Public IP Operations

%3CLINGO-SUB%20id%3D%22lingo-sub-3245681%22%20slang%3D%22en-US%22%3EPublic%20IP%20Operations%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3245681%22%20slang%3D%22en-US%22%3E%3CP%3EFor%20the%20purposes%20of%20alerting%20when%20something%20has%20happened%20concerning%20a%20public%20IP%2C%20for%20example%2C%20a%20Public%20IP%20address%20was%20associated%20with%20a%20resource%20(NIC%2C%20Load%20Balancer%2C%20etc.)%2C%20shouldn't%20this%20work%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAzureActivity%3C%2FP%3E%3CP%3E%7C%20where%26nbsp%3BOperationNameValue%20%3D%3D%20%40%22Microsoft.Network%2FpublicIPAddresses%2Fjoin%2Faction%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIt%20is%20the%20literal%20definition%20here%3A%26nbsp%3B%3C%2FP%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-network%2Fip-services%2Fvirtual-network-public-ip-address%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Fvirtual-network%2Fip-services%2Fvirtual-network-public-ip-address%3C%2FA%3E%3C%2FP%3E%3CP%3EMicrosoft.Network%2FpublicIPAddresses%2Fjoin%2Faction%20-%20Associate%20a%20public%20IP%20address%20to%20a%20resource%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Ebut%20yet%2C%20the%20event%20(me%2C%20associating%20a%20public%20IP%20to%20a%20VM's%20nic)%20shows%20up%20under%20%22Microsoft.Network%2FnetworkInterfaces%2Fwrite%22%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EMy%20question%20is%2C%20what%20is%20the%20Operation%20that%20I%20need%20to%20evaluate%20for%20if%20I%20want%20to%20see%20if%20a%20Public%20IP%20was%20associated%2Fdisassociated%20with%20a%20resource%20(regardless%20of%20the%20resource)%3F%26nbsp%3B%3C%2FP%3E%3CP%3EIdeally%20not%20just%20associations%20and%20dissassociations%2C%20but%20also%20creation%2C%20deletion%2C%20etc.%3C%2FP%3E%3CP%3EThese%20do%20seem%20to%20work%3A%3C%2FP%3E%3CP%3E%40%22Microsoft.Network%2FpublicIPAddresses%2Fread%22%2C%20%40%22Microsoft.Network%2FpublicIPAddresses%2Fwrite%22%2C%20%40%22Microsoft.Network%2FpublicIPAddresses%2Fdelete%22%20but%20I%20care%20most%20about%26nbsp%3Bassociations%20and%20dissassociations.%3C%2FP%3E%3CP%3EThanks!%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-3245681%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAnalytics%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EDetection%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EKQL%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EMonitoring%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Contributor

For the purposes of alerting when something has happened concerning a public IP, for example, a Public IP address was associated with a resource (NIC, Load Balancer, etc.), shouldn't this work?

 

AzureActivity

| where OperationNameValue == @"Microsoft.Network/publicIPAddresses/join/action"

 

It is the literal definition here: 

https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/virtual-network-public-ip-address

Microsoft.Network/publicIPAddresses/join/action - Associate a public IP address to a resource

 

but yet, the event (me, associating a public IP to a VM's nic) shows up under "Microsoft.Network/networkInterfaces/write"

 

My question is, what is the Operation that I need to evaluate for if I want to see if a Public IP was associated/disassociated with a resource (regardless of the resource)? 

Ideally not just associations and dissassociations, but also creation, deletion, etc.

These do seem to work:

@"Microsoft.Network/publicIPAddresses/read", @"Microsoft.Network/publicIPAddresses/write", @"Microsoft.Network/publicIPAddresses/delete" but I care most about associations and dissassociations.

Thanks!

 

5 Replies
Moreover, I found this in "Hunting":

let OperationNames = dynamic(["microsoft.compute/virtualMachines/write", "microsoft.resources/deployments/write"]);
AzureActivity
// We look for any Operation that modified and then was accepted or succeeded where a publicipaddress component is referenced
| where OperationNameValue in~ (OperationNames)
| where ActivityStatusValue has_any ("Succeeded", "Accepted")
| where Properties contains "publicipaddress"

It does not work at all as far as showing association/dissassociation of a public IP to a VM's NIC that I just performed like 20 minutes ago

@rafaelruales 

 

AzureActivity
| where ResourceProvider == "Microsoft.Network"
| where OperationName == "Create or Update Public Ip Address"

@Clive_Watson 

Thanks Clive, I am not sure why this is, but I am getting null (empty) for both columns. I don't think it's a permissions issue, since I am a contributor in the sub. where this log analytics workspace is located.

Sorry I'm not sure, I do have workbook which also used ARG for extra data.
Its not been updated for a while but may help with Public IP. https://github.com/clivewatson/KQLpublic/tree/master/KQL%2FWorkbooks%2FPublicIP
Thanks, Will take a look