KQL Search

This query is designed to monitor potential data exfiltration activities through the Microsoft Graph API, specifically related to a tool or feature referred to as "Copilot." Here's a simple breakdown of what the query does:

1. Define Commands: It starts by defining a list of specific commands or actions (interactionHistory and getAllEnterpriseInteractions) that are associated with potential data exfiltration activities.

2. Filter Logs: It looks at the MicrosoftGraphActivityLogs, which are logs of activities performed using the Microsoft Graph API.

3. Time Frame: It filters these logs to only include activities that have occurred within the last hour.

4. Parse URL: It extracts and parses the URL from the RequestUri field in the logs to analyze the specific actions being requested.

5. Identify Suspicious Activity: Finally, it checks if any of the parsed URLs contain the defined suspicious commands. If they do, these entries are flagged as potential data exfiltration activities.

In summary, this query is used to detect recent activities that might indicate unauthorized data access or transfer using specific Graph API commands related to "Copilot."