KQL Search

This query is designed to analyze audit logs from Microsoft Entra Connect Sync, specifically focusing on administrative actions. Here's a simplified breakdown of what the query does:

1. Data Source: It looks at security events where the source is "Entra Connect Admin Actions."

2. Event Filtering: It filters events based on specific Event IDs that are related to administrative actions. These IDs are specified in the query to capture relevant events.

3. XML Parsing: The query extracts and parses XML data from the event logs to make it easier to work with.

4. Data Extraction: It extracts specific fields from the parsed data, such as:

   • ActionType: The type of action performed.
   • AuditEventType: The type of audit event.
   • Category: The category of the event.
   • Name: The name associated with the event.
   • Status: The status of the action.
   • EventJsonTime: The timestamp of the event.
   • User: The user who performed the action.
   • Details: Additional details about the event.

5. Output: The query projects (selects) these fields along with the time the event was generated and the Event ID.

6. Sorting: Finally, it sorts the results by the time the event was generated, in descending order, so the most recent events appear first.

This query is useful for monitoring and auditing administrative actions in Microsoft Entra Connect Sync, helping administrators track changes and actions taken within the system.