KQL Search

Query Details

A new Lighthouse service provider was added

New Lighthouse Service Provider Was Added

Query

AzureActivity
| where OperationNameValue =~ "Microsoft.ManagedServices/registrationAssignments/Write"
| extend timestamp = TimeGenerated, AccountCustomEntity = Caller, IPCustomEntity = CallerIpAddress

Explanation

This query is looking for Azure activity related to adding a new service provider using Lighthouse. It checks for operations with the name "Microsoft.ManagedServices/registrationAssignments/Write" and extracts the timestamp, account, and IP information. Incidents will be created for each alert, and there is no grouping or suppression enabled. The query runs every 30 minutes and looks back 5 hours for matching events.