Query Details
Identify Ip Assets From Mdeasm In Exposure Management That Match Ti
Query
# Identify IP assets from MDEASM in Exposure Management that match TI
## Description
The following query will help identify which IPs from Microsoft Defender External Attack Surface Management in the Advanced Hunting tables from Exposure Management match Threat Intelligence indicators and the ThreatIntelIndicators table.
### References
- https://www.michalos.net/2025/07/31/breaking-down-the-microsoft-defender-external-attack-surface-management-opportunities-for-queries-in-advanced-hunting-log-analytics-workspace/
### Microsoft Defender XDR
```
let TIIPs =
ThreatIntelligenceIndicator
| extend TIIPAddress = tostring(NetworkIP)
| where isnotempty(TIIPAddress)
| project TIIPAddress, ThreatType, Description, ConfidenceScore;
let EASMIPs =
ExposureGraphNodes
| where NodeLabel == "IP address"
| project EASPIPAdress = tostring(NodeName);
TIIPs
| join kind=inner (
EASMIPs
) on $left.TIIPAddress == $right.EASPIPAdress
```
### Versioning
| Version | Date | Comments |
| ------------- |---------------| ---------------------------------------|
| 1.0 | 31/07/2025 | Initial publish |
Explanation
This query is designed to identify IP addresses from Microsoft Defender External Attack Surface Management (MDEASM) that match threat intelligence indicators. Here's a simple breakdown of what the query does:
-
Collect Threat Intelligence IPs:
- It retrieves IP addresses from the
ThreatIntelligenceIndicatortable, along with associated threat types, descriptions, and confidence scores. - These IPs are stored in a temporary dataset called
TIIPs.
- It retrieves IP addresses from the
-
Collect Exposure Management IPs:
- It gathers IP addresses labeled as "IP address" from the
ExposureGraphNodestable. - These IPs are stored in another temporary dataset called
EASMIPs.
- It gathers IP addresses labeled as "IP address" from the
-
Find Matching IPs:
- The query performs an inner join between the
TIIPsandEASMIPsdatasets. - It matches IP addresses from both datasets to find common IPs that are present in both threat intelligence data and exposure management data.
- The query performs an inner join between the
In summary, this query helps security analysts identify IP addresses that are both part of their organization's external attack surface and flagged in threat intelligence, allowing for better prioritization of potential threats.
Details
Michalis Michalos
Released: August 5, 2025
Tables
ThreatIntelligenceIndicatorExposureGraphNodes
Keywords
ThreatIntelligenceIndicatorExposureGraphNodesNetworkIPNodeLabelNodeName
Operators
letextendtostringwhereisnotemptyprojectjoinon