Forum Discussion
Azure Log search - Login search question
Hi,
I do not have Azure AD logs in my env but I can simulate the same thing via Azure Activity logs. The most basic query is this:
AzureActivity | extend httpdata = parse_json(HTTPRequest) | summarize AggregatedValue = dcount(tostring(httpdata.clientIpAddress)) by ResourceId
Don't mind the usage of parse_json that is specific for that log. The most important to notice is that I use dcount() and count it by Resource Id. In your case inside dcount will be the column of the IP address and ResourceId for you will be the user name. You will not get a list of which are IPs but you will get their count. This is the most basic query that should work for the most basic number of results alert.
Mark this reply as answer if it has helped you.
Hi,
I do not have Azure AD logs in my env but I can simulate the same thing via Azure Activity logs. The most basic query is this:
AzureActivity | extend httpdata = parse_json(HTTPRequest) | summarize AggregatedValue = dcount(tostring(httpdata.clientIpAddress)) by ResourceId
Don't mind the usage of parse_json that is specific for that log. The most important to notice is that I use dcount() and count it by Resource Id. In your case inside dcount will be the column of the IP address and ResourceId for you will be the user name. You will not get a list of which are IPs but you will get their count. This is the most basic query that should work for the most basic number of results alert.
Mark this reply as answer if it has helped you.
One last question. Using the method you gave me I get the total count of different IPs the sign-ins are coming from for a user, is there a way to also display the actual IPAddresses and not just the user and count?
Here is what I got that gives me the count, can something be added that shows the IPs related to the aggregatedvalue?
SigninLogs
| where ResultType == "0"
| summarize AggregatedValue = dcount(IPAddress) by UserPrincipalName
| where AggregatedValue > 5
Hi,
That is possible as well but you need to verify if the alert will work. Alerts require specific things like AggregatedValue for example.
The example query will be:
AzureActivity | extend httpdata = parse_json(HTTPRequest) | summarize IpList = makeset(tostring(httpdata.clientIpAddress)) by ResourceId | extend AggregatedValue = array_length(IpList) | sort by AggregatedValue desc
In your case:
SigninLogs | where ResultType == "0" | summarize IpList = makeset(IPAddress) by UserPrincipalName | extend AggregatedValue = array_length(IpList) | where AggregatedValue > 5
- Perfect that worked. Thank you very much!