KQL Search

Query Details

Office Activity Shared Teams Channel Created

Query

//Detect when a shared Teams channel is created

//Data connector required for this query - Office 365

OfficeActivity
| where Operation == "ChannelAdded"
| where ChannelType == "Shared"
| project TimeGenerated, Actor=UserId, TeamName, ChannelType, ChannelName

Explanation

This query is looking for when a shared Teams channel is created. It uses the Office 365 data connector and filters the OfficeActivity table for entries where the Operation is "ChannelAdded" and the ChannelType is "Shared". The query then projects the TimeGenerated, Actor (UserId), TeamName, ChannelType, and ChannelName.

Details

Matt Zorich profile picture

Matt Zorich

Released: June 17, 2022

Tables

OfficeActivity

Keywords

OfficeActivityOperationChannelAddedChannelTypeSharedTimeGeneratedActorUserIdTeamNameChannelName

Operators

| where==| project

Actions

GitHub