The Google Cloud Security Community is upgrading platforms! Read more and check out our FAQ.

[mccrilb]

for example:

AzureActivity
| where Caller in (```user```)
| where SubscriptionId == "subscriptionID"
| where ResourceGroup in (```Resource Group```)

Is there a way to do this now, or a feature in the works? We use KQL queries in "Execute a custom hunting query in Microsoft 365 Defender." We have a need to also be able to run them in Azure