Microsoft Sentinel

Join sign-in and firewall logs with the list in KQL.

Microsoft Sentinel can read the blocklist straight from a URL in KQL with externaldata, so you can join it with sign-in, firewall or web logs without an ingestion pipeline.

Hunt with the list

Sign-ins from listed addresses over the last day:

let isipsafe = externaldata(ip:string, confidence:int, reports:int, reporters:int, last_reported:datetime, country:string, asn:long, categories:string)
    [@"https://isipsafe.com/api/v1/blocklist?key=sl_your_key_here&format=csv&confidenceMinimum=50&limit=200000"]
    with (format="csv", ignoreFirstRecord=true);
SigninLogs
| where TimeGenerated > ago(1d)
| join kind=inner (isipsafe) on $left.IPAddress == $right.ip
| project TimeGenerated, UserPrincipalName, IPAddress, ResultType, confidence, categories, country
| order by confidence desc

Swap SigninLogs for CommonSecurityLog (firewalls, with SourceIP), AzureDiagnostics or W3CIISLog (cIP) to search other sources.

Alert on it

Save the query as a scheduled analytics rule (for example every hour over the last hour) and map IPAddress to an IP entity, so incidents show the address and link to its isipsafe page.

Anyone who can read the rule can read the key in it. Use a key from an account created for Sentinel, or load the list into a watchlist with a Logic App and query _GetWatchlist('isipsafe') instead.

Need a hand?

If something here does not work with your version of Microsoft Sentinel, or you have improved it, tell us. We update these pages with what people send.

Microsoft Sentinel and its logo are trademarks of their respective owners. isipsafe is not affiliated with or endorsed by them.