Using KQL for Audit Log Analysis in Entra ID

Using KQL for Audit Log Analysis in Entra ID

First seen 2 Dec 2025, 18:33 UTC •Rakhesh •21.6

Article Content

Browse articles
ThreatCluster

The articles discuss the use of KQL (Kusto Query Language) for analyzing audit logs in Entra ID. One article focuses on troubleshooting function inputs in KQL, while the other details querying user removals from an Entra ID group using audit logs sent to a Log Analytics workspace. Both highlight practical applications of KQL in cybersecurity operations.

How this analysis works

Extracted Entities

1 / 2