Hey - i have built up a collection of saved searches in Azure log analytics, mainly searching the SecurityAlerts, SignInLogs and OfficeActivity tables. When i get a security alert notification from Microsoft, I run my searches then export to CSV to search for indicators of compromise bla bla. This is great, somewhat quick and easy..
But is there a programmatic way of doing this?
Using the Security Graph API i can see the signIn resource type, so thats great, but i do not see exchange mailbox audit log resource, so i cannot see how to retrieve audit logs via an API..
Can i query the Log Analytics data directly through an API or is there another way to access this data programatically?
I looked at using the Azure Cloud Console, but even this didn't seem to be able to access the data..