Blog Post

Microsoft Sentinel Blog
8 MIN READ

Using external data sources to enrich network logs using Azure storage and KQL

Ashwin_Patil's avatar
Ashwin_Patil
Icon for Microsoft rankMicrosoft
Jun 15, 2020
Network data sources are one of the highest volume data sources hence threat hunting on such data sources becomes often challenging if we do not enrich such datasets. One of the common first steps do...
Updated Nov 02, 2021
Version 3.0
hunting
microsoft sentinel
Secureskydev's avatar
Secureskydev
Copper Contributor
Aug 21, 2020

Ashwin_Patil thank you for the quick response.   I haven't been able to get let/variable to work for externaldata's StorageConnectionString.

 

We "deployed" external data table to enrich IPaddress by joining external tables (via externaldata) for more static data such as country, isp, domain, proxy type,  domain/proxy usage/reputation, etc.  Our analyst/clients are looking for a similar use case to enrich more dynamic data such as IP and URL reputation data within kql queries for dashboards/workbooks and hunting queries.   Our reputation and intel sources (VirusTotal, etc.) and tools (ThreatQ, etc.) are API based and usually require parameters such as IPs such as http://ip-api.com/csv/24.48.0.1fields=status,country,countryCode,regionName,city,zip,lat,lon,isp,org,query

 

We do use jupyter notebook but the team would like the ability to do "inline" queries as well.   

 

Thanks!