KQL Search

This query is analyzing data security events over the past week to identify potentially risky activities related to file handling. Here's a breakdown of what it does:

1. Filter by Time: It looks at events that have occurred in the last 7 days.

2. Filter by Action Type: It focuses on specific actions that involve files, such as uploading files to the cloud, copying to removable media, printing, sending in emails, sharing externally, downloading from SharePoint, and syncing to personal cloud storage.

3. Summarize Data: For each user (identified by AccountUpn) and action type, it calculates:

   • The total number of events (Events).
   • The distinct count of files involved (Files).
   • A set of up to 5 different applications used (Apps).
   • A set of up to 5 different workloads involved (Workloads).
   • The first and last time the action was seen (FirstSeen and LastSeen).

4. Filter for Significant Activity: It only keeps records where there are at least 10 distinct files involved or at least 25 events.

5. Order Results: Finally, it orders the results by the number of events in descending order, highlighting the most active or potentially risky users and actions first.

In simple terms, this query is used to monitor and identify users who have been involved in significant file-related activities that might pose a security risk, focusing on those with high activity levels.