Function: ListAllActionsAndOperations()
List All Actions And Operations
Query
// List all ActionTypes, Operations and OperationNames in a single view. This can be used to get insight into the activities that are logged.
let ListAllActionsAndOperations = () {
union *
| extend Action = coalesce(Operation, OperationName, OperationNameValue, ActionType)
| where isnotempty(Action)
| distinct Action, Type
};
// Example
ListAllActionsAndOperationsAbout this query
Function: ListAllActionsAndOperations()
Query Information
Description
If you want to get quick insight into all the ActionTypes, Operations and OperationNames in your Sentinel environment, the function below can be used. This function summarizes all different actions in different tables in a single view, which is optimal when you want to quickly know if some activities can be seen/detected in your environment.
Note: This query only works in Sentinel and NOT in Defender XDR, if you have Unified XDR Enabled it will also work in Defender XDR
References
- https://learn.microsoft.com/en-us/azure/sentinel/data-source-schema-reference
- https://learn.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-schema-tables?view=o365-worldwide
Defender XDR
Sentinel
// List all ActionTypes, Operations and OperationNames in a single view. This can be used to get insight into the activities that are logged.
let ListAllActionsAndOperations = () {
union *
| extend Action = coalesce(Operation, OperationName, OperationNameValue, ActionType)
| where isnotempty(Action)
| distinct Action, Type
};
// Example
ListAllActionsAndOperations
Explanation
The query you're looking at is designed to provide a comprehensive overview of all the different actions and operations logged in your Microsoft Sentinel environment. Here's a simplified breakdown of what it does:
-
Purpose: The function
ListAllActionsAndOperations()is used to gather and display all the different types of actions and operations that are recorded in your Sentinel environment. This is useful for quickly understanding what activities are being tracked and can be detected. -
Functionality:
- The query uses the
union *operation to combine data from multiple tables in your Sentinel environment. - It then uses the
extendfunction to create a new column calledAction. This column is populated with the first non-empty value found amongOperation,OperationName,OperationNameValue, andActionType. - The
where isnotempty(Action)clause filters out any records where theActionfield is empty, ensuring that only meaningful data is included. - Finally, the
distinct Action, Typeoperation is used to remove duplicate entries, providing a unique list of actions and their types.
- The query uses the
-
Usage: By running this function, you can quickly see all the different actions and operations that are logged in your environment, helping you to understand what activities are being monitored.
-
Compatibility: The query is specifically designed for use in Microsoft Sentinel. However, if you have Unified XDR enabled, it will also work in Microsoft Defender XDR.
In summary, this query is a tool for gaining quick insights into the types of activities being logged in your security environment, helping you to ensure that important actions are being tracked.
Details
Bert-Jan Pals
Released: October 20, 2024
Tables
Keywords
Operators