KQL Search

Query Details

HomeAI ToolsDevice Query

Audit List Bulk Activities

Query

//List the bulk activities attempted by your privileged Azure AD users and parse the results

//Data connector required for this query - Azure Active Directory - Audit Logs

AuditLogs
| where OperationName has_all ("(bulk)", "finished")
| extend Actor = tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)
| project TimeGenerated, Actor, ResultDescription, OperationName
| parse ResultDescription with * "Total activities count:" ['Total Activity Count'] ";" *
| parse ResultDescription with * "succeeded activities count" ['Total Succeeded'] ";" *
| parse ResultDescription with * "failed activities count" ['Total Failed']
| project
    TimeGenerated,
    Actor,
    OperationName,
    ['Total Activity Count'],
    ['Total Succeeded'],
    ['Total Failed']

Explanation

This query lists the bulk activities attempted by privileged Azure AD users and parses the results. It uses the Azure Active Directory - Audit Logs data connector. The query retrieves the time generated, actor, result description, operation name, total activity count, total succeeded count, and total failed count for each activity.

Details

Matt Zorich profile picture

Matt Zorich

Released: June 17, 2022

Tables

AuditLogs

Keywords

AuditLogs,OperationName,ResultDescription,InitiatedBy.user,TimeGenerated,Actor,['TotalActivityCount'],['TotalSucceeded'],['TotalFailed']

Operators

has_allextendtostringparse_jsonprojectparsewith['Total Activity Count']['Total Succeeded']['Total Failed']

Actions