Forum Discussion
RE: Sign-in activity when trying to access a Storage Account
What is the most effective KQL query for looking at sign-in activity trying to access a Storage Account from a specific IP address?
SigninLogs
| where AppDisplayName == "Azure Storage"
| where IPAddress == "x.x.x.x" // Replace 'x.x.x.x' with the specific IP address you want to filter for
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Status, LocationDetails
If you liked, please click for vote.
Thank you!