Micrsoft 365 Defenders: Advanced Hunting Query for Azure Sign-ins Log - Foreign IP Addresses

Khoa Tran 40 Reputation points
2023-07-13T18:44:24.46+00:00

Hi everyone, while learning about both Azure Cloud Security and Microsoft 365 Defender, I have come up to a question: Is it possible to write a Kusto query in Advanced Hunting tab from Microsoft 365 Defender to identify foreign IP addresses and foreign countries from Azure Sign-Ins Log, and let that query scan the data at a time period, such as 10-hour, 24-hour, 2-day, 7-day, etc. Thank you in advance!

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,250 questions
Microsoft Defender for Identity
Microsoft Defender for Identity
A Microsoft service that helps protect enterprise hybrid environments from multiple types of advanced, targeted cyberattacks and insider threats.
175 questions
Microsoft Entra ID
Microsoft Entra ID
A Microsoft Entra identity service that provides identity management and access control capabilities. Replaces Azure Active Directory.
20,365 questions
0 comments
Accepted answer
  1. James Hamil 22,981 Reputation points Microsoft Employee
    2023-07-13T19:07:39.5866667+00:00

    Hi @Khoa Tran , yes this is possible. Here's an example query:

    SigninLogs
| where TimeGenerated >= ago(24h) // Set the time period here (e.g., 24h for the last 24 hours)
| extend Country = LocationDetails.countryOrRegion, IPAddress = IPAddress
| where Country != "YourCountry" // Replace "YourCountry" with the country you want to exclude
| summarize count() by Country, IPAddress
| sort by count_ desc

    This query retrieves sign-in logs from the last 24 hours, extracts the country and IP address, filters out sign-ins from a specific country, and then groups and counts the sign-ins by country and IP address. You can adjust the time period by changing the value in the ago() function. Remember to replace "YourCountry" with the country you want to exclude from the results.

    Please let me know if you have any questions and I can help you further.

    If this answer helps you please mark "Accept Answer" so other users can reference it.

    Thank you,

    James

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest