Reading · Kusto Insights · RSS Amplifier

Welcome to a new Monthly Update. We will go through some news and the latest queries. The goal is to provide you, the reader, a quick summary of what is going on in the world of KQL including News and Blogs from the Community as well as from Microsoft.

Hunt domains with Seamless SSO enabled in Entra ID Connect

By: Robbe Van den Daele [GitHub, LinkedIn]

// Get all device info we can find
let devices = (
    DeviceInfo
    // Search for 14 days
    | where TimeGenerated > ago(14d)
    // Normalize DeviceName
    // --> if it is an IP Address we keep it
    // --> If it is not an IP Address we only use the hostname for correlation
    | extend DeviceName = iff(ipv4_is_private(DeviceName), DeviceName, tolower(split(DeviceName, ".")[0]))
    // Only get interesting data
    | distinct DeviceName, OSPlatform, OSVersion, DeviceId, OnboardingStatus, Model, JoinType
);
IdentityLogonEvents
// Get the last 30 days of logon events on Domain Controllers
| where TimeGenerated > ago(30d)
// Search for Seamless SSO events
| where Application == "Active Directory" and Protocol == "Kerberos"
| where TargetDeviceName == "AZUREADSSOACC"
// Save the domain name of the Domain Controller
| extend OnPremisesDomainName = strcat(split(DestinationDeviceName, ".")[-2], ".", split(DestinationDeviceName, ".")[-1])
// Normalize DeviceName
// --> if it is an IP Address we keep it
// --> If it is not an IP Address we only use the hostname for correlation
| extend DeviceName = iff(ipv4_is_private(DeviceName), DeviceName, tolower(split(DeviceName, ".")[0]))
// Only use interesting data and find more info regarding the source device
| distinct AccountUpn, OnPremisesDomainName, DeviceName
| join kind=leftouter devices on DeviceName
| project-away DeviceName1
// Check if Seamless SSO usage is expected
| extend ['Seamless SSO Expected'] = case(
    // Cases where we do not expect Seamless SSO to be used
    JoinType == "Hybrid Azure AD Join" or
    JoinType == "AAD Joined" or
    JoinType == "AAD Registered", "No",
    // Cases where we do expect Seamless SSO to be used
    JoinType == "Domain Joined" or
    (OSPlatform startswith "Windows" and toreal(OSVersion) < 10.0) , "Yes",
    // Cases that need to be verified
    "Unknown (to verify)"
)

Source: GitHub

We've handpicked a few blog posts for their insightful content and relevance, yet we acknowledge the wealth of quality submissions from the KQL community. While we can't feature every post, each contribution is valued and vital to our collective knowledge. Stay inspired and keep sharing your perspectives!

Detect threats using GraphAPIAuditEvents - Part 3 - For a long time now, defenders had the ability to monitor behavior of human- and workload identities in Entra tenants not only through AuditLogs but with high level of insight with the MicrosoftGraphActivityLogs logs. The last two articles of this series gave you detection ideas and hunting queries for this logs source and were meant as a kick starter for detection engineers. But in the end the high cost of this log prevented many companies from putting it into operation. This is about to change with the release of GraphAPIAuditEvents logs in the XDR portal.

GraphApiAuditEvents: The new Graph API Logs - The new GraphApiAuditEvents table in Advanced Hunting have been in Public Preview since July this year. These valuable logs give new insights into the activities that are performed using the Graph API in your tenant, which makes it a table you definitly want to explore in the upcoming weeks. The GraphApiAuditEvents table is the ‘free’ version of the MicrosoftGraphActivityLogs table that was available in Sentinel. The GraphApiAuditEvents enables more organizations to use these valuable logs without burning their budget.

Breaking down the Microsoft Defender External Attack Surface Management opportunities for queries in Advanced Hunting & Log Analytics Workspace - Following latest Microsoft Defender XDR July 2025 news, it was announced that Microsoft Defender External Attack Surface Management (MDEASM) can be integrated within the Exposure Management (XSPM) blade in Unified Security Operations platform. This brings a set of new opportunities for KQL queries development, inside XSPM.

Investigating M365 Copilot Activity with Sentinel & Defender XDR - You can use the CloudAppEvents table in Defender XDR and Sentinel to track Microsoft 365 Copilot activity with KQL, giving you visibility into who triggered it, when, and with what sensitivity context. The audit logs from Copilot flow into Defender’s schema and then into Sentinel, which makes it easy to investigate with queries or build dashboards. There’s even a starter query example that filters on Microsoft 365 Copilot Chat interactions so you can get results right away. It’s a handy way to bring AI-related activity into your KQL investigations without extra setup.

Microsoft Sentinel’s New Data Lake: Cut Costs & Boost Threat Detection - Sentinel now includes a purpose-built Data Lake that cuts your log retention costs by up to 85 percent while letting you keep months or even years of security data handy for deep KQL queries—no more painful trade-offs between visibility and budget. It supports over 350 native connectors and keeps your raw data in open formats, which means you can run big, flexible analytics via KQL, Spark, or notebooks across massive datasets. Plus, Defender Threat Intelligence is being baked in for free starting October 2025, giving you richer context to correlate historic data with live threat intel—all in the familiar Sentinel environment. This is a genuine upgrade for Kusto users who want scalable, cost-smart threat hunting and compliance without wrestling with complex setups or losing query power.

Check out some of the latest queries added to KQLSearch.com:

Michalis Michalos - X & GitHub: