has_any_ipv4()
Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel
Returns a value indicating whether one of specified IPv4 addresses appears in a text.
IP address entrances in a text must be properly delimited with non-alphanumeric characters. For example, properly delimited IP addresses are:
- "These requests came from: 192.168.1.1, 10.1.1.115 and 10.1.1.201"
- "05:04:54 127.0.0.1 GET /favicon.ico 404"
Syntax
has_any_ipv4(
source ,
ip_address [,
ip_address_2,
...] )
Learn more about syntax conventions.
Parameters
Name | Type | Required | Description |
---|---|---|---|
source | string |
✔️ | The value to search. |
ip_address | string or dynamic | ✔️ | An IP address, or an array of IP addresses, for which to search. |
Returns
true
if one of specified IP addresses is a valid IPv4 address, and it was found in source. Otherwise, the function returns false
.
Examples
IP addresses as list of strings
print result=has_any_ipv4('05:04:54 127.0.0.1 GET /favicon.ico 404', '127.0.0.1', '127.0.0.2')
result |
---|
true |
IP addresses as dynamic array
print result=has_any_ipv4('05:04:54 127.0.0.1 GET /favicon.ico 404', dynamic(['127.0.0.1', '127.0.0.2']))
result |
---|
true |
Invalid IPv4 address
print result=has_any_ipv4('05:04:54 127.0.0.256 GET /favicon.ico 404', dynamic(["127.0.0.256", "192.168.1.1"]))
result |
---|
false |
Improperly deliminated IP address
print result=has_any_ipv4('05:04:54127.0.0.1 GET /favicon.ico 404', '127.0.0.1', '192.168.1.1') // false, improperly delimited IP address
result |
---|
false |