Enter the IP address in the Search field.You can filter the results of this section by time period the default period is 30 days.

The Prevalence section displays how many devices have connected to this IP address, and when the IP was first and last seen. The IP observed in organization section provides a list of devices that have a connection with this IP and the last event details for each device (the list is limited to 100 devices). The Alerts related to this IP section provides a list of alerts that are associated with the IP. In the left pane, the page provides IP details (if available). You can find information from the following sections in the IP address view: Identifying all devices in the organization that communicated with a suspected or known malicious IP address, such as Command and Control (C2) servers, helps determine the potential scope of breach, associated files, and infected devices.

Want to experience Defender for Endpoint? Sign up for a free trial.Įxamine possible communication between your devices and external internet protocol (IP) addresses.

Advanced ip address lookup