Untitled

AuthenticationEvents

| where src_ip in ("10.10.0.114", "10.10.0.86", "10.10.0.86", "10.10.0.20", "10.10.0.109") and result == "Failed Login"

Employees
| where name == "Nancy Roberts"

OutboundNetworkEvents
| where src_ip == "10.10.0.30"
| distinct url

// Finding Nancy Roberts' IP address to check web browsing
Employees
| where name == "Nancy Roberts"
//Nancy's ip address: 10.10.0.30

A great feature of ADX is that you can keep multiple queries in the same pane without needing to open new tabs or windows. Instead of running queries one at a time and losing track, you can stack them in one place, separated by a blank line, and run them individually when needed.

To run a specific query, just highlight the one you want and click Run.

// Find all IT support employees
Employees
| where role contains "IT support"

// Look for logins from IPs used by IT support 
AuthenticationEvents
| where src_ip in ("10.10.0.75", "10.10.0.42", "10.10.0.34", "10.10.0.10", "10.10.0.2")


// Count all failed logins
AuthenticationEvents
| where result == "Failed Login"
| count

let mary_ips =
Employees
| where name has "Mary"
| distinct ip_addr;
OutboundNetworkEvents
| where src_ip in (mary_ips)

saves us doing 2 searches, get marys ip from employees then search those ips in outboundnetworkevents

let mary_username = Employees
| where name has "Mary"
| distinct username;
AuthenticationEvents
| where username in (mary_username)
| count