Detection Enrichment - Entra User

Description

Sentinel Data Lake job to put an aggregated table of entra users in LAW for filtering/enrichment in detections and automations.

Query · kql

EntraUsers
| where TimeGenerated > ago(3d)
| summarize arg_max(TimeGenerated, * ) by id
| project-away _*
| project-rename ObjectId = id
Raw source Detection Enrichment - Entra User · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Detection Enrichment - Entra User

## Query Information

#### Description
Sentinel Data Lake job to put an aggregated table of entra users in LAW for filtering/enrichment in detections and automations.

#### References
- https://learn.microsoft.com/en-us/azure/sentinel/datalake/enable-data-connectors


## Sentinel
```KQL
EntraUsers
| where TimeGenerated > ago(3d)
| summarize arg_max(TimeGenerated, * ) by id
| project-away _*
| project-rename ObjectId = id
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.