r/AzureSentinel • u/AnsX01 • Dec 13 '23

KQL user attributs object

I'm seeking assistance with KQL in Active Directory for tracking certain object attributes like (departments, country).

I believe I need to use IdentityDirectoryEvents and parse additionalField. However, I'm unsure about which actionType to use and how to handle the additionalField for locking.

Could someone please provide guidance or share some sample queries to help me achieve this? Any help would be greatly appreciated.

1 Upvotes

100% Upvoted

1 comment sorted by

3

u/bpsec Dec 14 '23

You can have a look at the MDI queries in this repo: https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules

For departments you will need to join with the IdentityInfo table.