How to load the Azure IP address list for east us 2 into the hunting query "Detect Azure RemoteIP"
in the Defender dashboard in Azure, under Hunding , advanced Hunting, Queries, General Queries, Detect Azure RemoteIP
I downloaded the .json file that is the list of all IP address ranges. I copied the ip address list for east us 2 and pasted it into the section (DeviceNetworkEvents | take 10000) as stated in the top instructions of : "replace the demo portion of the query (DeviceNetworkEvents | take 10000) with your query with the column name of the IP address"
This query fails after pasting in the ip address list from the json file.
It is giving the error of expecting a semicolon in "line 3, position 4" but line 3 is setting a variable let AzureSubnets = toscalar (
Or if it means the third line in the ip address list after the note //begin sample query// is just another ip address in the list, see bottom 2 pics. anyone have an idea where this semicolon can be inserted?