Forum Discussion
Sentinel to Detect Storage Account Created
Hi Everyone,
When trying to generate query to show storage account when they are created, I'm having bad luck of not been able to see it in Sentinel. The KQL query I have is:
AzureActivity
| where ResourceProviderValue == "MICROSOFT.STORAGE"
| where OperationNameValue == "Microsoft.Storage/storageAccounts/write"
When the query is running, it generate no output. Even if take away "| where OperationNameValue == "Microsoft.Storage/storageAccounts/write"", I can see the storage account but not specifically when I spun up a test storage account to detect it.
I'll appericate if anyone can help me get this query to work.
Side note: I have Azure Monitor Alert enable and I get email but I want those alerts to be shown in Sentinel as an incident.
2 Replies
How about this:
AzureActivity | where ResourceProviderValue == "Microsoft.Storage" | where OperationNameValue has "write" | where ActivityStatusValue == "Succeeded" | where Properties has "storageAccounts" | project TimeGenerated, ResourceGroup, Resource, Caller, OperationNameValue, ActivityStatusValueThanks for reading my post. I'll definitely test it and I'll let you know.
