Defender for Cloud - CloudAuditEvents

CloudAuditEvents | where Timestamp > ago(7d) | where OperationName startswith "Microsoft.Compute/virtualMachines/write" | extend Status = RawEventData["status"], SubStatus = RawEventData["subStatus"] | sample 10

Query Information

Description

The CloudAuditEvents table in the advanced hunting schema contains information about cloud audit events for various cloud platforms protected by the organization's Microsoft Defender for Cloud.

References

Microsoft Defender XDR

To get a sample list of VM creation commands performed in the last seven days:

Explanation

This KQL (Kusto Query Language) query is designed to analyze cloud audit events using Microsoft Defender for Cloud. Here's a simple breakdown of what the query does:

Data Source: It uses the CloudAuditEvents table, which logs audit events related to cloud activities.
Time Frame: The query filters for events that occurred in the last seven days.
Operation Filter: It specifically looks for operations related to the creation of virtual machines, identified by the operation name starting with "Microsoft.Compute/virtualMachines/write".
Data Extraction: The query extracts additional details about each event, specifically the status and subStatus from the raw event data.
Sampling: It randomly selects 10 events from the filtered results to provide a sample list.

In summary, this query retrieves a sample of recent virtual machine creation events from the cloud audit logs, focusing on the last week of activity.

KQL Search