借助 Google Security Operations，您可以调查特定的 IP 地址，以确定您的企业是否存在任何 IP 地址，以及这些外部系统可能对您的资产产生的影响。Google SecOps IP 地址视图派生自企业转发的同一安全信息和数据，并且可以使用“资产”视图进行检查。确保从网络上的设备（例如 EDR、防火墙、Web 代理等）提取和规范化数据。
从“资产”视图开始，您可以从企业内部开始调查并展开调查。从 IP 地址视图中，您可以从企业外部开始调查，然后查看。
如需访问 Google SecOps 中的 IP 地址视图，请完成以下步骤：
在 Google SecOps 着陆页上，于搜索栏中输入 IP 地址。点击搜索。
点击结果中的 IP 地址，打开 IP 地址视图。
IP 地址上下文
“IP 地址”视图
1 普及率
Google SecOps 以图形形式呈现了给定 IP 地址的历史普及率。此图表可用于确定之前是否从企业内部访问过该 IP 地址，并指示该 IP 地址是否与针对企业的特定广告系列相关联。
通常，不太常见的 IP 地址（即已关联较少的 IP 地址）可能对您的企业构成更大的威胁。与“资产”视图中的普及率图表不同，此图在图表顶部显示高普及率，在底部显示低普及率。
当您将指针悬停在普及率图表中的某个条形上时，该图表会列出访问过相应 IP 地址的资产。由于 DNS 服务器非常普遍，因此未列出。如果所有资产都是 DNS 服务器，则不会列出任何资产。
2 普及率图表的滑块
调整滑块，以重点关注与特定日期范围相关的事件，如普及率图所示。
3 IP 地址数据洞察
IP 地址分析结果为您提供了更多有关所调查 IP 地址的背景信息。您可以使用它们来确定 IP 地址是良性还是恶意。还可以让您进一步调查指示因素，以确定是否存在更大的危害。
ET 情报代表名单：根据 ProofPoint 的新兴威胁 (ET) 情报代表名单进行检查。列出与特定 IP 地址和网域相关的已知威胁。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-02。"],[[["\u003cp\u003eGoogle Security Operations allows for the investigation of IP addresses to assess their presence and impact on an enterprise's assets.\u003c/p\u003e\n"],["\u003cp\u003eThe IP address view in Google Security Operations provides insights into outside systems, contrasting with the Asset view that focuses on internal systems.\u003c/p\u003e\n"],["\u003cp\u003eThe prevalence graph within the IP address view visually represents the historical activity of a given IP address, highlighting potential threats through connection frequency.\u003c/p\u003e\n"],["\u003cp\u003eIP address insights, including checks against the ET Intelligence Rep List and ESET Threat Intelligence, help determine if an IP address is benign or malicious.\u003c/p\u003e\n"],["\u003cp\u003eThe IP address view is limited to filtering events for DNS, EDR and Webproxy event types only, and generic events are not populated in the curated view.\u003c/p\u003e\n"]]],[],null,["# Investigate an IP address\n=========================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nGoogle Security Operations enables you to investigate specific IP addresses to determine\nif any are present within your enterprise and what impact these outside systems\nmight have had on your assets. The Google SecOps **IP address** view is derived\nfrom the same security information and data forwarded from your enterprise and\ncan examine using Asset view. Make sure you are ingesting and normalizing data\nfrom devices on your network, such as EDR, firewall, web proxy, etc.\n\nFrom Asset view, you begin your investigation from within your enterprise and\nlook outward. From **IP address** view, you begin your investigation from outside\nyour enterprise and look in.\n\nTo access **IP address** view in Google SecOps, complete the following steps:\n\n1. On the Google SecOps landing page, enter the IP address in the search bar. Click **Search**.\n2. Click the IP address in the results to open **IP address** view.\n\n| **Note:** [UDM search](/chronicle/docs/investigation/udm-search) provides enhanced capabilities that let you conduct more thorough investigations of the events and alerts within your Google SecOps instance than is possible using **IP address** view alone. For more information, see [UDM search](/chronicle/docs/investigation/udm-search).\n\nIP Address context\n------------------\n\n**IP Address view**\n\n#### 1 Prevalence\n\nGoogle SecOps provides a graphical representation of the historical\nprevalence of a given IP address. This graph can be used to determine whether\nthe IP address has been accessed from within the enterprise before, and can\nprovide an indication of whether the IP address is associated with a particular\ncampaign targeting the enterprise.\n\nTypically, less prevalent IP addresses, ones that fewer assets have connected\nto, might represent a greater threat to your enterprise. Unlike the *Prevalence*\ngraph in Asset view, the graph this figure shows a high prevalence access at the\ntop of the graph, and low prevalence access at the bottom.\n\nWhen you hold the pointer over a bar in the **Prevalence** graph, the graph\nlists the assets that accessed the IP address. Due to the high prevalence of DNS\nservers, they aren't listed. If all of the assets are DNS servers, no assets are\nlisted.\n\n#### 2 Slider for Prevalence graph\n\nAdjust the slider to focus on events tied to a specific range of dates as shown\nin the Prevalence graph.\n\n#### 3 IP Address insights\n\nIP address insights provide you with more context about the IP address under\ninvestigation. You can use them to determine whether an IP address is benign or\nmalicious. They also provide you with the ability to further investigate an\nindicator to determine if there is a broader compromise.\n\n- ET Intelligence Rep List: Checks against ProofPoint's Emerging Threats (ET)\n Intelligence Rep List. Lists known threats tied to specific IP addresses and\n domains.\n\n- [ESET Threat\n Intelligence](https://www.eset.com/us/):\n Checks against ESET's threat intelligence service.\n\n#### 4 VT Context\n\nClick **VT Context** to view the VirusTotal information available for this IP\naddress.\n\nConsiderations\n--------------\n\nIP address view has the following limitations:\n\n- You can only filter events that are displayed in this view.\n- Only DNS, EDR, Webproxy event types are populated in this view. The first seen and last seen information populated in this view is also limited to these event types.\n- Generic events don't appear in any of the curated views. They appear only in raw log and UDM searches.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
“IP 地址”视图