Forum Discussion
Solved
Query to Fetch Sentinel Admin Activities from Sentinel
Hello, I would like to know if there is a specific query available to fetch Sentinel admin activities directly from Sentinel itself. Thank you!
Does this work for you?
AzureActivity | where CategoryValue == "Administrative" | where OperationNameValue has "MICROSOFT.OPERATIONALINSIGHTS"
SteveBostedor
Microsoft
MicrosoftDoes this work for you?
AzureActivity
| where CategoryValue == "Administrative"
| where OperationNameValue has "MICROSOFT.OPERATIONALINSIGHTS"
