mirror of
https://github.com/marcredhat/kql
synced 2026-06-08 13:23:58 +00:00
marc
14 lines
692 B
Plaintext
14 lines
692 B
Plaintext
let auditLookback = ago(14d);
|
|
let baseline = AuditLogs
|
|
| where TimeGenerated between(auditLookback..ago(1d))
|
|
| extend InitiatedByApp = tostring(parse_json(tostring(InitiatedBy.app)).displayName)
|
|
| where isnotempty(InitiatedByApp)
|
|
| summarize by OperationName, InitiatedByApp;
|
|
AuditLogs
|
|
| where TimeGenerated >= ago(1d)
|
|
| extend InitiatedByApp = tostring(parse_json(tostring(InitiatedBy.app)).displayName)
|
|
| extend InitiatedByUser = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
|
|
| extend Actor = iff(isnotempty(InitiatedByApp), InitiatedByApp, InitiatedByUser)
|
|
| where isnotempty(Actor)
|
|
| join kind=leftanti baseline on $left.OperationName == $right.OperationName
|