Forum Discussion
Log Analytics query filter select multiple accounts
Hi,
I want to setup a query and create an alert for (failed) signin attempts of multiple service accounts. I collect the signin attempts in Log Analytics and use this query to filter:
SigninLogs | where OperationName == "Sign-in activity" | where UserPrincipalName == "auobrien.david@outlook.com"
The problem is, I want to use this for multiple service accounts and I can't use a wildcard like auobrien.*@outlook.com for example. Any idea's on how to specify multiple accounts or do I have to create a query for each account I want to monitor?
marwedit, you just have to add a different condition to the query:
SigninLogs
| where OperationName == "Sign-in activity" and (UserPrincipalName in~ ('auobrien.david@outlook.com','john.doe@outlook.com','mary.jones@outlook.com') or UserPrincipalName startswith "svc_")
See here a full list of the string operators you can use.
Hope that helps!
4 Replies
hspinto Thanks for the reply! I tried it and it works great. Thanks! This tackles the multiple query problem since I can put multiple users in one. One more question. Do you know of a way I could enter a wildcard in the filter so new service accounts (svc_*) are automatically added? When I replace part of the username with * it just ignores it.
- hspinto
Microsoft
marwedit, you just have to add a different condition to the query:
SigninLogs
| where OperationName == "Sign-in activity" and (UserPrincipalName in~ ('auobrien.david@outlook.com','john.doe@outlook.com','mary.jones@outlook.com') or UserPrincipalName startswith "svc_")
See here a full list of the string operators you can use.
Hope that helps!
