Now You See Me: AADGraphActivityLogs

KQL hunting queries for the new AADGraphActivityLogs table to detect Entra ID reconnaissance tooling based on UserAgent, RequestUri, and volume.

Cloudbrothers