This commit is contained in:
Manish Kumar 2022-04-06 12:01:28 +05:30 коммит произвёл GitHub
Родитель b5791d627d
Коммит 67dc87eaf3
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 3 добавлений и 3 удалений

Просмотреть файл

@ -1,11 +1,11 @@
//This function queries to quickly obtain the list of devices that have been assigned to a certain IP address at a given point in time.
//This function is invoked as part of a query.
//x—The first parameter is typically already a column in the query. In this case, it is the column named IP, the IP address for which you want to see a list of devices that have been //assigned to it. It should be a local IP address. External IP addresses are not supported.
//y—A second optional parameter is the Timestamp, which instructs the function to obtain the most recent assigned devices from a specific time. If not specified, the function returns
//The first parameter is typically already a column in the query. In this case, it is the column named IP, the IP address for which you want to see a list of devices that have been //assigned to it. It should be a local IP address. External IP addresses are not supported.
//The second optional parameter is the Timestamp, which instructs the function to obtain the most recent assigned devices from a specific time. If not specified, the function returns
// Usage Instruction :
// This Function should be deployed via Solution install only from content hub
//Sample Usage: DeviceNetworkInfo |mv-expand IPAddresses |project IP=tostring(IPAddresses.IPAddress) |invoke DeviceFromIP(now())
// Reference : https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-devicefromip-function?view=o365-worldwide
// Reference : https://docs.microsoft.com/microsoft-365/security/defender/advanced-hunting-devicefromip-function?view=o365-worldwide
let DeviceFromIP2 = (T:(IP:string), Timestamp:datetime = datetime(null))
{
let t = coalesce(Timestamp, now());