Microsoft Sentinel us watchlist for IP Range

Question

I currently have a Watchlist with IP Ranges:

What I'm trying to do is leverage the watchlist to check a if a specific IP Address is in the watchlist IP Range.

Example:
An alert comes in from IP Address 10.10.1.5 I do not want the alert to trigger because it's coming from a "Safe IP Address" My watchlist doesn't contain IP Addresses, it contains ranges. The above IP is part of one of the IP Ranges so I want it to be ignored let IPIgnore = (_GetWatchlist('AllowedIPs') | project IPAddress); SecurityAlerts | where IPAddress !in (IPIgnore)

Answer 1

@Kentucky Mike

I'm glad that you were able to resolve your issue and thank you for posting your solution so that others experiencing the same thing can easily reference this! Since the Microsoft Q&A community has a policy that "The question author cannot accept their own answer. They can only accept answers by others", I'll repost your solution in case you'd like to accept the answer.

Issue:

You're trying to leverage Watchlists in Microsoft Sentinel to check if a specific IP address is in the Watchlist IP range. For Example:

• An alert comes in from IP Address 10.10.1.5 I do not want the alert to trigger because it's coming from a "Safe IP Address" My watchlist doesn't contain IP Addresses, it contains ranges. The above IP is part of one of the IP Ranges so I want it to be ignored let IPIgnore = (_GetWatchlist('AllowedIPs') | project IPAddress); SecurityAlerts | where IPAddress !in (IPIgnore)

Solution:

After working with our Support Engineers, you found that the initial query doesn’t work with summarize because ipv4_is_in_range can’t use the result.

#I figured out what’s wrong with this query:

let IPIgnore = (_GetWatchlist('NetworkAddresses')
    | project SearchKey
    | summarize rangeList = make_list(SearchKey, 128));
let MyIPAddress = '10.50.248.25';
IPIgnore
| search '10.50.248.25'
| project MyIPAddress, tostring(rangeList)
| where (ipv4_is_in_range(MyIPAddress,rangeList))

===========================================================

#It doesn’t work with summarize because ipv4_is_in_range can’t use the result.
#This works:

let IPIgnore = (_GetWatchlist('NetworkAddresses')
    | project rangeList = SearchKey
    | distinct rangeList);
let MyIPAddress = '10.50.248.25';
IPIgnore
| project MyIPAddress, tostring(rangeList)
| where (ipv4_is_in_range(MyIPAddress, rangeList))

===========================================================

If you have any other questions, please let me know. Thank you again for your time and patience throughout this issue!

Answer 2

There are some useful IP functions like ipv4_is_in_range() that can be useful. Also, if you use the watchlist template for "Network Addresses" this will flag your IPs as internal on the UEBA profile page. I prefer this option because the insight is provided for every alert.

https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/ipv4-is-in-range-function

Answer 3

Hey Kentucky Mike! Long time no hear! Would this work?
let NetworkWatchlist = (_GetWatchlist('NetworkAddresses') | project SearchKey // this is where you extract the column from your watchlist with the IPs | summarize rangeList = make_list(SearchKey)); //here you're creating a list from the above results. let MyIPAddress = '192.168.100.4'; // you won't need this unless you're testing. NetworkWatchlist // now you run your regular search | project MyIPAddress, tostring(rangeList) // now they're dumping all the IPs from your search and the list | where (ipv4_is_in_range(MyIPAddress, rangeList)) // here you filter from the above dump to just match your IP.

Answer 4

I received the following from a Microsoft Support Engineer:

 
I figured out what’s wrong with this query:

let IPIgnore = (_GetWatchlist('NetworkAddresses')
    | project SearchKey
    | summarize rangeList = make_list(SearchKey, 128));
let MyIPAddress = '10.50.248.25';
IPIgnore
| search '10.50.248.25'
| project MyIPAddress, tostring(rangeList)
| where (ipv4_is_in_range(MyIPAddress,rangeList))
 
It doesn’t work with summarize because ipv4_is_in_range can’t use the result.
 
This works:
let IPIgnore = (_GetWatchlist('NetworkAddresses')
    | project rangeList = SearchKey
    | distinct rangeList);
let MyIPAddress = '10.50.248.25';
IPIgnore
| project MyIPAddress, tostring(rangeList)
| where (ipv4_is_in_range(MyIPAddress, rangeList))
 
 

===========================================================