INTERNAL_IPA_V View

This view provides a historical summary of internal IP addresses with some aggregation.

Lacework continuously monitors for internal IP addresses in your environment and returns a row in the INTERNAL_IPA_V view when Lacework detects a new key. For this view, a key is generated from the MID (machine id), IP_ADDR, START_TIME, and END_TIME. Note that the internal IP address rows are aggregated hourly. For example, if the same key is detected twice between 1:00 AM (START_TIME) and 1:59 AM (END_TIME), only one row is returned for this hour. For the next hour, the START_TIME (2:00 AM) and END_TIME (2:59 AM) are different so if the same internal IP address is detected again, a new row is returned because the key is different.

Each row contains internal IP address information as listed in the columns.

Column Name	Data Type	Description
START_TIME	Timestamp	The time and date when the hourly aggregation time period starts.
END_TIME	Timestamp	The time and date when the hourly aggregation time period ends.
IP_ADDR	Text	The internal IP address detected.
MID	Number	The Lacework-generated identifier for the machine that is assigned the IP_ADDR.