KQL Search

Query Details

A new Lighthouse service provider was added

New Lighthouse Service Provider Was Added

Query

AzureActivity
| where OperationNameValue =~ "Microsoft.ManagedServices/registrationAssignments/Write"
| extend timestamp = TimeGenerated, AccountCustomEntity = Caller, IPCustomEntity = CallerIpAddress

Explanation

This query is looking for Azure activity related to adding a new service provider using Lighthouse. It checks for operations with the name "Microsoft.ManagedServices/registrationAssignments/Write" and extracts the timestamp, account, and IP information. Incidents will be created for each alert, and there is no grouping or suppression enabled. The query runs every 30 minutes and looks back 5 hours for matching events.

Details

Fabian Bader profile picture

Fabian Bader

Released: July 25, 2023

Tables

AzureActivity

Keywords

DevicesIntuneUser

Operators

|==~whereextendTimeGeneratedCallerCallerIpAddressfalsetrueenabledreopenClosedIncident5hAllEntities[]SingleAlertAccountFullNameIPAddressAzureResourceResourceIdSubscriptionId

Severity

Informational

Tactics

Persistence

Frequency: 30m

Period: 30m

Actions

GitHub