KQL Search

This document provides a set of KQL (Kusto Query Language) queries designed to monitor changes in Active Directory Group Policy Objects (GPOs). The queries are a work in progress and aim to track various types of changes related to GPOs using Microsoft Defender XDR.

Here's a summary of each query:

1. New Group Policy Object Creations:

   • This query identifies when a new Group Policy Object is created in Active Directory.
   • It extracts and displays the timestamp, name, ID, and domain of the newly created GPO.

2. Group Policy Object Settings Changes:

   • This query detects changes made to the settings of existing Group Policy Objects.
   • It extracts and displays the timestamp, name, ID, and domain of the GPO whose settings were changed.

3. Group Policy Object Name Changes:

   • This query captures changes to the display name of Group Policy Objects.
   • It shows the timestamp, account details, and the old and new display names of the GPO.

4. Group Policy Object Deletions:

   • This query identifies when a Group Policy Object is deleted.
   • It checks for events where the action type indicates a deletion and further filters for objects classified as "groupPolicyContainer."

These queries help administrators monitor and audit changes to Group Policy Objects in an Active Directory environment, providing insights into security and configuration management.