Seen IPv4 Network Subnets

Description

This query uncovers seen IPAddressV4 network subnets

Query · kql

// 
DeviceNetworkInfo
| summarize arg_max(Timestamp, *) by DeviceId
| mv-expand todynamic(IPAddresses)
| where isnotempty( IPAddresses.SubnetPrefix) and isnotempty( IPAddresses.IPAddress)
| extend Subnet = format_ipv4_mask(tostring(IPAddresses.IPAddress), toint(IPAddresses.SubnetPrefix))
| summarize by Subnet
Raw source Seen IPv4 Network Subnets · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 919047fa-f646-469a-bfeb-69a0dcbf44c0
name: Seen IPv4 Network Subnets
description: |
  This query uncovers seen IPAddressV4 network subnets
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkInfo
tactics: []
relevantTechniques: []
query: |
  // 
  DeviceNetworkInfo
  | summarize arg_max(Timestamp, *) by DeviceId
  | mv-expand todynamic(IPAddresses)
  | where isnotempty( IPAddresses.SubnetPrefix) and isnotempty( IPAddresses.IPAddress)
  | extend Subnet = format_ipv4_mask(tostring(IPAddresses.IPAddress), toint(IPAddresses.SubnetPrefix))
  | summarize by Subnet

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.