Sdílet prostřednictvím

Dotazy na tabulku IdentityQueryEvents

  • Článek

Informace o používání těchto dotazů na webu Azure Portal najdete v kurzu služby Log Analytics. Informace o rozhraní REST API najdete v tématu Dotaz.

Dotazy SAMR do služby Active Directory

Najděte procesy, které odesílaly dotazy SAMR do služby Active Directory.

// Find processes that sent SAMR queries to Active Directory
IdentityQueryEvents
| where ActionType == "SAMR query"
//    and isnotempty(AccountName)
| project QueryTime = Timestamp, DeviceName, AccountName, Query, QueryTarget
| join kind=inner (
DeviceProcessEvents
| extend DeviceName = toupper(trim(@"\..*$",DeviceName))
//| where InitiatingProcessCommandLine contains "net.exe"
| project ProcessCreationTime = Timestamp, DeviceName, AccountName,
     InitiatingProcessFileName , InitiatingProcessCommandLine
    ) on DeviceName//, AccountName
| where ProcessCreationTime - QueryTime between (-2m .. 2m)
| project QueryTime, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, Query, QueryTarget //,AccountName
 | limit 100