How to resolve "Unknown function: 'iplocation'" issue?

Question

How to resolve "Unknown function: 'iplocation'" issue?

Param Singh 25

Hi -

I am trying to use the 'iplocation()' function within my Sentinel logic rules but I keep incurring an error stated that the function is unknown even though everything I've read states the function is valid.

I had read to enable geolocation within my Sentinel workspace but I don't see any option to do so.

Any guidance into resolving this issue would be sincerely appreciated.

Thanks!

Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2025-03-17T15:06:34.7366667+00:00

Hello @Param Singh,

I would like to better understand your environment to provide you with the most effective solution. Could you please share a full screenshot of the error message you’re encountering? Additionally, please outline the steps you are following to use the iplocation function in rules.If you are referring to any public documentation, kindly share the link here. Also, please confirm if the steps you are performing align with those mentioned in the following document:

Automatically check and record IP address reputation information in incidents
Param Singh 25 Reputation points

2025-03-17T15:34:17.7666667+00:00
Hi Raja -

Thank you for your response.

The following is the KQL rule that I entered within Azure Sentinel Analytics Rule:

let threshold = 5;

let szSharePointFileOperation = "SharePointFileOperation";

let szOperations = dynamic(["FileDownloaded", "FileUploaded"]);

let starttime = 14d;

let endtime = 10d;

// 1) Gather "historical" activity

let historicalActivity =

OfficeActivity

| where TimeGenerated between (ago(starttime) .. ago(endtime))

| where not (ClientIP startswith "fe80:"

or ClientIP startswith "fd" or ClientIP startswith "fc00:")

| where RecordType =~ szSharePointFileOperation

| where Operation in~ (szOperations)

| extend IPCountry = iplocation(ClientIP).Country

| where IPCountry != "United States"

| summarize historicalCount = count()

by ClientIP, RecordType, Operation;

// 2) Gather "recent" activity

let recentActivity =

OfficeActivity

| where TimeGenerated > ago(endtime)

| where not (ClientIP startswith "fe80:"

or ClientIP startswith "fd" or ClientIP startswith "fc00:")

| where RecordType =~ szSharePointFileOperation

| where Operation in~ (szOperations)

| extend IPCountry = iplocation(ClientIP).Country

| where IPCountry != "United States"

| summarize min(Start_Time),

max(Start_Time), recentCount = count() by ClientIP, RecordType, Operation;

// 3) Identify new IPs with high (recentCount > threshold) usage

let RareIP =

recentActivity

| join kind=leftanti (

historicalActivity

) on ClientIP, RecordType, Operation

| where recentCount > threshold;

// 4) Final output and join, pulling in relevant details

OfficeActivity

| where TimeGenerated >= ago(endtime)

| where RecordType =~ szSharePointFileOperation

| where Operation in~ (szOperations)

| extend IPCountry = iplocation(ClientIP).Country

| where IPCountry != "United States"

| join kind=inner (RareIP) on ClientIP, RecordType, Operation

| where Start_Time between (min_Start_Time .. max_Start_Time)

| summarize

StartTimeUtc = min(min_Start_Time), EndTimeUtc = max(max_Start_Time)

by RecordType,

Operation, UserType, UserId, ClientIP, OfficeWorkload, Site_Url, OfficeObjectId, UserAgent, IPSeenCount = recentCount

| extend timestamp = StartTimeUtc,

AccountCustomEntity = UserId, IPCustomEntity = ClientIP, URLCustomEntity = Site_Url

| order by IPSeenCount desc,

ClientIP asc, Operation asc, UserId asc

Thanks,
Param

Accepted answer

0 additional answers

Your answer

Raja Pothuraju 23,465 Reputation points Microsoft External Staff Moderator

2025-03-17T15:06:34.7366667+00:00

Hello @Param Singh,

I would like to better understand your environment to provide you with the most effective solution. Could you please share a full screenshot of the error message you’re encountering? Additionally, please outline the steps you are following to use the iplocation function in rules.If you are referring to any public documentation, kindly share the link here. Also, please confirm if the steps you are performing align with those mentioned in the following document:

Automatically check and record IP address reputation information in incidents

Answer 1

Clive Watson 7,866 MVP Volunteer Moderator

Hi, the built-in function is

| extend IPCountry =tostring(geo_info_from_ip_address(ClientIP).country)

my guess is that the author of the query had a function saved called iplocation() to make the syntax work:

| extend IPCountry = iplocation(ClientIP).Country

You should be able to replace the above to fix the issue

Param Singh 25 Reputation points

2025-03-18T17:20:40.1966667+00:00

Thank you very much, Clive!
That worked like a charm.

Thank you again for your help!

Share via

How to resolve "Unknown function: 'iplocation'" issue?

The following is the KQL rule that I entered within Azure Sentinel Analytics Rule:

0 additional answers

Your answer