KQL/IPinvestigation.kql at main · crtvrffnrt/KQL · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
let ip = '13.74.111.192'; // IP to search for
let timeframe = ago(10d); // Time range
union isfuzzy=true
  IdentityLogonEvents,
  IdentityQueryEvents,
  IdentityDirectoryEvents,
  EmailEvents,
  UrlClickEvents,
  DeviceNetworkEvents,
  DeviceFileEvents,
  DeviceLogonEvents,
  DeviceEvents,
  BehaviorAnalytics,
  CloudAppEvents,
  AADSpnSignInEventsBeta,
  AADSignInEventsBeta,
  AADNonInteractiveUserSignInLogs,
  AADServicePrincipalSignInLogs,
  AADUserRiskEvents,
  SigninLogs,
  OfficeActivity,
  AzureActivity,
  MicrosoftGraphActivityLogs,
  SecurityEvent,
  SecurityAlert
| where TimeGenerated >= timeframe
| where
    LocalIP == ip or
    FileOriginIP == ip or
    RequestSourceIP == ip or
    SenderIPv4 == ip or
    SenderIPv6 == ip or
    IPAddress == ip or
    SourceIPAddress == ip or
    ClientIP == ip or
    RemoteIP == ip or
    DestinationIPAddress == ip or
    CallerIpAddress == ip or
    tostring(parse_json(ExtendedProperties)["Client IP Address"]) == ip or
    tostring(IpAddress) == ip