Description
This IPinfo data connector installs an Azure Function app to download standard_abuse datasets and insert it into custom log table in Microsoft Sentinel
- Statut déclaré
- 1
- Auteur / éditeur déclaré
- IPinfo
Sources déclarées
Métadonnées du fichier source. Aucune dépendance déduite du KQL.
Types de données
Permissions déclarées
read and write permissions on the workspace are required.
Workspace
Workspace
read permissions to shared keys for the workspace are required. [See the documentation to learn more about workspace keys](https://docs.microsoft.com/azure/azure-monitor/platform/agent-windows#obtain-workspace-id-and-key).
Keys
Workspace
Microsoft.Web/sites permissions
Read and write permissions to Azure Functions to create a Function App is required. [See the documentation to learn more about Azure Functions](https://docs.microsoft.com/azure/azure-functions/).
IPinfo API Token
Retrieve your IPinfo API Token [here](https://ipinfo.io/).
Instructions du connecteur
Contenu publié dans le dépôt. Consultez le fichier original pour l’ensemble des paramètres.
1. Retrieve API Token
Retrieve your IPinfo API Token [here](https://ipinfo.io/).
2. In your Azure AD tenant, create an Azure Active Directory (AAD) application
In your Azure AD tenant, create an Azure Active Directory (AAD) application and acquire Tenant ID, Client ID, and Client Secret: Use this Link.
3. Assign the AAD application the Microsoft Sentinel Contributor Role.
Assign the AAD application you just created to the Contributor(Privileged administrator roles) and Monitoring Metrics Publisher(Job function roles) in the same “Resource Group” you use for “Log Analytic Workspace” on which “Microsoft Sentinel” is added: Use this Link.
4. Get Workspace Resource ID
Use the Log Analytic Workspace -> Properties blade having the 'Resource ID' property value. This is a fully qualified resourceId which is in the format '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}'
5. Deploy the Azure Function
Use this for automated deployment of the IPinfo data connector using an ARM Tempate.
1. Click the **Deploy to Azure** button below.
[](https://aka.ms/sentinel-IPinfo-Abuse-azuredeploy)
2. Select the preferred **Subscription**, **Resource Group** and **Location**.
3. Enter the **RESOURCE_ID**, **IPINFO_TOKEN**, **TENANT_ID**, **CLIENT_ID**, **CLIENT_SECRET**.
Manual Deployment of Azure Functions
Use the following step-by-step instructions to deploy the IPinfo data connector manually with Azure Functions (Deployment via Visual Studio Code).
Step 1 - Deploy a Function App
1. Download the Azure Function App file. Extract the archive to your local development computer [Azure Function App](https://aka.ms/sentinel-Ipinfo-Abuse-functionapp).
2. Create Function App using Hosting Functions Premium or App service plan using advanced option using VSCode.
3. Follow the function app manual deployment instructions to deploy the Azure Functions app using VSCode.
4. After successful deployment of the function app, follow the next steps for configuring it.
Step 2 - Configure the Function App
1. Go to Azure Portal for the Function App configuration.
2. In the Function App, select the Function App Name and select **Settings** -> **Configuration** or **Environment variables**.
3. In the **Application settings** tab, select **+ New application setting**.
4. Add each of the following application settings individually, with their respective string values (case-sensitive):
RESOURCE_ID
IPINFO_TOKEN
TENANT_ID
CLIENT_ID
CLIENT_SECRET
RETENTION_IN_DAYS
TOTAL_RETENTION_IN_DAYS
SCHEDULE
LOCATION
5. Once all application settings have been entered, click **Save**.
Contenus associés
Liens établis à partir des identifiants déclarés et des manifests des solutions.
Traçabilité de la source
GitHubLes valeurs affichées proviennent des fichiers du dépôt Azure/Azure-Sentinel. Elles décrivent le modèle publié, pas la configuration de votre workspace.
- Commit
629d1d3↗- Identifiant source
IPinfoAbuseDataConnector
GSTEP / SUIVI DU CATALOGUE
Ajouté au catalogue : 16 sept. 2026 · 05:49 UTC
Dernier changement observé : 16 sept. 2026 · 05:49 UTC