Skip to main content
Splunk Lantern

List of Azure resource unused public IP addresses

 

As an administrator, you want to have a high-level view of unused public IP addresses in your Azure infrastructure. This search provides you with a list of public IP addresses that have been allocated but that are not being used.

Data required 

Microsoft Azure resource data

Procedure

  1. Configure the Splunk Add-on for Microsoft Cloud Services.
  2. Run the following search. You can optimize it by specifying an index and adjusting the time range.
sourcetype="mscs:resource:publicIPAddress"
| eval properties.ipAddress=if(like('properties.ipAddress',"%"),'properties.ipAddress',"Not Attached")
| search properties.ipAddress="Not Attached"
| table location, name, properties.ipAddress, properties.publicIPAddressVersion, properties.publicIPAllocationMethod
| rename location AS Location name AS Name properties.ipAddress AS IP properties.publicIPAddressVersion AS "Public IP Version" properties.publicIPAllocationMethod AS "IP Allocation Method"
| dedup Name

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Splunk Search Explanation

sourcetype="mscs:resource:publicIPAddress"

Search only Azure resource public IP address data. 

| eval properties.ipAddress=if(like('properties.ipAddress',"%"),'properties.ipAddress',"Not Attached") Search for Not Attached events.
| table location, name, properties.ipAddress, properties.publicIPAddressVersion, properties.publicIPAllocationMethod Display the following fields: location, name, IP Address Version, and Allocation Method.
| rename location AS Location name AS Name properties.ipAddress AS IP properties.publicIPAddressVersion AS "Public IP Version" properties.publicIPAllocationMethod AS "IP Allocation Method" Modify field names for better readability.
| dedup Name Return only one record per name.

Next steps

The results show all the unused public IP addresses provisioned in the environment. Public IPs that are not attached to an instance might be candidates for release in order to save on cloud cost.

Inventory and asset management tracking is considered a best practice in the ITIL framework. A search like this can be used to gather information on provisioned assets, in this case virtual networks. Asset management is critical in the cloud because it affects operation expenses, as well as security, and informs lifecycle management. 

You might also be interested in other processes associated with the Managing Azure cloud infrastructure use case.