AIR investigation actions insight

Description

This query provides insights into AIR investigation actions in Microsoft Defender for Office 365.

Query · kql

CloudAppEvents
| where ActionType == "AirInvestigationData"
| project Timestamp, RawEventData
| extend EventData = parse_json(RawEventData)
| extend Data = parse_json(tostring(EventData.Data))
| extend InvestigationType = EventData.InvestigationType
| extend InvestigationId = RawEventData.InvestigationId
| extend Status = tostring(Data.Status)
| where Status == "Resolved"
| extend ActionRaw = parse_json(tostring(EventData.Actions))
| mv-expand ActionRaw
| extend Action = parse_json(tostring(ActionRaw))
| extend ActionType=Action.ActionType, ActionApproval=Action.ActionApproval, ApprovedBy=Action.ApprovedBy, ApproverComment=Action.ApproverComment, ActionStatus=Action.ActionStatus
| mv-expand Action.Entities
| extend EntityQuery = Action_Entities.Query
| mv-expand Action_Entities.Urls, Action_Entities.NetworkMessageIds
| sort by Timestamp
| project Timestamp, InvestigationType, InvestigationId, ActionType, ActionApproval, ApprovedBy, ApproverComment, ActionStatus, EntityQuery, Action_Entities_Urls, Action_Entities_NetworkMessageIds
Raw source AIR investigation actions insight · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 28a1ce89-ee88-47b3-872b-fb5c3c8b350c
name: AIR investigation actions insight
description: |
  This query provides insights into AIR investigation actions in Microsoft Defender for Office 365.
description-detailed: |
  This query provides insights into AIR investigation results approval actions (Approved, Declined etc.) in Microsoft Defender for Office 365.
  More information:https://learn.microsoft.com/en-us/defender-office-365/air-remediation-actions and https://learn.microsoft.com/en-us/defender-office-365/air-review-approve-pending-completed-actions
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - CloudAppEvents
tactics:
  - InitialAccess
relevantTechniques:
  - T1566
query: |
  CloudAppEvents
  | where ActionType == "AirInvestigationData"
  | project Timestamp, RawEventData
  | extend EventData = parse_json(RawEventData)
  | extend Data = parse_json(tostring(EventData.Data))
  | extend InvestigationType = EventData.InvestigationType
  | extend InvestigationId = RawEventData.InvestigationId
  | extend Status = tostring(Data.Status)
  | where Status == "Resolved"
  | extend ActionRaw = parse_json(tostring(EventData.Actions))
  | mv-expand ActionRaw
  | extend Action = parse_json(tostring(ActionRaw))
  | extend ActionType=Action.ActionType, ActionApproval=Action.ActionApproval, ApprovedBy=Action.ApprovedBy, ApproverComment=Action.ApproverComment, ActionStatus=Action.ActionStatus
  | mv-expand Action.Entities
  | extend EntityQuery = Action_Entities.Query
  | mv-expand Action_Entities.Urls, Action_Entities.NetworkMessageIds
  | sort by Timestamp
  | project Timestamp, InvestigationType, InvestigationId, ActionType, ActionApproval, ApprovedBy, ApproverComment, ActionStatus, EntityQuery, Action_Entities_Urls, Action_Entities_NetworkMessageIds
version: 1.0.0

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.