Feedback:

iplocation

Use the iplocation operator to enrich results with geolocation fields provided from a third-party database and associated with the IP address specified in the event log IP address field.

Syntax

|iplocation [prefix=<unique_geolocation_prefix>] [allfields = [true, false]] <fields_included>

<field>

Specify an IP address field, such as src_ip or dest_ip.
<unique_geolocation_prefix>

Specify a prefix for geolocation fieldnames in results. For example, if you specify geo_, the column having the city in results is shown as geo_city.

Note: If you require geolocation enrichment for both source and destination IPs, you must provide two unique geolocation prefixes, one for each instance of the iplocation operator. These prefixes prevent erroneous duplicate field names.

See the Examples below to understand how to construct a query with multiple iplocation prefixes.
allfields = [true, false]

When allfields=true, results include city, country, lat, lon, continent, postal_code, time_zone. Otherwise, results include city, country, lat, and lon.

Note: Retain the lat and lon fields in your query output if you intend to plot the results on a Geo Map. A query that aggregates by country alone returns country-level data with no coordinates, which a Geo Map cannot plot.

Usage

The iplocation operator can be used to create Geo Map visualizations. See About the Geo Map Visualization Type for the query requirements that apply to each type of Geo Map.

Examples

Example 1: Enrich results with geolocation data for source IP addresses.

Copy 
|iplocation src_ip

Example 2: Add geolocation fields with a custom prefix.

Copy 
|iplocation prefix=geo_ src_ip

Example 3: Retrieve 90 days of login or session activity for a specific user, geolocate both source and destination IPs with prefixed fields to avoid collision, and get a clean activity timeline. Here, "srcgeo_" and "destgeo_" prefixes ensure information about both source and destination cities, countries, and latitude-longitude is accurately captured.

Copy 
| where user = 'john.doe@acme.com' and event_time &gt;= relative_time(now(), -90d)
    and (action contains_ci 'login' or action contains_ci 'logon'
    or action contains_ci 'authenticate' or action contains_ci 'signin'
    or action contains_ci 'access' or action contains_ci 'session')
  | iplocation prefix=srcgeo_ allfields=true src_ip
  | iplocation prefix=destgeo_ allfields=true dest_ip
  | fields event_time, user, src_ip, dest_ip, host,
    srcgeo_city, srcgeo_country, srcgeo_lat, srcgeo_lon,
    destgeo_city, destgeo_country, destgeo_lat, destgeo_lon

Example 4: Include all available geolocation fields in the output.

Copy 
|iplocation allfields=true src_ip

Example 5: Enrich non-empty source IPs with geolocation data, and counts events per IP grouped by country and coordinates.

Copy 
ocsf | where src_endpoint.ip!='' | iplocation src_endpoint.ip | aggr count as cnt by src_endpoint.ip, src_endpoint.location.country, lat, lon