Query Log Analytics Workspace for Prefix/CIDR wise filter

Shaikh, Sufiyan 20

Could you help with the script we can run to query IP subnet/Prefix value wise like 192.168.12.0/27.

Shaikh, Sufiyan 20 Reputation points

2023-08-11T09:43:48.8266667+00:00

Thank you Clive for the response.

Accepted answer

Clive Watson 7,866 Reputation points MVP Volunteer Moderator

2023-08-10T22:00:19.5566667+00:00

If you need to see if its a valid IP/prefix, use: https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/has-any-ipv4-prefix-function or https://learn.microsoft.com/en-us/azure/data-explorer/kusto/query/has-ipv4-prefix-function

There are some other examples in the Sentinel Github: https://github.com/search?q=repo%3AAzure%2FAzure-Sentinel%20ipv4_prefix&type=code
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

0 additional answers

Your answer