✄𐘗
text code block:
✄𐘗FROM logs-azure.auditlogs-* metadata _id, _version, _index
| WHERE (azure.auditlogs.operation_name == "Consent to application"
    OR event.action == "Consent to application")
  AND event.outcome == "success"

| MV_EXPAND azure.auditlogs.properties.additional_details.value
| WHERE azure.auditlogs.properties.additional_details.value
    RLIKE "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
| RENAME azure.auditlogs.properties.additional_details.value AS Esql.app_id

| STATS
    Esql.timestamp_first_seen = MIN(@timestamp),
    Esql.timestamp_last_seen = MAX(@timestamp),
    Esql.app_display_name_values = VALUES(`azure.auditlogs.properties.target_resources.0.display_name`),
    Esql.service_principal_id_values = VALUES(`azure.auditlogs.properties.target_resources.0.id`),
    Esql.is_admin_consent_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.0.new_value`),
    Esql.is_app_only_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.1.new_value`),
    Esql.on_behalf_of_all_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.2.new_value`),
    Esql.consent_context_tags_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.3.new_value`),
    Esql.consent_permissions_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.4.new_value`),
    Esql.consent_reason_values = VALUES(`azure.auditlogs.properties.target_resources.0.modified_properties.5.new_value`),
    Esql.user_id_values = VALUES(azure.auditlogs.properties.initiated_by.user.id),
    Esql.ip_address_values = VALUES(azure.auditlogs.properties.initiated_by.user.ipAddress),
    Esql.tenant_id_values = VALUES(azure.tenant_id),
    Esql.correlation_id_values = VALUES(azure.auditlogs.properties.correlation_id),
    Esql.event_count = COUNT(*)
    BY azure.auditlogs.properties.initiated_by.user.userPrincipalName, Esql.app_id

| WHERE Esql.timestamp_first_seen >= NOW() - 9 minutes
    OR Esql.consent_reason_values LIKE "*Risky application detected*"
| KEEP Esql.*, azure.*