Machine info from IP address (2)

id: a6208585-9910-4855-b847-dfd49ff9beb1
name: Machine info from IP address (2)
description: |
  The following queries pivot from an IP address assigned to a machine to the relevant machine or logged-on users.
  To read more about it, check out this post: https://techcommunity.microsoft.com/t5/What-s-New/Advanced-hunting-now-includes-network-adapters-information/m-p/224402#M74.
  Query #1: get machines that have used a given local IP address at a given time - as configured on their network adapters.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceInfo
query: |
  // Query #3: get machines that have used a given *public* IP address at a given time - as seen in their communications with the WDATP cloud
  let pivotTimeParam = datetime(2018-07-15 19:51:00);
  let ipAddressParam = "192.168.1.5";
  DeviceInfo
  | where Timestamp between ((pivotTimeParam-15m) .. 30m) and PublicIP == ipAddressParam
  | project DeviceName, LoggedOnUsers, Timestamp, TimeDifference=abs(Timestamp-pivotTimeParam)
  // In case multiple machines have reported from that IP address arround that time, start with the ones reporting closest to pivotTimeParam
  | sort by TimeDifference asc