Initial commit: KQL ↔ SDL PowerQuery proof of equivalence

2026-06-10 22:11:18 +00:00 · 2026-06-01 09:57:14 +02:00
commit 23cbaa9c08
91 changed files with 5966 additions and 0 deletions
@@ -0,0 +1,11 @@
+let SensitiveOps = dynamic([
+    "microsoft.compute/snapshots/write",
+    "microsoft.network/networksecuritygroups/write",
+    "microsoft.storage/storageaccounts/listkeys/action"]);
+let threshold = 5;
+AzureActivity
+| where OperationNameValue in~ (SensitiveOps)
+| where ActivityStatusValue =~ "Success"
+| where TimeGenerated >= ago(1d)
+| summarize ActivityCount = count() by CallerIpAddress, Caller, OperationNameValue
+| where ActivityCount >= threshold