How to Find Azure Resources with Public IP Addresses

Below is a resource graph KQL query to list all Public IPs with attached resource details for each. Also VM Details attached details If attached resource type is NIC.

It’s not neat as it should be, but at least it get the details:

Resources
| join kind=inner  
    (resourcecontainers 
    | where type == 'microsoft.resources/subscriptions' 
    | project SubscriptionName=name, subscriptionId
    )
    on subscriptionId 
| where type == 'microsoft.network/publicipaddresses'
| where SubscriptionName startswith "ag-azr-"
| project
    PIP_LOC = location,
    PIP_SUB = SubscriptionName,
    PIP_RG = resourceGroup, 
    PIP_Name = name,
    PIP_skuName = sku.name,
    PIP_skuTier = sku.tier,
    PIP_zones = zones,
    PIP_ddos = properties.ddosSettings.protectionMode,
    publicIPAllocationMethod = properties.publicIPAllocationMethod,
    publicIPAddressVersion = properties.publicIPAddressVersion,
    ipAddress = properties.ipAddress,
    Attched_resourceID = tolower(split(properties.ipConfiguration.id, '/ipConfigurations')[0]), 
    Attched_resourceName = split(properties.ipConfiguration.id, '/')[8],
    Attched_resourceRG = split(properties.ipConfiguration.id, '/')[4],
    Attched_resourceType = strcat(split(properties.ipConfiguration.id, '/')[6], "/", split(properties.ipConfiguration.id, '/')[7])
| join kind=leftouter  
    (resources
    | where type == "microsoft.network/networkinterfaces"
    | project Attched_resourceID = tolower(id),
      VMID = properties.virtualMachine.id
    )
    on Attched_resourceID 
| project-away Attched_resourceID1
| extend VM_RG = split(VMID, '/')[4]
| extend VM_Name = split(VMID, '/')[8]

The query is ugly, but I think it works. It matches IPv4 without RFC1918 private addresses. To be precise, it matches more than just IPv4 (.e.g. 0.999.999.999), but I think it should do the trick here.

resources
| where properties matches regex @'\b[0-9]\.\d{1,3}\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b1[1-9]\.\d{1,3}\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b[2-9][0-9]\.\d{1,3}\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b1[0-6][0-9]\.\d{1,3}\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b171\.\d{1,3}\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b172\.3[3-9]\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b172\.[4-9][0-9]\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b17[3-9]\.\d{1,3}\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b18[0-9]\.\d{1,3}\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b19[0-1]\.\d{1,3}\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b192\.[0-9]\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b192\.[1-9][0-9]\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b192\.1[0-5][0-9]\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b192\.16[0-7]\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b192\.169\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b192\.1[7-9][0-9]\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b192\.2[0-5][0-9]\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b19[3-9]\.\d{1,3}\.\d{1,3}\.\d{1,3}\b' or
properties matches regex @'\b2[0-5][0-9]\.\d{1,3}\.\d{1,3}\.\d{1,3}\b'
|project  name, type, location, resourceGroup, subscriptionId, properties

Hi @wernerrall

Could you advise the query you would need to check for all non rfc1918 addresses.

0.0.0.0 - 9.255.255.255

11.0.0.0 - 171.255.255.255

172.33.0.0 - 192.167.255.255

192.169.0.0 - 255.255.255.255

I have tried this... 

Thanks in advance

JohnTie Thank you for the questions! Easiest way to interpret the properties are to understand which resources contain which properties. A VM would for example have a different set of IP Properties than a SQL Database or a Load Balancer. Our documentation for each of the technologies would explain it better. 

By learning about the IP properties it would also expand your understanding on how to possibly protect them. 

In our MS Security Documentation we have articles like Azure security baseline for Azure Public IP | Microsoft Docs which explains very carefully how to protect al types of resources. Hope this helps!

wernerrall Thanks for this article - very helpful. I'm relatively new to Azure. Any tips for how to interpret the properties output generated by the query? For example an I see non private IP addresses next to words like 

possibleInboundIpAddresses

destinationAddresses

nexthopIPAddress

If it was you, what would you do next when you have your output, to test whether the IPs are IPs which are truly public (and attackable)?

Thanks!

guidovbrakel That works great for VMs, the problem comes in when the "type" for an IP is not called publicipaddresses (I saw this in a few other resources). Not an easy way to get Sub Names so for specific subscription names I use the Graph Explorer "Scope" filter to choose my subscription. I am sure a join could be completed which will show the names. Will keep this in mind. Thanks

Wouldn't it be easier to just query for the resource type: microsoft.network/publicipaddresses. How can we integrate the subscriptionname in this query? wernerrall