Azure Sentinel - 日志分析 - 帮助 - 按位置和用户查找 3 个月内所有成功的天蓝色标志

如何解决Azure Sentinel - 日志分析 - 帮助 - 按位置和用户查找 3 个月内所有成功的天蓝色标志

我是 Sentinel/工作分析和 KMQ 的新手。我一直在试图找出一个查询，以从 azure 活动登录中按用户和位置获取所有成功登录。我希望你能帮助我或给我一些参考。

我尝试使用 github 和 Sentinel 仪表板中的一些示例。我可以按国家/地区获取所有失败的用户登录但不成功。我打算将此日志数据用于地理封锁活动。

非常感谢您的帮助，对于这样的初学者问题，我们深表歉意。

提前致谢

解决方法

let data = SigninLogs
    | extend AppDisplayName = iff(AppDisplayName == '','Unknown',AppDisplayName)
    | where AppDisplayName in ('*') or '*' in ('*')
    | where UserDisplayName in ('*') or '*' in ('*')
    | extend Country = tostring(LocationDetails.countryOrRegion)
    | extend City = tostring(LocationDetails.city)
    | extend errorCode = Status.errorCode
    | extend SigninStatus = case(errorCode == 0,"Success",errorCode == 50058,"Pending user action",errorCode == 50140,errorCode == 51006,errorCode == 50059,errorCode == 65001,errorCode == 52004,errorCode == 50055,errorCode == 50144,errorCode == 50072,errorCode == 50074,errorCode == 16000,errorCode == 16001,errorCode == 16003,errorCode == 50127,errorCode == 50125,errorCode == 50129,errorCode == 50143,errorCode == 81010,errorCode == 81014,errorCode == 81012,"Failure")
    | where SigninStatus == '*' or '*' == '*' or '*' == 'All Sign-ins'
    | where details.Type == '*' or (details.Type == 'Country' and Country == details.Name) or (details.Type == 'City' and City == details.Name)
    | where UserPrincipalName contains "example.com"
    | where Country != "AU";
    //| where SigninStatus contains "success";
data
| top 10000 by TimeGenerated desc
//| extend TimeFromNow = now() - TimeGenerated
//| extend TimeAgo = strcat(case(TimeFromNow < 2m,strcat(toint(TimeFromNow / 1m),' seconds'),TimeFromNow < 2h,' minutes'),TimeFromNow < 2d,//strcat(toint(TimeFromNow / 1h),' hours'),strcat(toint(TimeFromNow / 10d),' days')),' ago')
| project User = UserDisplayName,['Sign-in Status'] = strcat(iff(SigninStatus == 'Success','✔️','❌'),' ',SigninStatus),['Sign-in Time'] = TimeGenerated,App = AppDisplayName,['Error code'] = errorCode,['Result type'] = ResultType,['Result signature'] = ResultSignature,['Result description'] = ResultDescription,['Conditional access policies'] = ConditionalAccessPolicies,['Conditional access status'] = ConditionalAccessStatus,['Operating system'] = DeviceDetail.operatingSystem,Browser = DeviceDetail.browser,['Country or region'] = LocationDetails.countryOrRegion,['State'] = LocationDetails.state,['City'] = LocationDetails.city,['Time generated'] = TimeGenerated,Status,['User principal name'] = UserPrincipalName,['ClientAppUsed'] = ClientAppUsed````