RE: Sign-in activity when trying to access a Storage Account

Question

What is the most effective KQL query for looking at sign-in activity trying to access a Storage Account from a specific IP address?

cyb3rmik3 · Answer

Hi&nbsp;JMSHW0420,&nbsp;maybe this guide could help?How to query Azure Storage logs in Azure Monitor Log Analytics | Azure Tips and Tricks - YouTube&nbsp;If I have answered your question,&nbsp;please mark your post as SolvedIf you like my response,&nbsp;please consider giving it a like

raphaelcustodiosoares · Answer

SigninLogs
| where AppDisplayName == "Azure Storage"
| where IPAddress == "x.x.x.x" // Replace 'x.x.x.x' with the specific IP address you want to filter for
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Status, LocationDetails
&nbsp;If you liked, please click for vote.Thank you!&nbsp;&nbsp;

Forum Discussion

RE: Sign-in activity when trying to access a Storage Account

2 Replies

Resources