Query Details
List Public I Ps
Query
# Function: ListPublicIPs()
## Query Information
#### Description
List all public IPs that are returned by Azure Resource Graph. This can be used for enrichment or filtering.
#### References
- https://learn.microsoft.com/en-us/azure/governance/resource-graph/overview
- https://learn.microsoft.com/en-us/azure/governance/resource-graph/samples/starter?tabs=azure-portal
## Log Analytics (Sentinel)
```
let ListPublicIPs = arg("").Resources
| where type == "microsoft.network/publicipaddresses"
| extend ipAddress = tostring(properties.ipAddress), publicIPAllocationMethod = tostring(properties.publicIPAllocationMethod)
| where isnotempty(ipAddress)
| distinct ipAddress;
ListPublicIPs
```
Explanation
The query "ListPublicIPs()" retrieves a list of all public IP addresses returned by Azure Resource Graph. It can be used to enrich or filter data. The query filters for resources of type "microsoft.network/publicipaddresses" and extracts the IP address and allocation method. It then removes any empty IP addresses and returns a distinct list of IP addresses.
Details
Bert-Jan Pals
Released: September 22, 2023
Tables
microsoft.network/publicipaddresses
Keywords
Devices,Intune,User
Operators
argResourceswheretype=="microsoft.network/publicipaddresses"extendipAddresstostringproperties.ipAddresspublicIPAllocationMethodisnotemptydistinct