XDR Data Lake Question

On XDR Data Lake query, can you find the public IP that the device is connected to? So far I've only seen the local IP or the IP that the device connects to. Thanks

JC2022

Top Comments

JeramyKopacko over 2 years ago in reply to Qoosh +2

You can find this information in the Data Lake. Qoosh + JC2022 SELECT meta_hostname, meta_public_ip FROM XDR_Data
Qoosh over 2 years ago +1

Hi JC2022, I was able to locate some resources in the Live Discover schema which has what you're looking for. Checking the table "public_ip" will show you an example query you can run. SELECT * FROM…

Parents

Qoosh over 2 years ago
Hi JC2022,

I was able to locate some resources in the Live Discover schema which has what you're looking for. Checking the table "public_ip" will show you an example query you can run.
```
SELECT
*
FROM
public_ip
```
I don't believe this is available in the XDR data.
- Cancel
- Vote Up +1 Vote Down
- More
- Cancel
JeramyKopacko over 2 years ago in reply to Qoosh
You can find this information in the Data Lake. Qoosh + JC2022
```
SELECT meta_hostname,
meta_public_ip
FROM XDR_Data
```
- Cancel
- Vote Up +2 Vote Down
- More
- Cancel

Comment

JeramyKopacko over 2 years ago in reply to Qoosh
You can find this information in the Data Lake. Qoosh + JC2022
```
SELECT meta_hostname,
meta_public_ip
FROM XDR_Data
```
- Cancel
- Vote Up +2 Vote Down
- More
- Cancel

Children

No Data

Uncategorized

Anomalies

ATT&CK

Cloud Optix

Compliance

Data Lake

Device

Email

Events

Files

Live Response

Network

Other queries

Processes

Query Tips

Registry

Threat Hunting

User

XDR Data Lake Question

Top Comments