Edit

Share via

NTAIpDetails

  • Article

Traffic Analytics provides WHOIS data and geographic location for all public IPs in the customer's environment. For Malicious IP, it provides DNS domain, threat type and thread descriptions as identified by Microsoft security intelligence solutions. IP Details are published to your Log Analytics Workspace so you can create custom queries and put alerts on them. You can also access pre-populated queries from the traffic analytics dashboard.

Table attributes

Attribute Value
Resource types -
Categories Network
Solutions LogManagement
Basic log No
Ingestion-time transformation Yes
Sample Queries -

Columns

Column Type Description
_BilledSize real The record size in bytes
DnsDomain string For Malicious IPs only: Domain name associated with this IP.
FaSchemaVersion string Schema version.
FlowIntervalEndTime datetime End time of the flow log processing interval.
FlowIntervalStartTime datetime Start time of the flow log processing interval. This is time from which flow interval is measured.
FlowType string Can be AzurePublic/ExternalPublic/MaliciousFlow.
Ip string Public IP whose information is provided in the record.
_IsBillable string Specifies whether ingesting the data is billable. When _IsBillable is false ingestion isn't billed to your Azure account
Location string For Azure Public IP: Azure region of virtual network/network interface/virtual machine to which the IP belongs OR Global for IP 168.63.129.16. For External Public IP and Malicious IP: 2-letter country code where IP is located (ISO 3166-1 alpha-2).
Port int For Malicious IPs only: Port associated with this IP.
PublicIpDetails string For AzurePublic IP: Azure Service owning the IP OR "Microsoft Virtual Public IP" for IP 168.63.129.16 . ExternalPublic/Malicious IP: WhoIS information of the IP.
SourceSystem string The type of agent the event was collected by. For example, OpsManager for Windows agent, either direct connect or Operations Manager, Linux for all Linux agents, or Azure for Azure Diagnostics
SubType string Subtype for the flow logs. Use only FlowLog, other values of SubType_s are for internal workings of the product.
TenantId string The Log Analytics workspace ID
ThreatDescription string For Malicious IPs only: Description of the threat posed by the malicious IP.
ThreatType string For Malicious IPs only: One of the threats from the list of currently allowed values.
TimeGenerated datetime The time when the data gets ingested into the Log Analytics Workspace.
Type string The name of the table
Url string For Malicious IPs only: Url associated with this IP.