'Get Logon Location KQL

I am using Microsoft 365 Defender Advanced Hunting attempting to get the Logon location of a user, but the Location column only has the Country. I'm attempting the following query to get the location from the ip-address.

IdentityLogonEvents
| where OSPlatform == 'Windows'
| lookup city, state from geo:ip-address

Thank you for any help!

microsoft365-defender


Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source

Related Questions