KQL Search

This KQL (Kusto Query Language) query is designed to detect successful additions of device-bound passkeys (security keys) in the Entra system. Here's a simple summary of what the query does:

1. Source Table: It looks at the AuditLogs table.
2. Filter by Activity: It filters the logs to find entries where the activity is "Add Passkey (device-bound) security key".
3. Filter by Result: It further filters these entries to only include those where the result was "success".
4. Extract Information: It extracts additional details from these logs:
   • AccountUPN: The user principal name (UPN) of the account associated with the activity.
   • AAGUID: A unique identifier for the security key.
   • WebAuthnInfo: Additional Web Authentication information.
5. Select Columns: It selects and displays the following columns in the result:
   • TimeGenerated: The time the log entry was generated.
   • AccountUPN: The user principal name.
   • ActivityDisplayName: The name of the activity.
   • AAGUID: The unique identifier for the security key.
   • WebAuthnInfo: Additional Web Authentication information.

In essence, this query helps identify when and by whom a device-bound passkey was successfully added, along with some specific details about the security key and the authentication process.