Setup new Azure Data Explorer Table from
This document details the steps needed to create a new Azure Data Explorer table for ingested logs from Azure Active Directory.
All ingested logs from AAD are written to a table in ADX named
MyAADLogs, this table is overwritten over and over thus the need to create a parsing function which is used to filter the new ingested logs by their
category and construct new records out of it to then write them to their corresponding tables.
First step is to query the
MyAADLogs table filtering by the
record.category property and expanding those properties of interest from each record. We can query the same logs using Log Analytics for comparison. For example, for