Defender for Identity - Health Status updates
MDI Audit Health Issue
Query
CloudAppEvents
| extend WorkLoad = tostring(parse_json(RawEventData).Workload)
| where WorkLoad == "MicrosoftDefenderForIdentity"
| where ActionType == "MonitoringAlertUpdated"
| extend ResultDescription = tostring(RawEventData.ResultDescription)
| extend UserId = tostring(RawEventData.UserId)
| project TimeGenerated, WorkLoad, ActionType,UserId, ResultDescriptionAbout this query
Defender for Identity - Health Status updates
Query Information
Description
Use the below query to get information about Defender for Identity Health Status updates initiated by a user.
References
Microsoft Sentinel
Explanation
This query retrieves information about updates to the health status of Microsoft Defender for Identity initiated by a user. It filters CloudAppEvents data for Microsoft Defender for Identity workload and MonitoringAlertUpdated action type, then projects TimeGenerated, WorkLoad, ActionType, UserId, and ResultDescription fields.
Details
Alex Verboon
Released: May 31, 2024
Tables
CloudAppEvents
Keywords
CloudAppEventsMicrosoftDefenderForIdentityMonitoringAlertUpdatedResultDescriptionUserIdTimeGeneratedWorkLoadActionType
Operators
extendwhereproject