Devices In Subnet - IPAddressV6

Description

This query surfaces devices that are in a specific IPAddressV6 subnet

Query · kql

// Specify the relevant subnet in IpV6Range
let IpV6Range = "2001:4898::1050:1050/127";
DeviceNetworkInfo
| summarize arg_max(Timestamp, *) by DeviceId
| mv-expand IPAddressEntry=todynamic(IPAddresses)
| extend IPAddress=tostring(IPAddressEntry.IPAddress)
| where ipv6_is_match(IPAddress, IpV6Range)
Raw source Devices In Subnet - IPAddressV6 · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 008f87b5-5b80-4487-9612-80032d931a69
name: Devices In Subnet - IPAddressV6
description: |
  This query surfaces devices that are in a specific IPAddressV6 subnet
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceInfo
tactics: []
relevantTechniques: []
query: |
  // Specify the relevant subnet in IpV6Range
  let IpV6Range = "2001:4898::1050:1050/127";
  DeviceNetworkInfo
  | summarize arg_max(Timestamp, *) by DeviceId
  | mv-expand IPAddressEntry=todynamic(IPAddresses)
  | extend IPAddress=tostring(IPAddressEntry.IPAddress)
  | where ipv6_is_match(IPAddress, IpV6Range)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.