Devices In Subnet - IPAddressV4

Description

This query surfaces devices that are in a specific IPAddressV4 subnet

Query · kql

// Specify the relevant subnet in IpV4Range
let IpV4Range = "172.22.138.0/24";
DeviceNetworkInfo
| summarize arg_max(Timestamp, *) by DeviceId
| mv-expand IPAddressEntry=todynamic(IPAddresses)
| extend IPAddress=tostring(IPAddressEntry.IPAddress)
| where ipv4_is_in_range(IPAddress, IpV4Range)
Raw source Devices In Subnet - IPAddressV4 · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 7f4a9010-4948-4e0c-b668-7a2f603c7dc8
name: Devices In Subnet - IPAddressV4
description: |
  This query surfaces devices that are in a specific IPAddressV4 subnet
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceInfo
tactics: []
relevantTechniques: []
query: |
  // Specify the relevant subnet in IpV4Range
  let IpV4Range = "172.22.138.0/24";
  DeviceNetworkInfo
  | summarize arg_max(Timestamp, *) by DeviceId
  | mv-expand IPAddressEntry=todynamic(IPAddresses)
  | extend IPAddress=tostring(IPAddressEntry.IPAddress)
  | where ipv4_is_in_range(IPAddress, IpV4Range)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.