Forum Discussion
Query to Fetch Sentinel Admin Activities from Sentinel
Hello,
I would like to know if there is a specific query available to fetch Sentinel admin activities directly from Sentinel itself.
Thank you!
Does this work for you?
AzureActivity | where CategoryValue == "Administrative" | where OperationNameValue has "MICROSOFT.OPERATIONALINSIGHTS"
SteveBostedorMicrosoft
Does this work for you?
AzureActivity | where CategoryValue == "Administrative" | where OperationNameValue has "MICROSOFT.OPERATIONALINSIGHTS"
