Export IP list from Microsoft Defender for Cloud

Alexis Salazar Núñez 21 Reputation points


I'd like to know if there is a way to export the IP list of a low alert. (Traffic detected from IP addresses recommended for blocking)

¿Any query or from Log Analytics?

Attached example.

I understand that there is an option to export to .csv but it is not readable.


Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,042 questions
{count} votes

Accepted answer
  1. Andrew Blumhardt 9,346 Reputation points Microsoft Employee

    The data is in a JSON array in the alert data. This can be found in the MDFC workspace in the SecurityAlert table. Here is a query to extract the IP list from all alerts. It could be paired with a logic app to take automated action on the list like updating the Sentinel or MDE indicators. It also has location data that will render nicely on a world map tile in a workbook.

    | where DisplayName =="Traffic detected from IP addresses recommended for blocking"
    | mv-expand todynamic(Entities)
    | extend BadIP = Entities.Address
    | where isnotempty(BadIP)
    | extend Carrier = parse_json(tostring(Entities.Location)).Carrier
    | extend City = parse_json(tostring(Entities.Location)).City
    | extend CountryCode = parse_json(tostring(Entities.Location)).CountryCode
    | extend CountryName = parse_json(tostring(Entities.Location)).CountryName
    | extend Latitude = parse_json(tostring(Entities.Location)).Latitude
    | extend Longitude = parse_json(tostring(Entities.Location)).Longitude
    | extend Organization = parse_json(tostring(Entities.Location)).Organization
    | extend State = parse_json(tostring(Entities.Location)).State
    | project TimeGenerated, BadIP, Carrier, City, CountryName, CountryCode, Latitude, Longitude, Organization, State

    1 person found this answer helpful.

1 additional answer

Sort by: Most helpful
  1. James Hamil 18,866 Reputation points Microsoft Employee

    Are you getting a .txt file when you export? You're saying CSV but you uploaded a txt file so I wanted to confirm. I converted it to a csv and it was very unorganized. Please let me know because you should be getting a csv. Have you looked into importing the data into Azure Data Explorer?