Export IP list from Microsoft Defender for Cloud

Question

¡Hello!

I'd like to know if there is a way to export the IP list of a low alert. (Traffic detected from IP addresses recommended for blocking)

¿Any query or from Log Analytics?

Attached example.

I understand that there is an option to export to .csv but it is not readable.

TY!

Answer 1

The data is in a JSON array in the alert data. This can be found in the MDFC workspace in the SecurityAlert table. Here is a query to extract the IP list from all alerts. It could be paired with a logic app to take automated action on the list like updating the Sentinel or MDE indicators. It also has location data that will render nicely on a world map tile in a workbook.

SecurityAlert
| where DisplayName =="Traffic detected from IP addresses recommended for blocking"
| mv-expand todynamic(Entities)
| extend BadIP = Entities.Address
| where isnotempty(BadIP)
| extend Carrier = parse_json(tostring(Entities.Location)).Carrier
| extend City = parse_json(tostring(Entities.Location)).City
| extend CountryCode = parse_json(tostring(Entities.Location)).CountryCode
| extend CountryName = parse_json(tostring(Entities.Location)).CountryName
| extend Latitude = parse_json(tostring(Entities.Location)).Latitude
| extend Longitude = parse_json(tostring(Entities.Location)).Longitude
| extend Organization = parse_json(tostring(Entities.Location)).Organization
| extend State = parse_json(tostring(Entities.Location)).State
| project TimeGenerated, BadIP, Carrier, City, CountryName, CountryCode, Latitude, Longitude, Organization, State

Answer 2

Are you getting a .txt file when you export? You're saying CSV but you uploaded a txt file so I wanted to confirm. I converted it to a csv and it was very unorganized. Please let me know because you should be getting a csv. Have you looked into importing the data into Azure Data Explorer?