EXAMPLES · Azure Kusto Irql · microsoft/azure-skills · Skills Docs

EXAMPLES · Azure Kusto Irql · microsoft/azure-skills · Skills Docs

#	Ask This	What It Does
1	“Find all failed logins in ValdyTimes”	Basic `Get_Event_Authentication` with filter
2	“Which sender domains are emailing executives?”	`Get_Email` -> `Extract_Email_Sender_Domain` -> `Enrich_Username_Employee`
3	“Show me users with more than 20 failed logins and their job roles”	`Get_Event_Authentication` -> `summarize` -> `Enrich_Username_Employee`
4	“Find powershell or rundll32 execution on any host”	`Get_Event_Process` with command-line filter
5	“What domains are being accessed by IPs with failed logins?”	Auth -> distinct IPs -> `Enrich_Ip_Domain`
6	“Find authentication from external IPs”	`Get_Event_Authentication_All` with RFC1918 exclusion
7	“A file called Raisin_Kane appeared on some hosts. What processes ran on those hosts?”	`Get_Event_FileCreation_All` -> victim hosts -> `Get_Event_Process`
8	“Which users are logging in from the most distinct IPs?”	`Get_Event_Authentication_All` -> `summarize dcount(ClientIp) by Username`

#	Ask This	What It Does
1	“Find all failed logins in AzureCrest”	Raw `AuthenticationEvents` with `result` filter
2	“Which sender domains are emailing executives in AzureCrest?”	`Email` -> extract domain -> join `Employees`
3	“Show users with more than 20 failed logins and their roles in AzureCrest”	`AuthenticationEvents` -> `summarize` -> join `Employees`
4	“Find powershell execution across all hosts in AzureCrest”	`ProcessEvents` with `process_commandline` filter
5	“What domains are accessed by IPs with failed logins in AzureCrest?”	`AuthenticationEvents` -> distinct `src_ip` -> join `PassiveDns`
6	“Find authentication from external IPs in AzureCrest”	`AuthenticationEvents` with RFC1918 exclusion