Identity Enrichment for RiskyUsers Action Detection

Igor Oliveira@Pr0fiLeRR

•updated Feb 28, 2026•1•0•22

Enrichment rule pulling identity details from IdentityInfo table. Correlated with AuditLogs via AccountUPN to enrich admin and target user identity details including department and job title. Used in correlation with Rule 09198296-c7e9-43a7-b85f-6aaa70d281c5 via correlation rule 5841b08f-f363-4139-a70a-5cc91e13efc3. Note: Multiple join fallback logic (by UPN, last name, full name) and StrippedAdminName prefix removal are handled natively in KQL.