KQL Search

This query is designed to help you investigate user logon activity on Linux devices over the past 24 hours, with a focus on SSH-based access. Here's a simple breakdown of what the query does:

1. Identify Linux Devices: It first identifies all devices running Linux by checking the operating system platform in the DeviceInfo table and collects their unique DeviceIds.

2. Filter Logon Events: It then looks at the DeviceLogonEvents table to find logon events that occurred within the last 24 hours on these Linux devices.

3. Select Relevant Information: For each logon event, it selects key details such as the timestamp, device name, action type, account name and domain, logon type, and information about the initiating process (like the file name and command line).

4. Sort the Results: Finally, it orders these events by timestamp in descending order, so the most recent logon activities appear first.

This query is particularly useful for investigating SSH access, detecting unexpected interactive logons, and correlating user sessions with other activities like process or network events. Typical activities you might see include SSH logons, local user sessions, and actions by automation accounts.