How to track back down the Caller IP Address to workstation?

Naija R C 20 Reputation points
2023-01-25T11:23:29.4966667+00:00

Hi,

I am looking for retrieving user information from the REST API event details generated.

I have uploaded a file directly via the azure portal and collected the event details as JSON object using azure Event Hubs. I have given the REST API event's JSON object and the image of how I uploaded the file via azure portal for reference.

Now in the REST API event's JSON object, I got the caller IP address. So using this caller IP address how to track back down to workstation?

And I need another clarification, why didn't I get any user information like Requestor UPN in the event details? Is there any way to get UPN in the event details generated?

uploadFile

Event details of REST API event:

{
  "time": "2023-01-19T06:43:07.2821147Z",
  "resourceId": "XXXXX",
  "category": "StorageWrite",
  "operationName": "CreateFile",
  "operationVersion": "2015-02-21",
  "schemaVersion": "1.0",
  "statusCode": 201,
  "statusText": "Success",
  "durationMs": 76,
  "callerIpAddress": "XXXXX",
  "correlationId": "XXXXX",
  "identity": {
    "type": "SAS",
    "tokenHash": "key1(XXXXX),SasSignature(XXXXX)"
  },
  "location": "East US",
  "properties": {
    "accountName": "testaccount",
    "userAgentHeader": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36",
    "referrerHeader": "XXXXX",
    "clientRequestId": "XXXXX",
    "etag": "XXXXX",
    "serviceType": "file",
    "objectKey": "/testaccount",
    "lastModifiedTime": "1/19/2023 6:43:07 AM",
    "metricResponseType": "Success",
    "serverLatencyMs": 66,
    "requestHeaderSize": 932,
    "responseHeaderSize": 330,
    "tlsVersion": "TLS 1.2",
    "accessTier": "TransactionOptimized"
  },
  "uri": "XXXXX",
  "protocol": "HTTPS",
  "resourceType": "Microsoft.Storage/storageAccounts/fileServices"
}
Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
3,666 questions
Azure Files
Azure Files
An Azure service that offers file shares in the cloud.
1,425 questions
Azure Storage
Azure Storage
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
3,543 questions
Azure Event Hubs
Azure Event Hubs
An Azure real-time data ingestion service.
722 questions
{count} votes

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.