WhiteList IP Range 10.0.0.0/8

[kay07949]

Hi,

i am trying to whitelist the ip range 10.0.0.0/8 using the technique below:

let lookup=toscalar(datatable(ip_range:string) ["10.0.0.0/8","199.207.253.101/32","199.207.253.96/32","199.206.0.5/32","199.206.8.26/32"] | summarize l=make_set(ip_range));
let AllSourceIps = materialize(
AzureActivity
| where OperationName =~ "List Storage Account Keys"
| distinct CallerIpAddress
);
let MatchedIps = AllSourceIps
| mv-apply l=lookup to typeof(string) on
(
where ipv4_is_match (CallerIpAddress, l)
);
let ListStorageAccountKeys =
AzureActivity
| where OperationName =~ "List Storage Account Keys"
| where CallerIpAddress !in ((MatchedIps))
| distinct OperationName;

However this doesn't appear to work. It whitelist the other ranges specified except the 10.0.0.0/8 . Please help!

[ashwin-patil]

Hi @kay07949

The above query seems to be the correct and filtering all the IP ranges in my environments.
Could you verify if it`s the same query and possibly add a screenshot of your results to troubleshoot this further ?

Here is the query I compiled with sample data from all of the specified IP ranges from allowlist.

let AzureActivity = datatable ( OperationName: string, CallerIpAddress: string)
[
"List Storage Account Keys","10.0.0.1",
"List Storage Account Keys","10.0.0.2",
"List Storage Account Keys","10.0.0.4",
"List Storage Account Keys","10.0.0.10",
"List Storage Account Keys","10.0.0.100",
"List Storage Account Keys","10.1.0.1",
"List Storage Account Keys","10.2.0.1",
"List Storage Account Keys","10.10.0.1",
"List Storage Account Keys","199.206.8.26",
"List Storage Account Keys","199.206.0.5",
"List Storage Account Keys","199.207.253.96",
"List Storage Account Keys","199.207.253.101",
"List Storage Account Keys","100.100.100.1" 
];
let lookup=toscalar(datatable(ip_range:string) ["10.0.0.0/8","199.207.253.101/32","199.207.253.96/32","199.206.0.5/32","199.206.8.26/32"] | summarize l=make_set(ip_range));
let AllSourceIps = materialize(
AzureActivity
| where OperationName =~ "List Storage Account Keys"
| distinct CallerIpAddress
);
let MatchedIps = AllSourceIps
| mv-apply l=lookup to typeof(string) on
(
where ipv4_is_match (CallerIpAddress, l)
);
let ListStorageAccountKeys =
AzureActivity
| where OperationName =~ "List Storage Account Keys"
| where CallerIpAddress !in ((MatchedIps))
| distinct CallerIpAddress,OperationName;
ListStorageAccountKeys

Query Results:
Correctly filters and gives me only non-matching IP range (100.100.100.1) results.

[kay07949]

thanks this works!

[ashwin-patil]

Closing as no further action required.