KQL Search

This query is part of a workbook designed for analyzing various aspects of Azure Active Directory (Azure AD), Office 365, and Microsoft Sentinel data. It is structured to provide insights through different tabs, each focusing on specific areas of interest. Here's a simplified breakdown:

1. Tabs for Navigation: The workbook is organized into tabs, each representing a different focus area:

   • Azure AD Sign-Ins
   • Azure AD Audit
   • MFA Analytics
   • Office 365 Analytics
   • Sentinel Analytics

2. Time Range Parameter: The workbook includes a parameter to select the time range for the data analysis. The default duration is set to 30 days, but other options range from 3 days to 90 days.

3. Azure AD Sign-Ins Tab: This section includes queries that:

   • Count total Azure AD sign-ins per day.
   • Analyze conditional access policy failures.
   • Track risk event types per day.
   • Compare password vs. passwordless sign-ins.

4. Azure AD Audit Tab: This section includes queries that:

   • Track self-service password resets and account unlocks.
   • Compare guest invites sent vs. redeemed.
   • Identify top domains redeeming guest invites.

5. Sentinel Analytics Tab: This section includes queries that:

   • Analyze Microsoft Sentinel incident severity per day.
   • List top Sentinel incidents triggered.
   • Identify Sentinel incidents not recently triggered.

6. Office 365 Analytics Tab: This section includes queries that:

   • Compare file uploads vs. downloads in Office 365. - Track guests added vs. removed from Teams.
   • Identify top guest domains downloading from Office 365. - List top malicious domains with phishing emails removed.
   • Identify top users targeted by phishing.

7. MFA Analytics Tab: This section includes queries that:

   • Compare MFA challenges vs. previously satisfied MFA per day.
   • Analyze MFA methods used per day.
   • Break down MFA methods by type.
   • Identify most popular apps with the least MFA coverage.

Each query is designed to provide visual insights through charts and tables, helping users understand trends and patterns in their Azure AD, Office 365, and Sentinel data.