Update Devicefromip.txt
This commit is contained in:
Родитель
b5791d627d
Коммит
67dc87eaf3
|
@ -1,11 +1,11 @@
|
|||
//This function queries to quickly obtain the list of devices that have been assigned to a certain IP address at a given point in time.
|
||||
//This function is invoked as part of a query.
|
||||
//x—The first parameter is typically already a column in the query. In this case, it is the column named IP, the IP address for which you want to see a list of devices that have been //assigned to it. It should be a local IP address. External IP addresses are not supported.
|
||||
//y—A second optional parameter is the Timestamp, which instructs the function to obtain the most recent assigned devices from a specific time. If not specified, the function returns
|
||||
//The first parameter is typically already a column in the query. In this case, it is the column named IP, the IP address for which you want to see a list of devices that have been //assigned to it. It should be a local IP address. External IP addresses are not supported.
|
||||
//The second optional parameter is the Timestamp, which instructs the function to obtain the most recent assigned devices from a specific time. If not specified, the function returns
|
||||
// Usage Instruction :
|
||||
// This Function should be deployed via Solution install only from content hub
|
||||
//Sample Usage: DeviceNetworkInfo |mv-expand IPAddresses |project IP=tostring(IPAddresses.IPAddress) |invoke DeviceFromIP(now())
|
||||
// Reference : https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-devicefromip-function?view=o365-worldwide
|
||||
// Reference : https://docs.microsoft.com/microsoft-365/security/defender/advanced-hunting-devicefromip-function?view=o365-worldwide
|
||||
let DeviceFromIP2 = (T:(IP:string), Timestamp:datetime = datetime(null))
|
||||
{
|
||||
let t = coalesce(Timestamp, now());
|
||||
|
|
Загрузка…
Ссылка в новой задаче