Device Logons from Unknown IPs

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Content Index

---

Device Logons from Unknown IP Addresses. This query identifies device logons from IP addresses not associated with any machine in Defender ATP.

Attribute	Value
Type	Hunting Query
Solution	GitHub Only
ID	a6d76204-efb2-4ccd-a068-d5a9e6876236
Required Connectors	MicrosoftThreatProtection
Source	View on GitHub

Tables Used

This content item queries data from the following tables:

Table	Transformations	Ingestion API	Lake-Only
DeviceLogonEvents	✓	✗	?
DeviceNetworkInfo	✓	✗	?
IdentityLogonEvents	✓	✗	?

---

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

↑ Back to Hunting Queries