\nNot Allowed<\/td>\n | 332<\/td>\n | [“52.179.171.240″,”77.125.9.89″,”84.109.188.120″,”192.176.203.10″,”80.230.49.35″,”37.142.175.61″,”185.27.105.142″,”213.57.167.77″,”79.176.91.243″,”51.143.4.240″,”77.139.246.1″,”73.225.151.175″,”50.35.73.176″,”40.121.91.41″,”89.151.37.15″,”143.159.241.199″,”47.185.20.237″,”173.169.57.117″,”136.55.145.135″,”173.68.101.186″,”52.191.195.160″,”167.220.2.190″,”98.232.109.219″,”166.67.66.245″,”77.138.103.125″,”184.170.166.31″,”83.130.91.77″,”137.135.26.148″,”66.108.20.213″,”90.222.83.39″,”93.173.27.72”]<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n <\/p>\n 2. Using IPV4_is_match<\/h3>\nThe example in the help is this:<\/p>\n \n datatable(ip1_string:string, ip2_string:string)<\/strong><\/div>\n[<\/strong><\/div>\n‘1.168.1.0’,’192.168.1.0′,<\/strong><\/div>\n‘192.168.1.1\/24′,’192.168.1.255’,<\/strong><\/div>\n‘192.168.1.1’,’192.168.1.10\/24′,<\/strong><\/div>\n‘239.168.1.1\/30′,’192.168.1.255\/24’,<\/strong><\/div>\n]<\/strong><\/div>\n| extend CIDRresult= ipv4_is_match(ip1_string, ip2_string) \/\/ In CIDR range?<\/strong><\/div>\n<\/div>\n <\/p>\n <\/p>\n \n \n\n\nip1_string<\/th>\n | ip2_string<\/th>\n | result<\/th>\n<\/tr>\n | \n192.168.1.0<\/td>\n | 192.168.1.0<\/td>\n | true<\/td>\n<\/tr>\n | \n192.168.1.1\/24<\/td>\n | 192.168.1.255<\/td>\n | true<\/td>\n<\/tr>\n | \n192.168.1.1<\/td>\n | 192.168.1.255\/29<\/td>\n | false<\/td>\n<\/tr>\n | \n192.168.1.1\/30<\/td>\n | 192.168.1.255\/24<\/td>\n | true<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n <\/p>\n We can add HostCount and IP Class information<\/p>\n \n datatable(ip1_string:string, ip2_string:string)<\/strong><\/div>\n[<\/strong><\/div>\n‘1.168.1.0’,’192.168.1.0′,<\/strong><\/div>\n‘192.168.1.1\/24′,’192.168.1.255’,<\/strong><\/div>\n‘192.168.1.1’,’192.168.1.10\/24′,<\/strong><\/div>\n‘239.168.1.1\/30′,’192.168.1.255\/24’,<\/strong><\/div>\n]<\/strong><\/div>\n| extend CIDRresult= ipv4_is_match(ip1_string, ip2_string) \/\/ In CIDR range?<\/strong><\/div>\n| extend hostcount = pow(2,(32 – split(ip1_string,”\/”).[1])) \/\/ How many hosts supported?<\/strong><\/div>\n| extend IPAddress = tostring(split(ip1_string,”\/”).[0]) \/\/ Get just IP part of CIDR<\/strong><\/div>\n| extend ipClass = case(parse_ipv4(IPAddress) between ( parse_ipv4(‘1.0.0.0’).. parse_ipv4(‘126.0.0.0’)),”A”,<\/strong><\/div>\nparse_ipv4(IPAddress) between ( parse_ipv4(‘128.0.0.0’).. parse_ipv4(‘191.255.0.0’)),”B”,<\/strong><\/div>\nparse_ipv4(IPAddress) between ( parse_ipv4(‘192.0.0.0’).. parse_ipv4(‘223.255.255.0’) ),”C”,<\/strong><\/div>\nparse_ipv4(IPAddress) between ( parse_ipv4(‘224.0.0.0’).. parse_ipv4(‘239.255.255.255’) ),”D”,<\/strong><\/div>\nparse_ipv4(IPAddress) between ( parse_ipv4(‘240.0.0.0’).. parse_ipv4(‘255.255.255.254’) ),”E”,<\/strong><\/div>\n\/\/else<\/strong><\/div>\nstrcat(“Unknown class”, parse_ipv4(IPAddress))<\/strong><\/div>\n)<\/strong><\/div>\n<\/div>\n<\/div>\n \n \n \n\n\nip1_string<\/th>\n | ip2_string<\/th>\n | CIDRresult<\/th>\n | hostcount<\/th>\n | IPAddress<\/th>\n | ipClass<\/th>\n<\/tr>\n | \n1.168.1.0<\/td>\n | 192.168.1.0<\/td>\n | false<\/td>\n | null<\/td>\n | 1.168.1.0<\/td>\n | A<\/td>\n<\/tr>\n | \n192.168.1.1\/24<\/td>\n | 192.168.1.255<\/td>\n | true<\/td>\n | 256<\/td>\n | 192.168.1.1<\/td>\n | C<\/td>\n<\/tr>\n | \n192.168.1.1<\/td>\n | 192.168.1.10\/24<\/td>\n | true<\/td>\n | null<\/td>\n | 192.168.1.1<\/td>\n | C<\/td>\n<\/tr>\n | \n239.168.1.1\/30<\/td>\n | 192.168.1.255\/24<\/td>\n | false<\/td>\n | 4<\/td>\n | 239.168.1.1<\/td>\n | D<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n <\/p>\n","protected":false},"excerpt":{"rendered":" KQL has some IPV4 features.\u00a0 A new one last month is IPV4_is_match : https:\/\/docs.microsoft.com\/en-us\/azure\/kusto\/query\/ipv4-is-matchfunction Two examples (more here https:\/\/github.com\/CliveW-MSFT\/KQLpublic\/blob\/master\/Queries\/CIDRexamples ): 1.Using the SigninLogs Table as data. This example takes an IP Address from the log and sees if it is in an allowed range or not.\u00a0 You define whats allowed or not in the CASE<\/p>\n","protected":false},"author":424,"featured_media":17607,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"categories":[1],"post_tag":[882,424,1296],"content-type":[],"coauthors":[],"class_list":["post-30588","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cross-industry","tag-azure-sentinel","tag-hybridcloud","tag-kql"],"yoast_head":"\n Azure Sentinel: CIDR matching - Microsoft Industry Blogs - United Kingdom<\/title>\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\t\n\n\n\t\n\t\n\t\n | | |