Sophos Endpoint

Device XDR Data Lake Question

Sophos Endpoint requires membership for participation - click to join

Complete

over 3 years ago

XDR Data Lake Question

On XDR Data Lake query, can you find the public IP that the device is connected to? So far I've only seen the local IP or the IP that the device connects to. Thanks

JC2022

Top Comments

JeramyKopacko over 3 years ago in reply to Qoosh +2

You can find this information in the Data Lake. Qoosh + JC2022 SELECT meta_hostname, meta_public_ip FROM XDR_Data
Qoosh over 3 years ago +1

Hi JC2022, I was able to locate some resources in the Live Discover schema which has what you're looking for. Checking the table "public_ip" will show you an example query you can run. SELECT * FROM…

Parents

Qoosh over 3 years ago
Hi JC2022,

I was able to locate some resources in the Live Discover schema which has what you're looking for. Checking the table "public_ip" will show you an example query you can run.
```
SELECT
*
FROM
public_ip
```
I don't believe this is available in the XDR data.
- Cancel
- Vote Up +1 Vote Down
- More
- Cancel

Comment

Qoosh over 3 years ago
Hi JC2022,

I was able to locate some resources in the Live Discover schema which has what you're looking for. Checking the table "public_ip" will show you an example query you can run.
```
SELECT
*
FROM
public_ip
```
I don't believe this is available in the XDR data.
- Cancel
- Vote Up +1 Vote Down
- More
- Cancel

Children

JeramyKopacko over 3 years ago in reply to Qoosh
You can find this information in the Data Lake. Qoosh + JC2022
```
SELECT meta_hostname,
meta_public_ip
FROM XDR_Data
```
- Cancel
- Vote Up +2 Vote Down
- More
- Cancel