addresses so sign in.
False positives can be a VPN that changes IP addresses, which results in a high number of IPs used to sign in.
Risk
The risk is that an actor uses an rare IP address to sign into your tenant.
Defender XDR
Sentinel
SigninLogs
| summarize IPsUsed = make_set(IPAddress), locations = make_set(LocationDetails) by Identity
| extend CountIP = array_length(IPsUsed)
| project-reorder CountIP
| top 10 by CountIP
Explanation
This query is designed to identify the top 10 users who have signed in from the most different IP addresses. Here's a simple breakdown of what the query does:
-
Data Source: It uses sign-in event logs from two different systems, Defender XDR and Sentinel, to analyze user sign-in activity.
-
Summarization: For each user, it collects a list of unique IP addresses from which they have successfully signed in. It also gathers the locations associated with these IP addresses.
-
Count Calculation: It calculates the total number of unique IP addresses used by each user.
-
Ranking: It sorts the users based on the number of unique IP addresses they have used, in descending order.
-
Top 10 Selection: Finally, it selects the top 10 users who have used the most different IP addresses to sign in.
The query helps identify users with unusual sign-in patterns, such as using many different IP addresses, which could indicate potential security risks like unauthorized access or the use of VPNs that frequently change IP addresses.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators