Email sender IP address Geo location information

Description

This query helps getting GeoIP information of emails SenderIPv4 addresses.

Query · kql

EmailEvents
| where geo_info_from_ip_address(SenderIPv4) != ""
| extend GeoIPInfo = geo_info_from_ip_address(SenderIPv4)
| extend country = tostring(parse_json(GeoIPInfo).country)
Raw source Email sender IP address Geo location information · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 0d5ae69d-bdb2-404d-8c8c-50ebe68b6a5b
name: Email sender IP address Geo location information
description: |
  This query helps getting GeoIP information of emails SenderIPv4 addresses.
description-detailed: |
  This query helps getting GeoIP information of emails SenderIPv4 addresses. Country, State, City, Latitude, Longitude
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - EmailEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  EmailEvents
  | where geo_info_from_ip_address(SenderIPv4) != ""
  | extend GeoIPInfo = geo_info_from_ip_address(SenderIPv4)
  | extend country = tostring(parse_json(GeoIPInfo).country)
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.