AuditLogs

← All KQL categories

Data Source

AuditLogs

4 queries tagged with this data source.

• Hunting Hunt Credential Compromise Signin Audit Alert Three Table

  Three-table credential-compromise chain: joins risky sign-ins, audit follow-up, and downstream SecurityAlert on the same user.

• Hunting Hunt Suspicious User Consented Oauth App Grants

  'The backdoor you approved yourself' — OAuth application consents granting broad Graph permissions to unfamiliar apps. Focuses on CONSENT events, not the logins that follow.

• Hunting / User Activity Whats This User Doing

  Unions `DeviceEvents`, `DeviceNetworkEvents`, and `DeviceFileEvents` to give a timestamped activity trace for a single user, including URLs touched. Swiss-army knife for user investigations — includes a Facebook-usage example.

• Identity Whos Activating Roles Via PIM

  PIM role activations from `AuditLogs` — useful for tracking privileged-role usage.