User location in Security Alerts/Incidents logs

Question

Dear Community,I´ve been struggling to find a way to pull out location information for user in security incidents logs. The idea is to have this details on alerts and incidents to generate dashboards (workbooks) and reports. Would you be able to enlight me with ideas/insights?Thanks in advance for your help.

clive_watson · Answer

hello, if you have an ip address you can try this command to get the location from that source https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/geo-info-from-ip-address-function

luizgomesjr · Answer

Thanks Clive, will look into it.

Forum Discussion

User location in Security Alerts/Incidents logs

Share

Resources