Approved

over 2 years ago

This query is one you are recommended to read the full content of the post to use. It is not simply a copy and paste query, like others in the forum. It is valuable in the right situation

Live Discovery - Need help to get current IP address

Hi, need some help on creating a query that will show me the current IP address the machine is connecting from.

Is there any nice easy way of doing this?

I've tried with: interface_addresses.address Network_IP,

But that returns the IP for all existing interfaces, not just the one that the machine is connected from.

Thanks in advance!

Diego Tavolari

Top Comments

Parents

Rutvij over 3 years ago

Or A simple Query just to list the active Adapter connection

SELECT ia.interface , address , mask , ia.type , ia.friendly_name  

from interface_addresses ia

JOIN interface_details id ON ia.interface = id.interface

WHERE connection_status = 2 AND mask LIKE '255.%%'

Rutvij over 3 years ago in reply to Rutvij

Make sure there is no error in typing, There will be a column name for that if you can just check https://osquery.io/schema/4.6.0/#interface_details
It works for me
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Comment

Rutvij over 3 years ago in reply to Rutvij

Make sure there is no error in typing, There will be a column name for that if you can just check https://osquery.io/schema/4.6.0/#interface_details
It works for me
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Children

No Data

Uncategorized

Anomalies

ATT&CK

Cloud Optix

Compliance

Data Lake

Device

Email

Events

Files

Live Response

Network

Other queries

Processes

Query Tips

Registry

Threat Hunting

User

Live Discovery - Need help to get current IP address

Top Comments