Daily Defender News
Aboutmerill.net
Microsoft Defender XDR
Hunting and detection

CloudKeyVaultEvents table in the advanced hunting schema - Microsoft Defender XDR | Microsoft Learn

28 October 2026New feature+159 / −0 lines

In brief

Microsoft added documentation for the CloudKeyVaultEvents table, which contains Azure Key Vault operations, access identities, request details, and operation results. The page includes schema fields and sample queries.

What Defender admins need to know

Administrators can use the table to investigate and hunt for Azure Key Vault activity. Queries require Microsoft Defender for Cloud; no administrator action is stated.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

new file mode 100644

layout: Conceptual title: CloudKeyVaultEvents table in the advanced hunting schema - Microsoft Defender XDR | Microsoft Learn canonicalUrl: https://learn.microsoft.com/en-us/defender-xdr/advanced-hunting-cloudkeyvaultevents-table breadcrumb_path: /defender-xdr/breadcrumb/toc.json permissioned-type: public feedback_system: Standard feedback_product_url: https://techcommunity.microsoft.com/t5/microsoft-365-defender/bd-p/MicrosoftThreatProtection uhfHeaderId: MSDocsHeader-MicrosoftDefender manager: orspodek description: Learn about the CloudKeyVaultEvents table, which contains Azure Key Vault operations for investigation and threat hunting in Microsoft Defender XDR. author: EitanBr-2025 ms.author: eitanbremler ms.service: defender-xdr ms.subservice: adv-hunting ms.topic: reference ms.date: 2026-10-28T00:00:00.0000000Z ai-usage: ai-assisted ms.collection:

CloudKeyVaultEvents table in the advanced hunting schema - Microsoft Defender XDR | Microsoft Learn

The CloudKeyVaultEvents table in the advanced hunting schema contains information about operations performed against Azure Key Vault resources. Use this reference and the sample queries to investigate Key Vault access, caller identities, and operation results in Microsoft Defender XDR.

Important

Some information relates to a prereleased product that might be substantially modified before commercial release. Microsoft makes no warranties, express or implied, with respect to this information.

This advanced hunting table is populated by records from Microsoft Defender for Cloud. If your organization doesn't have Microsoft Defender for Cloud, queries that use the table won't work or return any results. Microsoft Defender for Key Vault protection must be enabled for the relevant Azure subscriptions. For more information about prerequisites for integrating Defender for Cloud with Microsoft Defender XDR, see Microsoft Defender XDR integration.

For information on other tables in the advanced hunting schema, see the advanced hunting reference.

Column nameData typeDescription
TimestampdatetimeDate and time when the record was generated.
ReportIdstringGUID that identifies the record in this table.
DataSourcestringSource of the Key Vault logs.
SubscriptionIdstringUnique identifier of the Azure subscription.
AzureResourceIdstringAzure resource ID of the key vault.
LocationstringAzure region where the key vault is located.
ActivityNamestringName of the Key Vault operation performed.
IPAddressstringIP address from which the key vault was accessed.
HttpStatusCodeintHTTP status code returned by the Key Vault operation.
ResultSignaturestringResult signature of the Key Vault operation.
AccountTenantIdstringUnique identifier of the Microsoft Entra tenant associated with the accessing account.
AccountApplicationIdstringApplication ID associated with the Key Vault access.
AccountTypestringType of account used to access the key vault.
AccountObjectIdstringObject ID of the identity accessing the key vault.
AccountUpnstringUser principal name of the user accessing the key vault.
RequestUristringURI of the Key Vault request.
VaultNamestringName of the key vault.
UserAgentHeaderstringUser-agent string from the HTTP request.
AdditionalFieldsdynamicAdditional information about the event in JSON format.

Sample queries

These queries are investigation examples, not validated detection rules. A failed request or a high operation count doesn't by itself establish malicious activity.

Review recent Key Vault operations

List the 100 most recent operations from the past day, including the accessing identity and operation result.

CloudKeyVaultEvents
| where Timestamp > ago(1d)
| top 100 by Timestamp desc
| project Timestamp, ReportId, SubscriptionId, AzureResourceId,
    VaultName, ActivityName, AccountType, AccountObjectId,
    AccountUpn, AccountApplicationId, IPAddress,
    HttpStatusCode, ResultSignature, RequestUri

Discover operation names in your environment

Identify the operation names present in the data before creating operation-specific queries.

CloudKeyVaultEvents
| where Timestamp > ago(7d)
| summarize Operations = count() by ActivityName
| order by Operations desc

Investigate unauthorized and forbidden requests

Review operations that returned HTTP status code 401 (Unauthorized) or 403 (Forbidden). Use the caller identity, source IP address, and request URI to investigate whether the failures are expected.

CloudKeyVaultEvents
| where Timestamp > ago(7d)
| where HttpStatusCode in (401, 403)
| project Timestamp, ReportId, AzureResourceId, VaultName,
    ActivityName, AccountObjectId, AccountUpn,
    AccountApplicationId, IPAddress, HttpStatusCode,
    ResultSignature, RequestUri
| order by Timestamp desc

Find callers with frequent request failures

Find caller and vault combinations with more than 20 requests returning HTTP 4xx or 5xx status codes in an hour. Adjust the illustrative threshold to match normal activity in your environment. Group by the resource ID as well as the vault name to distinguish resources across subscriptions.

CloudKeyVaultEvents
| where Timestamp > ago(7d)
| where HttpStatusCode between (400 .. 599)
| summarize FailedOperations = count(),
    Activities = make_set(ActivityName, 50)
    by bin(Timestamp, 1h), AzureResourceId, VaultName,
    AccountObjectId, AccountApplicationId, IPAddress
| where FailedOperations > 20
| order by FailedOperations desc

Summarize successful operations by identity and vault

Review successful requests by caller and vault. HTTP 2xx responses are treated as successful requests in this example.

CloudKeyVaultEvents
| where Timestamp > ago(7d)
| where HttpStatusCode between (200 .. 299)
| summarize SuccessfulOperations = count(),
    Activities = make_set(ActivityName, 50),
    SourceIPs = make_set(IPAddress, 50)
    by AzureResourceId, VaultName, AccountObjectId,
    AccountUpn, AccountApplicationId
| order by SuccessfulOperations desc

\ No newline at end of file