IP Functions are Generally Available, bringing high-performance network analytics to the Lakehouse

Every firewall, load balancer, VPN, CDN edge, DNS resolver, Kubernetes cluster, and application server all emit a stream of records keyed on one thing: an IP address. For a large enterprise, these streams collectively generate tens of billions of events a day and are the foundation of some of the most valuable analytics an organization runs, including threat detection, fraud investigation, and network observability. Historically, the industry treated these network observability use cases as specialized use cases that required a specialized stack, leading to silos, fragmented governance, and lock-in.

That changes now. Today, IP Functions are available Generally Available. With this launch, IP address analytics becomes a first-class, high-performance SQL workload on the lakehouse, letting security teams parse, enrich, and analyze their highest-volume IP data alongside the rest of their analytics, under one governance model.

Why network analytics used to be painful

In the past, IP addresses were deceptively hard to handle in SQL. An IPv4 address looks like a string but behaves like a 32-bit integer; IPv6 is 128 bits. A CIDR block like 10.0.0.0/8 isn't a value at all - it's a range of 16 million addresses. Asking "is this IP inside that subnet?" is a range containment problem hiding behind a piece of text.