KQL Search

// This query can help you to obtain which accounts in IdentityInfo table have privileged groups or roles, according to values specified in certain Watchlists.
// IdentityInfo table renews itself completely every ~14 days.
//
// Click "Save as function", in Parameters write in the fields:
// "datetime"  "start_time"  "14d"
// "datetime"  "end_time"    "time(null)"
//
// If you name the function "PrivilegedIdentityInfo", you can check the function with queries like the following:
//
// PrivilegedIdentityInfo
//
// PrivilegedIdentityInfo(26d, 12d)
//
//let Function = (start_time:timespan = 14d, end_time:timespan = time(null)){
let _PrivilegedGroupRegex = toscalar(
    union
        (_GetWatchlist("SID-AuditADObjects")
        | where Notes has_any ("[Privileged]", "[Unpopulated]")
        | project RegEx = regex_quote(SAMAccountName)
        ),
        (_GetWatchlist("RegEx-PrivDomainGroups")
        | project RegEx
        )
    | summarize RegEx = make_set(RegEx)
    | extend RegEx = strcat(@"^(", strcat_array(RegEx, "|"), @")$")
);
let _PrivilegedRoleRegex = toscalar(
    _GetWatchlist("RegEx-PrivAADRoles")
    | summarize RegEx = make_list(RegEx)
    | extend RegEx = strcat(@"^(", strcat_array(RegEx, "|"), @")$")
);
IdentityInfo
| where TimeGenerated between (ago(start_time) .. ago(end_time))
| summarize arg_max(TimeGenerated, *) by AccountObjectId, AccountSID
| mv-expand GroupMember = GroupMembership to typeof(string), AssignedRole = AssignedRoles to typeof(string)
| where GroupMember matches regex _PrivilegedGroupRegex or AssignedRole matches regex _PrivilegedRoleRegex
| project-away GroupMember, AssignedRole
| summarize take_any(*) by AccountObjectId, AccountSID
//};
//Function(14d, time(null))