IPinfo Microsoft Sentinel Integration

The IPinfo for Microsoft Sentinel integration allows organizations to automatically ingest enriched IP data directly into their Sentinel workspace via Azure Functions and Data Collection Rules (DCR).

This documentation guides you through the complete setup process, from creating your Log Analytics Workspace to deploying connectors, verifying data ingestion, and running queries against the enriched data.

The IPinfo solution deploys Azure Function-based connectors that periodically download IPinfo datasets and ingest the data into custom Log Analytics tables in your Microsoft Sentinel workspace. Each connector runs as an independent Azure Function App that downloads IPinfo datasets and writes the data to your workspace using the Logs Ingestion API via Data Collection Rules.

Prerequisites & Permissions

Before you begin, ensure you have the following items ready.

Azure Subscription & Permissions

• An active Azure subscription with billing enabled.
• Owner or Contributor role on the resource group where you will deploy resources.
• Microsoft Sentinel Contributor role (or higher) on the target workspace.
• Ability to create App Registrations in Microsoft Entra ID (Azure AD) to obtain CLIENT_ID and CLIENT_SECRET.

IPinfo Account & Token

1. Sign up for an IPinfo account (ipinfo.io).
2. Navigate to the Dashboard and copy your token.
3. Ensure your plan includes access to the datasets you plan to deploy (ASN, Abuse, Company, Country, Domain, Privacy, Carrier, etc.).

Keep your IPinfo token secure. You will enter it as a parameter during connector deployment. Do not share it in logs or source control.

Required Parameters

You will need the following values during deployment:

Register an App in Microsoft Entra ID

An App Registration is required so that the Azure Function can authenticate and write data to your workspace.

1. In the Azure Portal, go to Microsoft Entra ID > App registrations > New registration.
2. Enter a name (e.g., IPinfo-Sentinel-Connector) and select Single tenant.
3. Click Register. Copy the Application (client) ID and Directory (tenant) ID.
4. Go to Certificates & secrets > New client secret. Set an expiry and click Add.
5. Copy the secret Value immediately (it will not be shown again).
6. Go to Subscriptions and select your subscription > Access control (IAM) > Add role assignment.
7. Assign the Log Analytics Contributor, Monitoring Contributor, and Monitoring Metrics Publisher roles.

Each of the 3 roles is required for the Azure Function to write data via the Azure Monitor Ingestion API. Without these roles, data ingestion will fail with a 403 Forbidden error.

Creating a Log Analytics Workspace

A Log Analytics Workspace (LAW) is the central data store that Microsoft Sentinel uses. If you already have a workspace with Sentinel enabled, you can skip to Onboarding the Workspace to Microsoft Sentinel.

Steps to Create a Workspace

1. Sign in to the Azure Portal (https://portal.azure.com).
2. In the search bar at the top, type Log Analytics workspaces and select it.
3. Click + Create.
4. Select your Subscription and Resource Group (or create a new one).
5. Enter a Name for the workspace (e.g., ipinfo-sentinel-law).
6. Select a Region close to your operations for optimal performance.
7. Leave the Pricing tier as the default (Pay-As-You-Go) unless you have a commitment tier.
8. Click Review + Create, then click Create.

Choose the same region for all resources (workspace, Function App, etc.) to minimize latency and cross-region data transfer costs.

Note the Workspace Resource ID

After the workspace is created, you need its Resource ID for connector deployment:

1. Open the workspace in the Azure Portal.
2. Go to Settings > Properties.
3. Copy the Resource ID. It will look like: /subscriptions/{sub-id}/resourceGroups/{rg-name}/providers/Microsoft.OperationalInsights/workspaces/{ws-name}

Onboarding the Workspace to Microsoft Sentinel

Microsoft Sentinel must be enabled on your Log Analytics Workspace before connectors can ingest data.

Enable Microsoft Sentinel

1. In the Azure Portal, search for Microsoft Sentinel and select it.
2. Click + Create (or + Add if you see existing workspaces).
3. Select the Log Analytics Workspace you created in Creating a Log Analytics Workspace.
4. Click Add. Sentinel will be enabled on the workspace.

This process takes a few moments. Once complete, you will see the Sentinel Overview dashboard for your workspace.

Enabling Sentinel is free; you only pay for data ingestion and retention. The IPinfo connectors ingest data into custom tables, which are billed at Log Analytics ingestion rates.

Installing the IPinfo Solution from Content Hub

The IPinfo solution packages all data connectors, workbooks, and analytics rules into a single deployable solution available in Microsoft Sentinel Content Hub.

Find and Install the Solution

1. In Microsoft Sentinel, go to Content Hub (under Content management in the left menu).
2. In the search bar, type IPinfo.
3. Locate the IPinfo solution and click on it to open the details pane.
4. Click Install.
5. Select your Subscription, Resource Group, and Workspace.
6. Review the terms and click Create / Install.

The installation deploys the connector definitions and any associated content (workbooks, hunting queries, etc.) into your Sentinel workspace. After installation, the data connectors will appear under the Data connectors page.

Installing the solution only registers the connectors in Sentinel. You still need to deploy each connector (Deploying the Data Connectors) for data to start flowing.

Deploying the Data Connectors

Each IPinfo connector runs as an Azure Function App. Deployment is done through the connector page in Sentinel using an ARM template.

Deploy a Connector

1. In Microsoft Sentinel, go to Data connectors (under Configuration).
2. Find the IPinfo connector you want to deploy (e.g., IPinfo ASN) and click the Open connector page.
3. On the connector page, scroll to the Configuration section.
4. Click the Deploy to Azure button. This opens the ARM template deployment in a new tab.
5. Fill in the required parameters:

6. Click Review + Create, then Create to start the deployment.
7. Wait for the deployment to complete (typically 2 to 5 minutes).

What Gets Deployed

Each connector deployment creates the following Azure resources:

• Azure Function App (Elastic Premium EP2 plan) running Python 3.11
• Storage Account for Function App state
• Data Collection Rule (DCR) for ingesting data into the custom table
• Data Collection Endpoint (DCE) for the Azure Monitor Ingestion API
• Application Insights for monitoring

Repeat for Additional Connectors

Repeat the steps above for each IPinfo connector you want to deploy. Each connector is independent and can be deployed, updated, or removed individually.

Each Function App incurs compute costs. During initial testing, deploy and test one connector at a time to minimize costs. You can disable or delete Function Apps you are not actively using.

Verifying Deployment & Function App Logs

After deployment, verify that the Azure Function is running correctly and processing data.

Check the Function App Status

1. In the Azure Portal, navigate to Function Apps.
2. Find the Function App created by the connector deployment (it will be named based on the connector, e.g., ipinfo-asn-func-app).
3. On the Overview page, verify the Status shows Running.
4. Check the Functions section in the left menu. You should see the timer-triggered function listed.

Trigger a Manual Execution

Rather than waiting for the next scheduled run, trigger the function immediately:

1. In the Function App, go to Functions in the left menu.
2. Click on the timer-triggered function.
3. Click Code + Test → Test/Run → Run.

View Function Execution Logs

There are two ways to view logs from the Function App.

Method 1: Log Stream (Real-time)

1. Open your Function App in the Azure Portal.
2. In the left menu, go to Monitoring > Log stream.
3. Select App Insights Logs or Filesystem Logs from the dropdown.
4. You will see real-time log output from the function, including execution status, data download progress, and ingestion results.

Method 2: Application Insights

For historical logs and deeper analysis:

1. Open the Application Insights resource linked to your Function App.
2. Go to Monitoring > Logs.
3. Run the following Kusto query to see recent function executions:

KQL Query: Function App Traces

traces
| where timestamp > ago(24h)
| where operation_Name contains "ipinfo"
| order by timestamp desc
| take 50

Common Log Messages

Viewing Ingested Data in Log Analytics

Once the connector has run successfully, data will appear in custom tables in your Log Analytics Workspace.

Navigate to Logs

1. In the Azure Portal, open your Log Analytics Workspace.
2. In the left menu, click Logs (under General).
3. The query editor will open. You can run KQL (Kusto Query Language) queries here.

Find IPinfo Tables

IPinfo data is stored in custom tables. You can find them in the Tables section on the left side of the Logs editor, under the Custom Logs category. The tables follow the naming convention shown below:

All tables include TimeGenerated (datetime) and TenantId (guid) columns added automatically by Log Analytics.

Quick Validation Query

To verify data is present, run the following query for any connector (replacing the table name as appropriate):

KQL Query: Verify Data Ingestion

Ipinfo_ASN_CL
| take 10

If rows are returned, data ingestion is working. If no results appear, check the Function App logs (Verifying Deployment & Function App Logs) for errors.

Configuration

All parameters are stored as Application Settings in the Function App. To modify after deployment: Function App → Settings → Configuration → edit value → Save → Restart.

Optional Parameters

Basic KQL Queries

This section provides sample Kusto Query Language (KQL) queries to help you explore and analyze the ingested IPinfo data.

Row Count per Table

Check how many records have been ingested in each table:

Ipinfo_ASN_CL
| summarize Count = count()

Ipinfo_Abuse_CL
| summarize Count = count()

Ipinfo_Country_CL
| summarize Count = count()

Recent Ingestion Activity

View the most recently ingested records to confirm fresh data:

Ipinfo_ASN_CL
| order by TimeGenerated desc
| take 20

Lookup by IP Range or ASN

Search for a specific IP range or ASN in the ASN table:

Ipinfo_ASN_CL
| where asn == "AS13335"
| project asn, name, domain, type, TimeGenerated

Top ASN Types

Summarize records by ASN type to understand the distribution of ISP, hosting, business, and education networks:

Ipinfo_ASN_CL
| summarize Count = count() by type
| order by Count desc

Abuse Contact Lookup

Find the abuse contact for a specific IP range:

Ipinfo_Abuse_CL
| where ip_range has "8.8.8"
| project ip_range, name, email, country

Country Distribution

Analyze the distribution of IP ranges by country:

Ipinfo_Country_CL
| summarize Count = count() by country
| order by Count desc
| take 20

Privacy/VPN Detection

Identify IP ranges flagged as VPN, proxy, Tor, or hosting providers:

Ipinfo_Privacy_CL
| where is_vpn == true or is_proxy == true or is_tor == true
| summarize Count = count() by is_vpn, is_proxy, is_tor, is_hosting
| order by Count desc

Cross-Table Join Example

Enrich ASN data with abuse contact information:

Ipinfo_ASN_CL
| join kind=inner (Ipinfo_Abuse_CL) on $left.ip_range == $right.ip_range
| project ip_range, asn, name, abuse_email = email, country
| take 20

Ingestion Trend Over Time

Chart the volume of ingested records over the last 7 days:

Ipinfo_ASN_CL
| where TimeGenerated > ago(7d)
| summarize Count = count() by bin(TimeGenerated, 1d)
| render timechart

Longitude Filter

Analyze IP ranges located in the western hemisphere:

Ipinfo_Location_extended_CL
| where toreal(longitude) < 0
| take 50

Network and Firewall Requirements

The Azure Function App requires outbound HTTPS (port 443) access to the following endpoints:

Ensure these domains are allowlisted in your firewall or Network Security Group (NSG) configuration. If your organization uses an SSL-intercepting proxy or TLS inspection, the Function App may fail with certificate verification errors. In that case, the proxy must pass through traffic to these domains without inspection, or you must add your organization's root CA certificate to the Function App's certificate store.

Troubleshooting & Common Issues

No Data Appearing in Tables

If you do not see data in your custom tables after deployment:

1. Verify the Function App status is Running (Check the Function App Status).
2. Check the Function App logs for errors (View Function Execution Logs).
3. Confirm the App Registration has the Log Analytics Contributor, Monitoring Contributor and Monitoring Metrics Publisher roles assigned.
4. Ensure the IPINFO_TOKEN is valid and has the correct plan access.
5. Allow up to 15 minutes after the first function execution for data to appear in Log Analytics.

HTTP 403 Forbidden Error

This typically means the App Registration is missing the required role assignment.

1. Go to the resource group > Access control (IAM).
2. Verify that your App Registration has Log Analytics Contributor, Monitoring Contributor and Monitoring Metrics Publisher roles.
3. If the role was just assigned, wait a few minutes for propagation and trigger the function again.

HTTP 401 Unauthorized Error

This indicates an authentication failure.

1. Verify the CLIENT_SECRET has not expired in the App Registration.
2. Confirm the TENANT_ID and CLIENT_ID are correct.
3. Verify the IPINFO_TOKEN is valid by testing it at https://ipinfo.io/me?token=YOUR_TOKEN.

Function Timeout

Some connectors process large datasets and may take several hours to complete. The connectors run on an Elastic Premium (EP2) plan which supports long-running executions. If a function appears to time out:

1. Check Application Insights for any memory or execution errors.
2. Verify the Function App plan is EP2 (not Consumption/Y1, which has a 10-minute limit).
3. Review the Function App configuration to ensure the functionTimeout setting is not set to a low value.

Duplicate or Missing Data

If data appears duplicated or incomplete:

1. Check whether the function was triggered multiple times (review Application Insights for overlapping executions).
2. Verify the timer trigger schedule in the function configuration.
3. For missing data, review the function logs to confirm the dataset download completed successfully.

Deployment Failure

If the ARM template deployment fails:

1. Review the deployment error details in the Azure Portal under the resource group > Deployments.
2. Ensure all required parameters were provided and correctly formatted.
3. Verify the RESOURCE_ID follows the correct format: /subscriptions/{sub-id}/resourceGroups/{rg}/providers/Microsoft.OperationalInsights/workspaces/{name}
4. Ensure you have Contributor permissions on the target resource group.

Client Secret Expired

Secrets have a limited lifespan (6 months, 1 year, or 2 years). When expired, the function silently fails.

Symptoms: HTTP 401 errors after weeks/months of normal operation.

Fix:

1. Entra ID → App registrations → your app → Certificates & secrets → create a new secret.
2. Function App → Configuration → update CLIENT_SECRET → Save → restart.

Prevention: Set a calendar reminder before expiry.

Resource Provider Not Registered

Symptoms: Deployment fails with MissingSubscriptionRegistration or "not registered to use namespace 'Microsoft.Insights".

Fix: Go to Subscriptions → your subscription → Resource providers → register Microsoft.Insights, Microsoft.Web, and Microsoft.OperationalInsights.

Storage Account Firewall Issues

Symptoms: Function App shows Error status or fails to start.

Fix: Navigate to the Storage Account → Networking → set Public network access to Enabled from all networks, or add the Function App's outbound IPs.

Redeployment Conflicts

Symptoms: Deployment fails with "Resource already exists".

Fix: Delete the previous Function App, DCR, DCE, and Storage Account from the resource group before redeploying, or use a different Function App name.

Monitoring Database Downloads

To verify that your connector is regularly downloading and ingesting fresh data, use either of these methods:

Method 1: Data Freshness Query

In your Log Analytics Workspace, run the following KQL query (replace the table name with your connector's table):

Ipinfo_ASN_CL
| summarize LastIngestion = max(TimeGenerated)

If the timestamp is recent (within the last 24 hours for a daily schedule), downloads and ingestion are working normally. If the timestamp is stale, check the Function App logs for errors.

Method 2: Application Insights

Open the Application Insights resource linked to your Function App and run:

traces
| where timestamp > ago(7d)
| where message has "downloaded successfully" or message has "Failed to download"
| project timestamp, message
| order by timestamp desc

Successful runs will show messages confirming the file was downloaded. Failed downloads will show error messages, often indicating an invalid or expired IPinfo token.

If no download messages appear at all, the Function App may not be running — verify its Status is Running in the Azure Portal.

Change Database Download Schedule

Each connector comes pre-configured with a default schedule that runs daily at 9:30 AM UTC. No manual schedule setup is required.

IPinfo datasets are updated once per day. Running the connector more frequently than daily provides no new data and only increases compute costs. But if you want to change the cron schedule:

1. In the Azure Portal, navigate to your Function App.
2. Go to Settings > Configuration.
3. Find the SCHEDULE application setting. The value is a cron expression in NCRONTAB format (six fields).
4. Edit the value, click Save, then restart the Function App.

Key Azure Portal Paths

We welcome your feedback, and if you have any feature requests or need support using the IPinfo Microsoft Sentinel integration, please create a post in our IPinfo Community or contact support@ipinfo.io.