Kusto Query Language - Microsoft Defender IP Subnet Query

Question

Is there a way to query for IP ranges from the DeviceEvent table using IP subnet notation i.e. 1.1.1.0/24 vs. listing individual IPs 1.1.1.1?

Instead of list inididual IPs for

| where LocalIP == "1.1.1.1"

I would like to list subnet range "1.1.1.1 - 1.1.1.255" or "1.1.1.0/24"

Answer 1

datatable(LocalIP:string)["1.1.0.255", "1.1.1.0", "1.1.1.179", "1.1.1.255", "1.129.13.42", "2.0.0.0"]
| where ipv4_is_in_range(LocalIP, "1.1.1.0/24")

LocalIP
1.1.1.0
1.1.1.179
1.1.1.255

Fiddle