mirror of
https://github.com/marcredhat/kql
synced 2026-06-08 13:23:58 +00:00
marc
9 lines
422 B
Plaintext
9 lines
422 B
Plaintext
AuditLogs
|
|
| where TimeGenerated > ago(1d)
|
|
| where OperationName has_any ("Add service principal","Certificates and secrets management")
|
|
| extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
|
|
| join kind=inner (
|
|
SigninLogs | where ResultType == 0 and TimeGenerated > ago(1d)
|
|
| project LoginTime = TimeGenerated, Identity, IPAddress, AppDisplayName
|
|
) on $left.Actor == $right.Identity
|