View Query Audit Logs in Microsoft Sentinel

#loganalytics #kql #sentinel #microsoftsentinel #microsoftsecurity #microsoft

📌 View Query Audit Logs in Microsoft Sentinel

At times, we need to know
production environment either
➡️ Who has performed what query.
➡️ Was there a query performed by same user regularly.
➡️ Queries performed in last 1 day, 7days or 14 days etc.

To know all there we can enable audit with diagnostics settings in Log Analytics.

To extend further we can leverage Log Analytics Query Analysis workbook which is equipped with come of the prebuilt queries.

💡 This same query can be leveraged as Hunting query or Detection Rule when you need it.

Leverage this feature and share your thoughts. 🤔

[sarathkumaras]

Hi bro, can you help me with a KQL query to know who has done a " role assignment" for a given user