Azure-Sentinel/Playbooks/Save-NamedLocations
ThijsLecomte 9f8b11ff6e
Update Azure Deploy URL
2020-11-21 14:50:42 +01:00
..
CidrIpRange.zip Update readme, zip location + API 2020-03-23 19:41:47 +01:00
azuredeploy.json Update CA URL 2020-05-18 11:37:09 +02:00
readme.md Update Azure Deploy URL 2020-11-21 14:50:42 +01:00

readme.md

Save-NamedLocations

author: Thijs Lecomte

This Playbook will retrieve the Named Locations from Azure Active Directory Conditional Access and save them in Log Analytics. These named locations can be used in hunting queries.

An app registration should be created with permissions: Policy.Read.All.

This playbook uses an Azure Function to convert CIDR ranges to IP-addresses. The function is deployed from the zip file which can be found in this repo.