Get hostname/domain name from IP in AzureNetworkAnalytics_CL log

Paul Nerie 266 Reputation points
2021-08-01T00:47:53.563+00:00

I'm trying to get the outbound bytes for each destination public IP. I have this query:

AzureNetworkAnalytics_CL
| where SubType_s == 'FlowLog'
and FlowDirection_s == 'O'
and FlowStatus_s == 'A'
and FlowType_s == "ExternalPublic"
| project
VM_s,
TimeProcessed_t,
DestinationIP = split(split(DestPublicIPs_s, ' ')[0], '|')[0],
OutboundBytes = toint(split(split(DestPublicIPs_s, ' ')[0], '|')[5])

Is there a way to get the hostname or domain name of the IP address?

Thanks in advance!

Azure Monitor
Azure Monitor
An Azure service that is used to collect, analyze, and act on telemetry data from Azure and on-premises environments.
2,868 questions
0 comments No comments
{count} votes

Accepted answer
  1. bharathn-msft 5,086 Reputation points Microsoft Employee
    2021-08-02T02:46:58.527+00:00

    <<Sharing the information from comments here for broader community usage.>>

    Thank you @Paul Nerie for reaching out with your query.

    As per current documentation on Public IP details Schema only for Malicious IP, it provides DNS domain, threat type and thread descriptions as identified by Microsoft security intelligence solutions

    For additional details on the Traffic Analytics Schema, please refer this document.

    Hope the above information helps, please let us know if you have any further queries.


0 additional answers

Sort by: Most helpful