Storage Account

For caller IP different than 10.253.

StorageFileLogs
| where AccountName == "stfileshareunitedkingdom"
| where CallerIpAddress !contains "10.253"
| summarize CallerIpAddress = make_set(CallerIpAddress) by AccountName
| mv-expand CallerIpAddress

For caller IP different than RFC1918

StorageFileLogs
| where AccountName == "stfileshareunitedkingdom"
//| where CallerIpAddress !contains "10.253"
| where not (CallerIpAddress matches regex @"^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.")
| summarize CallerIpAddress = make_set(CallerIpAddress) by AccountName
| mv-expand CallerIpAddress