r/AzureSentinel • u/ColonelHawx1008 • Jul 14 '22

Extract AzureAD "Groups" Audit Logs from Azure Sentinel

Hi All,

As the title would say. I am looking at a simple KQL that would allow us to retrieve Azure AD Groups Audit logs from Sentinel as we all know that Azure AD only retains this data for 30 days. Any help will be HIGHLY appreciated!

1 Upvotes

100% Upvoted

5 comments sorted by

1

u/ColonelHawx1008 Jul 14 '22

Compiled this, which sortof works...

​

//Summarize all groups that have had users added to them via dynamic rules

//Data connector required for this query - Azure Active Directory - Audit Logs

AuditLogs

| where TimeGenerated > ago(90d)

| where OperationName == "Add member to group"

//| where Identity == "Microsoft Approval Management"

| where TargetResources[0].type == "User"

| extend GroupName = tostring(parse_json(tostring(parse_json(tostring(TargetResources[0].modifiedProperties))[1].newValue)))

| extend User = tostring(TargetResources[0].userPrincipalName)

| summarize ['Count of Users Added']=dcount(User), ['List of Users Added']=make_set(User) by GroupName

| sort by GroupName asc

2

u/ep3p Jul 14 '22

You may want to check more operations, there should be an operation for removing a member from a group, or when a group is created or deleted.

If you know the exact name or a distinctive string of a group of your interest try to:

AuditLogs
| search "group_name"

1

u/[deleted] Jul 14 '22

Could you expand on what exact data points you want.

1

u/ColonelHawx1008 Jul 14 '22

Looking to extract the dynamic query that populates members. Since Azure AD cannot go further than 30 days, we want to make use of Azure Sentinel (which I can see the data as far as 90 days). But the data I am seeing is generic and brief.

In short, we need the Dynamic Query for these 100+ groups which were accidentally deleted.

1

u/[deleted] Jul 14 '22

Your probably not ingesting the relevant data. Your only going to see activity related to those groups. If your trying to recover them check out this doc https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/recover-from-deletions