Blog Post

Microsoft Sentinel Blog
4 MIN READ

Hunting the Clues- Azure Sentinel Administrative Suspicious Activities Library

Hesham_Saad's avatar
Hesham_Saad
Icon for Microsoft rankMicrosoft
Jul 21, 2020
Azure Activity logs  provides insight into any subscription-level or management group level events that have occurred in Azure, there are three main categories covered under Azure Activity and a bunc...
Updated Nov 03, 2021
Version 5.0
detection
hunting
microsoft sentinel
53CU1t's avatar
53CU1t
Copper Contributor
May 24, 2022

The Qeries don't work for me if i export all subscription audit logs to the sentinel workspace.

This only works for me.

AzureActivity
| where OperationNameValue == "MICROSOFT.NETWORK/NETWORKSECURITYGROUPS/SECURITYRULES/WRITE"
| where ActivitySubstatusValue == "Created"

 

Can someone share working kql queries? 

Why is azure monitor recommended for this kind of detections from CIS and not Sentinel?

 

Thanks.

Kind Regards

Sebastian