I want to search something for IP's coming from a specific set of subnets. Some query languages are smart enough to know a /24 is a subnet, but KQL is not. Is there an alternative to this? This is not what I'll be searching on, but for the sake of example let's say you want to search on SignIn logs but only from machines in the 192.168.1.0/24
1 Answers
Please check: https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/ipv4-is-matchfunction
datatable (ip:string)
[
'192.168.1.64', // match
'192.168.2.11', // no match
]
| where ipv4_is_match(ip, '192.168.1.0/24')
Related