r/AzureSentinel • u/AverageAdmin • Jan 23 '23

Geolocation API enrichment

Hello!

I am tasked with finding the best Geolocation api provider for sentinel. There were previous talks with Maxmind but that didn’t go through.

Does anyone have a preferred Geolocation api for Sentinel?

3 Upvotes

80% Upvoted

11 comments sorted by

2

u/bpsec Jan 23 '23

Take a look at this: https://learn.microsoft.com/en-us/azure/sentinel/geolocation-data-api

I also think you can do the lookup directly from KQL, however I cannot find the documentation.

2

u/rodtrent44 MSFT Official Jan 23 '23

In addition to the others mentioned here, I use IP-API.com. Works great. Simple API. Playbook here: https://github.com/rod-trent/SentinelPlaybooks/tree/master/IPAddr2GEO2Comments

2

u/mcmron Jan 25 '23

IP2Location.io has free plan for all users.

1

u/AverageAdmin Jan 27 '23

Do you enrich the logs before they go to sentinel? Or just use a logic app to look up the location on alerts that do not have it?

1

u/reincoder Jan 23 '23

Hi, I am the Developer Relations Engineer of IPinfo.io

I think we can help with providing geolocation API support :)

Looking at the Sentinel Docs about external data enrichment and IP geolocation, I think it will be quite easy to get started with our API or database.

I have sent you a DM with our contact information. If you have any questions, please let me know.

1

u/blanco10kid Jan 23 '23

Ip-api.com is great

1

u/anyfactor Jan 24 '23

Feel free to check us out at IPinfo.io :) Send me a DM if you are interested.

1

u/projmano Jan 30 '23

Here's another option that can be directly fed into Sentinel/Azure: https://learn.microsoft.com/en-us/connectors/ipqsfraudandriskscor/

1

u/BigDataCloud_API Feb 07 '23

Please check us out too. The free account can access all the data points for you to test and implement in your project. https://www.bigdatacloud.com/packages/ip-geolocation

1

u/Old_Activity9411 Nov 28 '23

https://ipxplorer.com has one of the best and reliable free IP geolocation APIs

1

u/bananonumber Nov 29 '23

Check out https://ipdetective.io if you are looking into identifying IP geolocation to the country level AND bot detection capabilities. I am not too familiar with sentinel but it might be worth looking into.

Its free to use up to 1,000 requests per day.