Detection Enrichment - Entra Group Membership Enriched

Description

Sentinel Data Lake job to put an aggregated table of group memberships in LAW for filtering/enrichment in detections and automations.

Query · kql

EntraGroupMemberships
| where TimeGenerated > ago(3d)
| summarize arg_max(TimeGenerated, *) by sourceId, targetId
| join kind=leftouter (EntraGroups | where TimeGenerated > ago(3d) |  summarize arg_max(TimeGenerated, TimeGenerated, description, displayName, groupTypes, mailNickname) by id ) on $left.sourceId == $right.id
| project GroupId = sourceId, ObjectId = targetId, tenantId, organizationId, GroupDescription = description, GroupDisplayName = displayName, groupTypes, mailNickname
Raw source Detection Enrichment - Entra Group Membership Enriched · KQL
Esc
Published by Bert-JanP/Hunting-Queries-Detection-Rules ↗, licensed under BSD 3-Clause ↗. Reproduced here unmodified. 
# Detection Enrichment - Entra Group Membership Enriched

## Query Information

#### Description
Sentinel Data Lake job to put an aggregated table of group memberships in LAW for filtering/enrichment in detections and automations.

#### References
- https://learn.microsoft.com/en-us/azure/sentinel/datalake/enable-data-connectors


## Sentinel
```KQL
EntraGroupMemberships
| where TimeGenerated > ago(3d)
| summarize arg_max(TimeGenerated, *) by sourceId, targetId
| join kind=leftouter (EntraGroups | where TimeGenerated > ago(3d) |  summarize arg_max(TimeGenerated, TimeGenerated, description, displayName, groupTypes, mailNickname) by id ) on $left.sourceId == $right.id
| project GroupId = sourceId, ObjectId = targetId, tenantId, organizationId, GroupDescription = description, GroupDisplayName = displayName, groupTypes, mailNickname
```

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.