RE: Sign-in activity when trying to access a Storage Account

Brass Contributor

What is the most effective KQL query for looking at sign-in activity trying to access a Storage Account from a specific IP address?

2 Replies

Hi @JMSHW0420,

 

maybe this guide could help?

How to query Azure Storage logs in Azure Monitor Log Analytics | Azure Tips and Tricks - YouTube

 

If I have answered your question, please mark your post as Solved

If you like my response, please consider giving it a like

SigninLogs
| where AppDisplayName == "Azure Storage"
| where IPAddress == "x.x.x.x" // Replace 'x.x.x.x' with the specific IP address you want to filter for
| project TimeGenerated, UserPrincipalName, AppDisplayName, IPAddress, Status, LocationDetails

 

If you liked, please click for vote.

Thank you!