Skip to main content
Lantern Home

 

Splunk Lantern

List of Azure resource public IP addresses

  1. Last updated
  2. Save as PDF

 

As an administrator, you want to have a high-level view of the number of IP addresses in your Azure infrastructure, as well as their location and allocation method.

Data required 

Microsoft: Azure resource data

Procedure

  1. Configure the Splunk Add-on for Microsoft Cloud Services.
  2. Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype="mscs:resource:publicIPAddress"
| table location, name, properties.ipAddress, properties.publicIPAddressVersion, properties.publicIPAllocationMethod 
| rename location AS Location, name AS Name, properties.ipAddress as "IP Address", properties.publicIPAddressVersion AS Version, properties.publicIPAllocationMethod AS "Allocation Method"
| dedup Name

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

sourcetype="mscs:resource:publicIPAddress"

Search only Azure resource public IP address data. 
| table location, name, properties.ipAddress, properties.publicIPAddressVersion, properties.publicIPAllocationMethod  Display the results in a table with columns in the order shown.
| rename location AS Location, name AS Name, properties.ipAddress as "IP Address", properties.publicIPAddressVersion AS Version, properties.publicIPAllocationMethod AS "Allocation Method"

Rename the fields as shown for better readability.
| dedup Name Return only one record per name.

Next steps

The results show all the public IP addresses provisioned in the environment. This data could be the foundation for asset management data collection. Inventory and asset management tracking is considered a best practice in the ITIL framework. A search like this can be used to gather information on provisioned assets, in this case virtual networks. Asset management is critical in the cloud because it affects operation expenses, as well as security, and informs lifecycle management. Public IP addresses are not free.

You might also be interested in other processes associated with the Managing Azure cloud infrastructure use case.