Skip to content

Commit c62cf04

Browse files
chadmcoxchadmcox
authored
Create Get x509 Users
1 parent b84551b commit c62cf04

1 file changed

Lines changed: 7 additions & 0 deletions

File tree

‎Log Analytics/Userful Strong Auth Statistics KQL/Get x509 Users‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
SigninLogs
2+
| where TimeGenerated > ago(30d) and AuthenticationDetails contains 'X.509 Certificate'
3+
| mv-expand todynamic(AuthenticationDetails)
4+
| extend ['Authentication Method'] = tostring(AuthenticationDetails.authenticationMethod)
5+
| where ['Authentication Method'] == 'X.509 Certificate'
6+
| extend TrustedLocation = tostring(iff(NetworkLocationDetails contains 'trustedNamedLocation', 'trustedNamedLocation',''))
7+
| distinct ['Authentication Method'], AppDisplayName, UPN = tolower(UserPrincipalName), ConditionalAccessStatus, AuthenticationRequirement, ResultType, ResultDescription, TrustedLocation, IPAddress, AutonomousSystemNumber, UserAgent

0 commit comments

Comments
 (0)