Explanation:
AzureActivity Extend
Explanation = Use AzureActivity because NSG rule changes (operations like Microsoft.Network
/networkSecurityGroups/securityRules/write ) are re corded in the Azure Activity logs. To automatically associate the security principal (the caller) with a Sentinel entity you create a new column AccountCustomEntity and set it to Caller - that is done with the extend operator.
A completed/cleaned-up versio n of the query (showing the filled choices) would look like:
AzureActivity
| where OperationNameValue in ( " Microsoft.Network/networkSecurityGroups/securityRules/write " )
| where ActivityStatusValue == " Succeeded "
| make-series dcount(ResourceId) default=0 on EventSubmissionTimestamp in range(ago(7d), now(), 1d) by Caller
| extend timestamp = todatetime(EventSubmissionTimestamp[0])
| extend AccountCustomEntity = Caller
This produces the anomaly/hunting results grouped by the caller and makes Sentinel treat the Caller value as an account entity for investigations and alert enrichment.