KQL Search

This KQL (Kusto Query Language) query is designed to filter and extract specific information from audit logs related to directory management activities. Here's a simple breakdown of what the query does:

1. Data Source: It starts by looking at the AuditLogs table.

2. Filter by Category: It filters the logs to only include those in the "DirectoryManagement" category.

3. Filter by Operation: It further narrows down the logs to those where the operation performed was "Create Company".

4. Filter by Result: It only considers logs where the result of the operation was "success".

5. Extract Information:

   • It extracts the AccountID from the InitiatedBy.user field, which represents the ID of the user who initiated the operation.
   • It extracts the InitiatingIPAddress from the same field, representing the IP address of the user who initiated the operation.
   • It extracts the InitiatingUPN (User Principal Name) from the same field, representing the user's principal name.
   • It extracts the CreatedTenantID from the TargetResources array, which represents the ID of the tenant that was created.

In summary, this query identifies successful "Create Company" operations in directory management logs and extracts relevant details about the user who initiated the operation and the tenant that was created.