How can we get sentinel entities from logs what is the KQL Query we to for Entities , Sentinel ID information

Question

Need KQL Query to logs for Entities , Sentinel ID, Created Date

Created Date Sentinel ID Entities Last Updated User Assigned information

Answer 1

You can refer to SecurityEvent that contains the columns list of SecurityEvent Table, from there you can select the columns from the table within the query.

Use project command of KQL:

SecurityEvent 
| project TimeGenerated, CreatedDate, ResourceID