Need to extract location information from IP addresses and then show it on a map panel in the sentinel workbook

Question

Need to extract location information from IP addresses and then show it on a map panel in the sentinel workbook

Hii,

I am currently having IP addresses in a log analytics table, without any data on their geographical location. So, I need to project IP address data on a map panel in the sentinel workbook. To project the IP addresses, I need the geographical location of the IP address first.

Is there any way in sentinel to extract the geographical location from an IP address and then project it in the map panel of the sentinel workbook?

Thank you.

Answer 1

Hi,

To get the Latitude and Longitude you can use in a Workbook the Sentinel geodata api (use SRM rather than Logs - see below). You need to pass certain fields to the api - see below. This allows you to select an IP in a previous Grid and them get an answer.

/subscriptions/{SubscriptionID}/resourceGroups/{resourceGroup}/providers/Microsoft.SecurityInsights/enrichment/ip/geodata/?ipaddress={ipAddress}

You can then turn the Grid output into a Map

The other method will mean you need a lookup file (.csv) with the data or access to a service like RiskIQ, Greynoise etc... for both you can do an externaldata() lookup.