KQL Search

This KQL (Kusto Query Language) query is designed to identify potentially malicious activity related to a known security incident involving CommVault. Here's a simple breakdown of what the query does:

1. CommVaultIOC Definition: It defines a list of suspicious IP addresses (CommVaultIOC) that are associated with the CommVault security incident.

2. AzureActivityResult:

   • It queries the AzureActivity table to find any records from the last 90 days (TimeGenerated > ago(90d)) where the CallerIpAddress matches any of the IP addresses in the CommVaultIOC list.

3. SigninLogs:

   • It queries the SigninLogs table for the same 90-day period to find records where the IPAddress matches any of the IP addresses in the CommVaultIOC list.

4. Union Operation:

   • It combines the results from both the AzureActivity and SigninLogs queries into a single result set using the union operator.

In summary, this query is searching through Azure activity and sign-in logs from the past 90 days to find any entries that involve the suspicious IP addresses linked to the CommVault incident.