Identity Info Enrichment for Keystone Logon

Igor Oliveira@Pr0fiLeRR

•updated Feb 28, 2026•1•0•18

Enrichment rule pulling identity details from IdentityInfo table. Correlated with IdentityLogonEvents via AccountObjectId. Manager email construction (mgrSplit, ManagerEmail) is handled natively in KQL post-conversion.