Forum Discussion
Solved
Search Incidents for entries from an IP Range
Hi, I'm trying to perform some retrospective investigations and would like to be able to list any Sentinel Incident that contained an entity from a specific IP range. I'm not great at KQL, so tryin...
let rangeToCheck = "10.0.0.1/24"; SecurityIncident | summarize arg_max(TimeGenerated,*) by IncidentNumber | extend Alerts = extract("\\[(.*?)\\]", 1, tostring(AlertIds)) | mv-expand AlertIds to typeof(string) | join ( SecurityAlert | extend AlertEntities = parse_json(Entities) | mv-expand AlertEntities | where isnotempty(AlertEntities) | where AlertEntities.Type == "ip" | extend EntityIP = tostring(AlertEntities.Address) | extend EntityType = tostring(AlertEntities.Type) | extend inRange = ipv4_is_in_range(EntityIP, rangeToCheck) ) on $left.AlertIds == $right.SystemAlertId | project IncidntName = Title, IncidentNumber=IncidentNumber, inRange, EntityIP, EntityType, AlertId = AlertIds, AlertName = AlertName
Hi Clive_Watson,
Thankyou very much for your code example - this is fantastic and educational.
I'd like to bolt on to this, the incident number & Title that the entity featured in.
Would I need to use a join - like this? (Not my code - taken from the pre-loaded queries):
AlertEvidence
| join AlertInfo on AlertId
| project Timestamp, AlertId, Title, Category , Severity , ServiceSource , DetectionSource , AttackTechniques
let rangeToCheck = "10.0.0.1/24";
SecurityIncident
| summarize arg_max(TimeGenerated,*) by IncidentNumber
| extend Alerts = extract("\\[(.*?)\\]", 1, tostring(AlertIds))
| mv-expand AlertIds to typeof(string)
| join
(
SecurityAlert
| extend AlertEntities = parse_json(Entities)
| mv-expand AlertEntities
| where isnotempty(AlertEntities)
| where AlertEntities.Type == "ip"
| extend EntityIP = tostring(AlertEntities.Address)
| extend EntityType = tostring(AlertEntities.Type)
| extend inRange = ipv4_is_in_range(EntityIP, rangeToCheck)
) on $left.AlertIds == $right.SystemAlertId
| project IncidntName = Title, IncidentNumber=IncidentNumber, inRange, EntityIP, EntityType, AlertId = AlertIds, AlertName = AlertName- WOOOAH - You've done it!!
That's is AMZING Clive_Watson!!
Thanks so much - I will learn where I was going wrong (Everywhere!! :):):) )