Export IP list from Microsoft Defender for Cloud

Alexis Salazar Núñez 21 Reputation points
2022-10-20T15:46:54.413+00:00

¡Hello!

I'd like to know if there is a way to export the IP list of a low alert. (Traffic detected from IP addresses recommended for blocking)

¿Any query or from Log Analytics?

Attached example.

I understand that there is an option to export to .csv but it is not readable.

TY!252489-ex.png

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,042 questions
Accepted answer
  1. Andrew Blumhardt 9,346 Reputation points Microsoft Employee
    2022-11-02T01:12:45.143+00:00

    The data is in a JSON array in the alert data. This can be found in the MDFC workspace in the SecurityAlert table. Here is a query to extract the IP list from all alerts. It could be paired with a logic app to take automated action on the list like updating the Sentinel or MDE indicators. It also has location data that will render nicely on a world map tile in a workbook.

    SecurityAlert
    | where DisplayName =="Traffic detected from IP addresses recommended for blocking"
    | mv-expand todynamic(Entities)
    | extend BadIP = Entities.Address
    | where isnotempty(BadIP)
    | extend Carrier = parse_json(tostring(Entities.Location)).Carrier
    | extend City = parse_json(tostring(Entities.Location)).City
    | extend CountryCode = parse_json(tostring(Entities.Location)).CountryCode
    | extend CountryName = parse_json(tostring(Entities.Location)).CountryName
    | extend Latitude = parse_json(tostring(Entities.Location)).Latitude
    | extend Longitude = parse_json(tostring(Entities.Location)).Longitude
    | extend Organization = parse_json(tostring(Entities.Location)).Organization
    | extend State = parse_json(tostring(Entities.Location)).State
    | project TimeGenerated, BadIP, Carrier, City, CountryName, CountryCode, Latitude, Longitude, Organization, State

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. James Hamil 18,866 Reputation points Microsoft Employee
    2022-10-24T23:02:31.203+00:00

    Are you getting a .txt file when you export? You're saying CSV but you uploaded a txt file so I wanted to confirm. I converted it to a csv and it was very unorganized. Please let me know because you should be getting a csv. Have you looked into importing the data into Azure Data Explorer?