Query

let ApplicationInformation = externaldata (ApplicationName: string, AppId: string, Reference: string ) [h"https://raw.githubusercontent.com/Beercow/Azure-App-IDs/master/Azure_Application_IDs.csv"] with (ignoreFirstRecord=true, format="csv");
MicrosoftGraphActivityLogs
// Your filter here
| take 1000
| lookup kind=leftouter ApplicationInformation on $left.AppId == $right.AppId
| project-reorder AppId, ApplicationName

About this query

MicrosoftGraphActivityLogs App Enrichment ExternalData Based

Query Information

Description

This query enriches the MicrosoftGraphActivityLogs with Application information Using the Azure_Application_ID list developed by @Beercow 1000+ AppIds can be enriched with the externaldata operator resulting in the query below.

References

Sentinel

Explanation

This query is designed to enhance the data from Microsoft Graph Activity Logs by adding information about applications. It uses an external data source, a CSV file hosted on GitHub, which contains a list of application names and their corresponding IDs. The query performs the following steps:

Load External Data: It retrieves application information from a CSV file hosted on GitHub. This file contains columns for application names, IDs, and references.
Filter Activity Logs: It accesses the Microsoft Graph Activity Logs and applies a filter to limit the results to 1000 entries. (Note: The specific filter criteria are not provided in the query and should be added where indicated.)
Enrich Data: It uses a lookup operation to match and merge the application information from the external data with the activity logs based on the application ID.
Reorder Columns: Finally, it rearranges the columns to display the application ID and name first.

In simple terms, this query takes activity logs, adds detailed application information from an external source, and organizes the data for easier analysis.

KQL Search