https://firewalliplists.gypthecat.com/kusto-tables/Recent content in Kusto Tables on Firewall IP Lists @ Gyp the Cat dot ComHugo -- gohugo.ioen-usThu, 04 Jul 2024 09:10:10 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-asn-table/Thu, 04 Jul 2024 09:04:27 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-asn-table/Description This data gives ASN Number and ASN name for any given IP addresses. Source The excellent GeoLite2 ASN from MaxMind. This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com. Why should I use this data? Allows the ability to track IP addresses across service providers as well as investigate the whole address space for specific details. Updates Daily at around 0300UTC. The source data may or may not be updated as regularly.https://firewalliplists.gypthecat.com/kusto-tables/kusto-blocklistde/Mon, 18 Apr 2022 15:48:41 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-blocklistde/Description This data is the blocklist.de lists provided for use in Kusto. Source The superb blocklist.de. Why should I use this data? Allows the ability to track IP addresses that have been observed to being involved in attacks against web facing infrastructure, for instance SSH, FTP, Webservers, etc. Updates Daily at around 0300UTC. The source data may or may not be updated as regularly. Perma Link https://firewalliplists.gypthecat.com/lists/kusto/kusto-blocklistde.csv.zip Schema Column Name Data Type Notes CIDR string Source string Always blocklist.https://firewalliplists.gypthecat.com/kusto-tables/kusto-bogon-networks-table/Sun, 30 Oct 2022 15:48:41 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-bogon-networks-table/Description This dataset contains non publicly routable IP ranges, eg the RFC1918 ranges. Source From the very awesome IETF, IANA and RIR. Why should I use this data? It can be used to further enhance other data enrichment methods and represents IP ranges which may be of interest if their existence is unexpected. It may be that in some Kusto environments (eg MDE) this data may natively exist and may not be necessary.https://firewalliplists.gypthecat.com/kusto-tables/kusto-firehol-anonymous-table/Tue, 27 Dec 2022 13:38:41 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-firehol-anonymous-table/Description This data represents anonymising IP addresses, eg known VPNs and proxies. Source Taken from the firehol_anonymous publicly available IP set https://iplists.firehol.org/?ipset=firehol_anonymous Why should I use this data? This is a large data set which represents IP addresses which are using anonymising technologies to potentially mask actual source location or provide local MITM protection. It is a large dataset. Updates Daily at around 0300UTC. The source data may or may not be updated as regularly.https://firewalliplists.gypthecat.com/kusto-tables/kusto-firehol-datacenters/Mon, 29 Apr 2024 20:15:10 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-firehol-datacenters/Description This data represents address blocks for data centers and data processing ranges. Source Taken from the FireHOL datacenters publicly available IP set https://iplists.firehol.org/?ipset=datacenters Why should I use this data? This is a data set that contains IP ranges where it is unlikely that activity conducted from there would be normal user activity. This data set combined with ASN or Geographical data could provide additional useful insights. Updates Daily at around 0300UTC.https://firewalliplists.gypthecat.com/kusto-tables/kusto-geo-ip-light-table/Sun, 30 Oct 2022 15:48:41 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-geo-ip-light-table/Description This very small and efficient dataset gives geographical to IP lookup within Kusto, otherwise known as geolocation. Since the small size of this table has been a priority you may need to link the country code with the actual name. Update 7 June 2023 The new inbuilt Kusto function geo-info-from-ip-address has just been released. Thank you Kusto team :) // Geoip POC using inbuilt Kusto function // Test randomly generated IP addresses //*** Variables start let NumberOfIPsToTest = 100; //*** Variables end let IPsTesting = materialize( range Position from 1 to (NumberOfIPsToTest) step 1 //Generate x random IP Addresses for testing | extend IpAddress = strcat(toint(rand(255)), '.https://firewalliplists.gypthecat.com/kusto-tables/kusto-geo-ip-table/Sun, 27 Nov 2022 11:36:37 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-geo-ip-table/Description This is a full Geo IP lookup for use in Kusto, it is a larger dataset and is supplied via Maxmind. Update 7 June 2023 The new inbuilt Kusto function geo-info-from-ip-address has just been released. Thank you Kusto team :) Copy // Geoip POC using inbuilt Kusto function // Test randomly generated IP addresses //*** Variables start let NumberOfIPsToTest = 100; //*** Variables end let IPsTesting = materialize( range Position from 1 to (NumberOfIPsToTest) step 1 //Generate x random IP Addresses for testing | extend IpAddress = strcat(toint(rand(255)), '.https://firewalliplists.gypthecat.com/kusto-tables/kusto-public-holidays/Wed, 06 Jul 2022 15:48:41 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-public-holidays/Description This is output from the Python Holidays module and made available here in CSV format. Source The superb https://pypi.org/project/holidays/. Why should I use this data? This dataset shows all the supported countries and their public holidays available from the Python package. It contains the previous year’s holidays as well as this year and the next four years. ie if downloaded in 2024 you will have data from 2023, 2024, 2025, 2026, 2027 and 2028.https://firewalliplists.gypthecat.com/kusto-tables/kusto-spamhaus-drop-edrop-table/Mon, 21 Nov 2022 10:58:41 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-spamhaus-drop-edrop-table/Description This data is the very high fidelity Spamhaus DROP and EDROP lists packaged for ingestion for use in Kusto. Source From the very awesome Spamhaus and specifically DROP and EDROP. Why should I use this data? It contains some “known bad” IP blocks and the suggestion is that these ranges should be dropped from key internet routes. Leveraging this data in Kusto will give a very high fidelity investigation criteria if their use is discovered.https://firewalliplists.gypthecat.com/kusto-tables/kusto-team-cymru-table/Sun, 27 Nov 2022 11:08:41 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-team-cymru-table/Description This data from Team Cymru is a threat intelligence feed from their full bogons IPv4 list. It can be used to further enhance Threat Intelligence with an additional source. Source https://www.team-cymru.org/Services/Bogons/fullbogons-ipv4.txt https://team-cymru.com/ Why should I use this data? It is a high fidelity data source and can aid investigations and alerting. Updates Daily at around 0300UTC. The source data may or may not be updated as regularly. Perma Link https://firewalliplists.https://firewalliplists.gypthecat.com/kusto-tables/kusto-tor-exit-nodes-table/Sun, 30 Oct 2022 15:48:41 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-tor-exit-nodes-table/Description This data represents Tor exit nodes. Source Taken from the publically available resource on the Tor Projects own site https://check.torproject.org/torbulkexitlist Why should I use this data? It’s a small dataset and high fidelity given it comes from the Tor Project themselves. It is useful to find Tor nodes within existing datasets and represents a snapshot of the Tor environment on a given time. Updates Daily at around 0300UTC although source data is updated more regularly.https://firewalliplists.gypthecat.com/kusto-tables/kusto-tor-exit-nodes-historic-table/Thu, 04 Jul 2024 09:10:10 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-tor-exit-nodes-historic-table/Description This data represents a historic dataset of Tor exit nodes. Source Taken from the publically available resource on the Tor Projects own site https://check.torproject.org/torbulkexitlist Why should I use this data? It’s a high fidelity data set given it comes from the Tor Project themselves to identify Tor usage. It is useful to find Tor nodes within existing datasets and represents a snapshot of the Tor environment on a specified date.https://firewalliplists.gypthecat.com/kusto-tables/kusto-interesting-queries/Sun, 30 Oct 2022 15:48:41 +0000https://firewalliplists.gypthecat.com/kusto-tables/kusto-interesting-queries/Description In putting together this data these are queries I found quite interesting and included here for reference and as samples of why having multiple data sources is a useful exercise. Self Contain Kusto // Given the Maxmind Lite and IPDeny data sets, which networks have uncertain geography? // ie where do Maxmind Lite and IPDeny disagree? let CIDRRanges1 = (externaldata (CIDRCountry:string, CIDR:string, CIDRCountryName:string, CIDRContinent:string, CIDRContinentName:string, CIDRSource:string) ['https://firewalliplists.gypthecat.com/lists/kusto/kusto-cidr-countries.csv.zip'] with (ignoreFirstRecord=true)) | project CIDR, CIDRCountry, CIDRSource; let CIDRRanges2 = externaldata (CIDRCountry:string, CIDR:string, CIDRSource:string) ['https://firewalliplists.https://firewalliplists.gypthecat.com/kusto-tables/how-to-run-these-queries/Wed, 12 Jun 2024 20:27:41 +0000https://firewalliplists.gypthecat.com/kusto-tables/how-to-run-these-queries/Azure Data Explorer - Free If you head to https://aka.ms/kustofree and sign up for a free cluster using your MSA account you will be able to run the self contained queries as well as create tables and things of that nature. This is labelled by Microsoft as being free and you shouldn’t incur costs. Azure Log Analytics Workspace Demo - Free Opening up https://aka.ms/lademo and signing in with your MSA account should let you run these queries as well as explore the other datasets.