Unable to find the public IP addresses in logs

%3CLINGO-SUB%20id%3D%22lingo-sub-1474312%22%20slang%3D%22en-US%22%3EUnable%20to%20find%20the%20public%20IP%20addresses%20in%20logs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1474312%22%20slang%3D%22en-US%22%3E%3CP%3EI%20want%20to%20gather%20all%20the%20public%20IP%20addresses%20for%20my%20subscription%20using%20Log%20analytics.%3C%2FP%3E%3CP%3EI%20am%20unable%20to%20find%20information%20related%20to%20this.%3C%2FP%3E%3CP%3EI%20am%20able%20to%20get%20the%20logs%20for%20creation%20and%20deletion%20of%20public%20IP%20addresses%20but%20they%20also%20do%20not%20contain%20any%20value%20for%20the%20public%20IP%20address.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1474312%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAzure%20Sentinel%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Eip%20address%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ELog%20Analytics%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1474346%22%20slang%3D%22en-US%22%3ERe%3A%20Unable%20to%20find%20the%20public%20IP%20addresses%20in%20logs%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1474346%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F693835%22%20target%3D%22_blank%22%3E%40uditk14%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EYou%20often%20need%20a%20combination%20of%20Tables%2C%20like%20AzureActivity%20and%26nbsp%3B%3C%2FP%3E%0A%3CDIV%3E%0A%3CDIV%3E%3CSPAN%3EAzureNetworkAnalytics_CL%20takes%20a%20look%20at%20the%20first%26nbsp%3Btwo%20examples%20here%20for%20some%20ideas%20%3A%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3CDIV%3E%3CSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Ftree%2Fmaster%2FHunting%2520Queries%2FMultipleDataSources%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FAzure%2FAzure-Sentinel%2Ftree%2Fmaster%2FHunting%2520Queries%2FMultipleDataSources%3C%2FA%3E%3C%2FSPAN%3E%3C%2FDIV%3E%0A%3C%2FDIV%3E%3C%2FLINGO-BODY%3E
Occasional Contributor

I want to gather all the public IP addresses for my subscription using Log analytics.

I am unable to find information related to this.

I am able to get the logs for creation and deletion of public IP addresses but they also do not contain any value for the public IP address.

 

 

1 Reply

@uditk14 

 

You often need a combination of Tables, like AzureActivity and 

AzureNetworkAnalytics_CL takes a look at the first two examples here for some ideas :