Skip to content

Instantly share code, notes, and snippets.

@JohnLaTwC
Created December 17, 2019 04:00
Show Gist options
  • Save JohnLaTwC/cadc94bb8c9bd3d67dc3db56bfc829ae to your computer and use it in GitHub Desktop.
Save JohnLaTwC/cadc94bb8c9bd3d67dc3db56bfc829ae to your computer and use it in GitHub Desktop.
Azure Sentinel Geospatial query
SigninLogs
| where TimeGenerated >= ago(1d)
| where ResultType == 0
| extend longitude = todouble(LocationDetails['geoCoordinates']['longitude']),
latitude = todouble(LocationDetails['geoCoordinates']['latitude'])
| where geo_point_in_polygon(longitude, latitude,
dynamic({"type":"Polygon","coordinates": [[
[ -122.164216, 47.711740],
[ -122.084565, 47.714050],
[ -122.077698, 47.627585],
[ -122.142930, 47.627585],
[ -122.144303, 47.660894],
[ -122.162499, 47.662743],
[ -122.164216, 47.711740] ]]}))
| project TimeGenerated, Identity, longitude, latitude
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment