Forum Discussion
Solved
Fetch Sentinel admin activity
Hello, I would like to know if there is a specific query available to fetch Sentinel admin activities directly from Sentinel itself. Thank you!
There is some data in the Activity logs, here is a brief example
AzureActivity | where TimeGenerated > ago(90d) | where ResourceProviderValue =~ "Microsoft.SecurityInsights" | extend eventCategory_ = tostring(parse_json(Properties).eventCategory)
There is some data in the Activity logs, here is a brief example
AzureActivity
| where TimeGenerated > ago(90d)
| where ResourceProviderValue =~ "Microsoft.SecurityInsights"
| extend eventCategory_ = tostring(parse_json(Properties).eventCategory)