Query

CloudAppEvents
| where IPCategory == "Risky"
| project Timestamp, ActionType, IPAddress, IPCategory, ISP, RawEventData

About this query

List risky IP activities

Query Information

Description

This query activities from a Risky IP

Defender XDR

Sentinel

CloudAppEvents
| where IPCategory == "Risky"
| project TimeGenerated, ActionType, IPAddress, IPCategory, ISP, RawEventData

Explanation

This query is designed to identify and list activities associated with IP addresses that are categorized as "Risky." It pulls data from the CloudAppEvents table and filters the results to only include events where the IPCategory is marked as "Risky." The query then selects and displays specific details about these events, including:

Timestamp/TimeGenerated: The time when the event occurred.
ActionType: The type of action that was performed.
IPAddress: The IP address involved in the event.
IPCategory: The category of the IP, which in this case is "Risky."
ISP: The Internet Service Provider associated with the IP address.
RawEventData: The raw data of the event for further analysis.

The query is structured slightly differently for Defender XDR and Sentinel, but both serve the same purpose of identifying and detailing risky IP activities.

KQL Search