Query User Identity and Risk Information

Shadows VMB@Vemorian_Mort

•updated Jul 10, 2026•13•0•33

This KQL rule queries the IdentityInfo table to retrieve the most recent identity, risk, and criticality profile for a specific user account. It maps raw criticality data into a human-readable format and extracts key identity attributes such as department, job title, and assigned roles.