Seen IPv6 Network Subnets

Description

This query uncovers seen IPAddressV6 network subnets

Query · kql

// 
DeviceNetworkInfo
| summarize arg_max(Timestamp, *) by DeviceId
| mv-expand todynamic(IPAddresses)
| where isnotempty( IPAddresses.SubnetPrefix) and isnotempty( IPAddresses.IPAddress)
| extend Subnet = parse_ipv6_mask(tostring(IPAddresses.IPAddress), toint(IPAddresses.SubnetPrefix))
| summarize by Subnet
Raw source Seen IPv6 Network Subnets · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: dab99d96-b53d-438f-9826-fd0934e8578c
name: Seen IPv6 Network Subnets
description: |
  This query uncovers seen IPAddressV6 network subnets
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceNetworkInfo
tactics: []
relevantTechniques: []
query: |
  // 
  DeviceNetworkInfo
  | summarize arg_max(Timestamp, *) by DeviceId
  | mv-expand todynamic(IPAddresses)
  | where isnotempty( IPAddresses.SubnetPrefix) and isnotempty( IPAddresses.IPAddress)
  | extend Subnet = parse_ipv6_mask(tostring(IPAddresses.IPAddress), toint(IPAddresses.SubnetPrefix))
  | summarize by Subnet

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.