geo_info_from_ip_address()

  • Article
  • 09/30/2024

Applies to: ✅ Azure Data Explorer ✅ Azure Monitor ✅ Microsoft Sentinel

Retrieves geolocation information about IPv4 or IPv6 addresses.

Syntax

geo_info_from_ip_address(IpAddress )

Learn more about syntax conventions.

Parameters

Name Type Required Description
IpAddress string ✔️ IPv4 or IPv6 address to retrieve geolocation information about.

Returns

A dynamic object containing the information on IP address whereabouts (if the information is available). The object contains the following fields:

Name Type Description
country string Country name
state string State (subdivision) name
city string City name
latitude real Latitude coordinate
longitude real Longitude coordinate

Note

  • IP geolocation is inherently imprecise; locations are often near the center of the population. Any location provided by this function should not be used to identify a particular address or household.
  • This function uses GeoLite2 data created by MaxMind, available from https://www.maxmind.com.
  • The function is also built on the MaxMind DB Reader library provided under ISC license.

Note

To further manipulate the resulting array, see dynamic object accessors.

Examples

Run the query

print ip_location=geo_info_from_ip_address('20.53.203.50')

Output

ip_location
{"country": "Australia", "state": "New South Wales", "city": "Sydney", "latitude": -33.8715, "longitude": 151.2006}

Run the query

print ip_location=geo_info_from_ip_address('2a03:2880:f12c:83:face:b00c::25de')

Output

ip_location
{"country": "United States", "state": "Florida", "city": "Boca Raton", "latitude": 26.3594, "longitude": -80.0771}