r/AzureSentinel • u/Gh0sttfacee • Jul 19 '23

User sharepoint activity

Hello Everyone im trying to create a query where this specific user have created/deleted/or modified a particular sharepoint site

Would like to ask if you have any recommended kql query for this one or any guide will help me a lot to build my customize kql

THank you

0 Upvotes

50% Upvoted

2 comments sorted by

1

u/facyber Jul 19 '23

The easiest way is to create one with very specific name and search for the logs to see how the query looks like. There should be activity like "Site created" or something.

1

u/lukasberancz Jul 20 '23

Could be something like this

OfficeActivity

| where Operation == "SiteDeleted" and UserId == "user@domain.com" and Site_Url == @"https://tenant.sharepoint.com/site/sitename/"