How do I run a KQL query for security alerts/incidents in Microsoft Sentinel for a user or list of users

Question

New to KQL queries here. Trying to query for security alerts or incidents based off a set of users in Microsoft Sentinel.

Would I create a Watchlist of names and identifiers (emails or user ID's) and run a query on that Watchlist or build a query including all the users? Is this possible to do and what would that look like?

Any help would be greatly appreciated!

Answer 1

You can create a Watchlist in the Microsoft 365 Defender portal or through the Microsoft Graph Security API:

SecurityAlert 
| where AccountName in (datatable(Identifier:string)["******@mydomain.com", "******@mydomain.com"])

Also, you can directly add it in your query

SecurityAlert
| where AccountName in ("user1@example.com", "user2@example.com")

Answer 2

@Jarret McGraw

Thank you for your post and I apologize for the delayed response!

I understand that you're trying to create a new KQL query for Security Alerts or Incidents based off a set of users within Microsoft Sentinel. To hopefully help point you in the right direction or resolve your issue, I'll share my findings below.

---

Findings:

When it comes to creating a query for Security Alerts or Incidents based off a set of users within MS Sentinel, you can definitely leverage a Watchlist and query for the users' name or ID.

I created a sample query for your reference which compares the upn field to the values in the userWatchlist table using the in operator. This should return your security alerts or incidents that were generated in the last 7 days and where the user that triggered the alert is in the Watchlist.

• Note: This query assumes that the Sid field is always the third entity in the Entities array. If the order of the array changes, this may not work as expected. Additionally, the "in" operator is case-sensitive, so you'll want to ensure your values in the Watchlist match

Watchlist Data:

//Set userWatchList variable with the SearchKey column from the Watchlist
let userWatchlist = (_GetWatchlist('Users') | project SearchKey);

//Using the SecurityAlert table:
//Find all security alerts or incidents that were generated in the last 7 days
//Parse the Entities JSON Output
//Set the upn variable with the Entities Object ID that triggered the alert
//Compare the upn field to the values in the userWatchlist table.

SecurityAlert
| where TimeGenerated > ago(7d)
| extend EntityValues = parse_json(Entities)
| extend upn = EntityValues[2].Sid
| where upn in (userWatchlist)

---

Additional Links:

• Build queries or detection rules with watchlists in Microsoft Sentinel
• Create watchlists in Microsoft Sentinel

I hope this helps!

If you have any other questions, please let me know. Thank you for your time and patience throughout this issue.

---

If the information helped address your question, please Accept the answer. This will help us and also improve searchability for others in the community who might be researching similar information.