I am in Microsoft Azure Sentinel running a query against that OfficeActivity table. Guids are showing up in the ClientAppId column. I want to use these IDs to lookup details of the client application, however I cannot find a corresponding application in either the App Registration table nor the Enterprise Applications table.

Where else could these ClientAppIds be found?

Query:

OfficeActivity
| where ClientAppId != ""
0

There are 0 best solutions below