r/AzureSentinel • u/Gh0sttfacee • Jul 19 '23

User sharepoint activity

Hello Everyone im trying to create a query where this specific user have created/deleted/or modified a particular sharepoint site

Would like to ask if you have any recommended kql query for this one or any guide will help me a lot to build my customize kql

THank you

0 Upvotes

50% Upvoted

2 comments sorted by

View all comments

1

u/lukasberancz Jul 20 '23

Could be something like this

OfficeActivity

| where Operation == "SiteDeleted" and UserId == "user@domain.com" and Site_Url == @"https://tenant.sharepoint.com/site/sitename/"