Forum Discussion

Denys_bezshkuryi's avatar
Denys_bezshkuryi
Copper Contributor
Jul 24, 2023

Log Analytics query the logs that are not in IP range

Hi All,

 

I'm struggling with writing a query that will find sign-ins in logs that are not in IP ranges.

So we have Log Analytics Workplace which is collecting sign-in logs. And we want to trigger an alert when an account is signed in from an IP that is not in one of our IP ranges.
We have a lot of known network rages and we have to use an external repository like github with a txt file of those rages. 

I've tried to use the function "ipv4_is_match()", but from my understanding, it's looking just like to like, but not looking foreach.
That being said I've tried something like this, but it doesn't work. Does anyone experienced here can help with writing such a query, or even answer if it's possible?

let ipList = externaldata (IPAddress:string) [
@"https://raw.githubusercontent.com/NameOfRepository/IPv4Range.txt"
];
SigninLogs
| where UserPrincipalName contains "email address removed for privacy reasons"
| where IsInteractive == true
| where not (ipv4_is_match(IPAddress , ipList)

 

No RepliesBe the first to reply

Resources