Function: ListPublicIPs()

Description

List all public IPs that are returned by Azure Resource Graph. This can be used for enrichment or filtering.

Query · kql

let ListPublicIPs = arg("").Resources
| where type == "microsoft.network/publicipaddresses"
| extend ipAddress = tostring(properties.ipAddress), publicIPAllocationMethod = tostring(properties.publicIPAllocationMethod)
| where isnotempty(ipAddress)
| distinct ipAddress;
ListPublicIPs
Raw source Function: ListPublicIPs() · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Function: ListPublicIPs()

## Query Information

#### Description
List all public IPs that are returned by Azure Resource Graph. This can be used for enrichment or filtering. 

#### References
- https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview
- https://learn.microsoft.com/en-us/azure/governance/resource-graph/samples/starter?tabs=azure-portal

## Log Analytics (Sentinel)
```
let ListPublicIPs = arg("").Resources
| where type == "microsoft.network/publicipaddresses"
| extend ipAddress = tostring(properties.ipAddress), publicIPAllocationMethod = tostring(properties.publicIPAllocationMethod)
| where isnotempty(ipAddress)
| distinct ipAddress;
ListPublicIPs
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.